From debbugs-submit-bounces@debbugs.gnu.org Mon Feb 10 04:33:17 2020 Received: (at submit) by debbugs.gnu.org; 10 Feb 2020 09:33:17 +0000 Received: from localhost ([127.0.0.1]:53708 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1j15RN-0004Eo-DC for submit@debbugs.gnu.org; Mon, 10 Feb 2020 04:33:17 -0500 Received: from lists.gnu.org ([209.51.188.17]:36056) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1j15RL-0004Eg-Tw for submit@debbugs.gnu.org; Mon, 10 Feb 2020 04:33:16 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:45145) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1j15RK-00057K-96 for bug-guix@gnu.org; Mon, 10 Feb 2020 04:33:15 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50 autolearn=disabled version=3.3.2 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1j15RJ-00025T-BK for bug-guix@gnu.org; Mon, 10 Feb 2020 04:33:14 -0500 Received: from mail.choca.pics ([80.67.172.235]:37066) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1j15RJ-00022s-4x for bug-guix@gnu.org; Mon, 10 Feb 2020 04:33:13 -0500 Received: from localhost (localhost.localdomain [IPv6:::1]) by mail.choca.pics (Postfix) with ESMTP id 01A72181929E0 for ; Mon, 10 Feb 2020 10:33:11 +0100 (CET) Received: from mail.choca.pics ([IPv6:::1]) by localhost (mail.choca.pics [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id DgJwouKsyUm2 for ; Mon, 10 Feb 2020 10:33:10 +0100 (CET) Received: from localhost (localhost.localdomain [IPv6:::1]) by mail.choca.pics (Postfix) with ESMTP id 910C8181929C9 for ; Mon, 10 Feb 2020 10:33:10 +0100 (CET) X-Virus-Scanned: amavisd-new at choca.pics Received: from mail.choca.pics ([IPv6:::1]) by localhost (mail.choca.pics [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id X-5dqbTxJYsu for ; Mon, 10 Feb 2020 10:33:10 +0100 (CET) Received: from luz4 (lfbn-ren-1-1414-74.w90-27.abo.wanadoo.fr [90.27.133.74]) by mail.choca.pics (Postfix) with ESMTPSA id 5A7EB18192B26 for ; Mon, 10 Feb 2020 10:33:10 +0100 (CET) From: Damien Cassou To: bug-guix@gnu.org Subject: Adding openvpn client configurations to guix system Date: Mon, 10 Feb 2020 10:33:08 +0100 Message-ID: <87blq63hyj.fsf@cassou.me> MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 80.67.172.235 X-Spam-Score: 0.2 (/) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.8 (/) Hi, both OpenVPN and NetworkManager read network configurations from /etc. This should make it possible to configure your favorite VPN client configurations (and maybe wifi access points) in your /etc/config.scm. An OpenVPN client connection typically consists of *.key files, *.pem files and *.crt files. These should be placed under /etc/openvpn/client/. Each OpenVPN client connection must be declared at the Network manager level too. This means adding a *.nmconnection file in /etc/NetworkManager/system-connections/. It would be great if Guix could make that possible from my /etc/config.scm file. Thank you for your great work! -- Damien Cassou "Success is the ability to go from one failure to another without losing enthusiasm." --Winston Churchill From debbugs-submit-bounces@debbugs.gnu.org Mon Feb 10 07:31:57 2020 Received: (at 39542) by debbugs.gnu.org; 10 Feb 2020 12:31:57 +0000 Received: from localhost ([127.0.0.1]:53786 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1j18EH-0003Ue-3T for submit@debbugs.gnu.org; Mon, 10 Feb 2020 07:31:57 -0500 Received: from lepiller.eu ([89.234.186.109]:40366) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1j18EE-0003Rw-Gr for 39542@debbugs.gnu.org; Mon, 10 Feb 2020 07:31:55 -0500 Received: from lepiller.eu (localhost [127.0.0.1]) by lepiller.eu (OpenSMTPD) with ESMTP id f480b884; Mon, 10 Feb 2020 12:31:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=lepiller.eu; h=date :in-reply-to:references:mime-version:content-type :content-transfer-encoding:subject:to:from:message-id; s=dkim; bh=EkCCq9VRuNTimN2QAe20fw5qPuo=; b=PnCoBLxfFlvoldRJ7OXkCr6iRwvX rRclLJUQQOeiFz7Gu1UfRswp/3vmiVzeNLKmywjOYFahds9w4qNNBq9kFLUDxbSp w6XT3kZzMWbD0zdWCZWQwkRZBISrsbOvp4pTf4dUMD//WElS+pSjOpEa5bSip0DI nsB1+Si5QEyKrNczaXgSMrkHa2MG3ZnDUkocb2aUHb/n3Y+5Rc/5RR85ngjUAhpZ eTw06pEwF9N96NESC/Pqio6Bl/Eab740s2+qHSdg3yV7RElKoC1RNj/0Su2A+bUS fjRa18ToLuGSdDN1BdUs1tilUOXB2bYU0woHh1iG2qZyI3YxvM1fG7XMkw== Received: by lepiller.eu (OpenSMTPD) with ESMTPSA id 1189f322 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Mon, 10 Feb 2020 12:31:51 +0000 (UTC) Date: Mon, 10 Feb 2020 07:31:21 -0500 User-Agent: K-9 Mail for Android In-Reply-To: <87blq63hyj.fsf@cassou.me> References: <87blq63hyj.fsf@cassou.me> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Subject: Re: bug#39542: Adding openvpn client configurations to guix system To: bug-guix@gnu.org,Damien Cassou ,39542@debbugs.gnu.org From: Julien Lepiller Message-ID: <1BD29F0F-1268-4526-828D-C2AC25CFE2E5@lepiller.eu> X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 39542 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Le 10 f=C3=A9vrier 2020 04:33:08 GMT-05:00, Damien Cassou a =C3=A9crit : >Hi, > >both OpenVPN and NetworkManager read network configurations from >/etc=2E This should make it possible to configure your favorite VPN >client >configurations (and maybe wifi access points) in your /etc/config=2Escm= =2E > >An OpenVPN client connection typically consists of *=2Ekey files, *=2Epem >files and *=2Ecrt files=2E These should be placed under >/etc/openvpn/client/=2E > >Each OpenVPN client connection must be declared at the Network manager >level too=2E This means adding a *=2Enmconnection file in >/etc/NetworkManager/system-connections/=2E > >It would be great if Guix could make that possible from my >/etc/config=2Escm file=2E > >Thank you for your great work! Hi, We already have an openvpn-client-service-type and an openvpn-server-servi= ce-type=2E It's not linked to network manager though, I have no idea what i= t expects there=2E What do you need exactly? https://guix=2Egnu=2Eorg/manual/devel/en/html_node/VPN-Services=2Ehtml#VPN= -Services From debbugs-submit-bounces@debbugs.gnu.org Mon Feb 10 10:57:25 2020 Received: (at submit) by debbugs.gnu.org; 10 Feb 2020 15:57:25 +0000 Received: from localhost ([127.0.0.1]:55282 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1j1BR6-0000mN-OA for submit@debbugs.gnu.org; Mon, 10 Feb 2020 10:57:24 -0500 Received: from lists.gnu.org ([209.51.188.17]:56889) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1j1BR4-0000mF-RW for submit@debbugs.gnu.org; Mon, 10 Feb 2020 10:57:23 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:43222) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1j1BR3-00087q-LT for bug-guix@gnu.org; Mon, 10 Feb 2020 10:57:22 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,URIBL_BLOCKED autolearn=disabled version=3.3.2 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1j1BR2-000139-G2 for bug-guix@gnu.org; Mon, 10 Feb 2020 10:57:21 -0500 Received: from mail.choca.pics ([80.67.172.235]:43706) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1j1BR2-00011O-AM for bug-guix@gnu.org; Mon, 10 Feb 2020 10:57:20 -0500 Received: from localhost (localhost.localdomain [IPv6:::1]) by mail.choca.pics (Postfix) with ESMTP id 2A1C4181929E0; Mon, 10 Feb 2020 16:57:18 +0100 (CET) Received: from mail.choca.pics ([IPv6:::1]) by localhost (mail.choca.pics [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id RXCZ9vk2Wj8N; Mon, 10 Feb 2020 16:57:17 +0100 (CET) Received: from localhost (localhost.localdomain [IPv6:::1]) by mail.choca.pics (Postfix) with ESMTP id 87AFC181929CF; Mon, 10 Feb 2020 16:57:17 +0100 (CET) X-Virus-Scanned: amavisd-new at choca.pics Received: from mail.choca.pics ([IPv6:::1]) by localhost (mail.choca.pics [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id ZiFB98uDmy-5; Mon, 10 Feb 2020 16:57:17 +0100 (CET) Received: from luz4 (lfbn-ren-1-1414-74.w90-27.abo.wanadoo.fr [90.27.133.74]) by mail.choca.pics (Postfix) with ESMTPSA id 47D1A18192B26; Mon, 10 Feb 2020 16:57:17 +0100 (CET) From: Damien Cassou To: Julien Lepiller , bug-guix@gnu.org, 39542@debbugs.gnu.org Subject: Re: bug#39542: Adding openvpn client configurations to guix system In-Reply-To: <1BD29F0F-1268-4526-828D-C2AC25CFE2E5@lepiller.eu> References: <87blq63hyj.fsf@cassou.me> <1BD29F0F-1268-4526-828D-C2AC25CFE2E5@lepiller.eu> Date: Mon, 10 Feb 2020 16:57:15 +0100 Message-ID: <877e0u306c.fsf@cassou.me> MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 80.67.172.235 X-Spam-Score: 0.2 (/) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.8 (/) Julien Lepiller writes: > We already have an openvpn-client-service-type and an > openvpn-server-service-type. It's not linked to network manager > though, I have no idea what it expects there. What do you need > exactly? It seems to me that gnu/services/vpn.scm defines openvpn-server-service-type that triggers the generation of a shepherd service. At the office we use 3 different VPNs that we activate on demand (test, acceptance and production). If we follow the vpn.scm way, it seems that this would require 3 shepherd services but I guess it's not possible to instantiate the openvpn-client-service-type more than once. This seems to be a dead end to me. Instead of using an openvpn client daemon, I'm using a network manager connection for each VPN configuration I need. Then I can ask network manager to activate the VPN I want, when I want it. Network manager is responsible for calling the openvpn client binary. Below is a typical nmconnection file for an openvpn client. Many fields are similar to openvpn-client-configuration fields. [connection] id=some-name uuid=a401d9bb-ab82-a84f-731a-0ed18ebc48af type=vpn autoconnect=false permissions= [vpn] ca=/etc/openvpn/client/some-name-ca.crt cert=/etc/openvpn/client/some-name.crt cert-pass-flags=0 cipher=BF-CBC comp-lzo=adaptive connection-type=password-tls dev=tun key=/etc/openvpn/client/some-name.key ns-cert-type=server password-flags=0 remote=some-ip:port username=some-username service-type=org.freedesktop.NetworkManager.openvpn [vpn-secrets] password=some-password [ipv4] dns-search= method=auto never-default=true [ipv6] addr-gen-mode=stable-privacy dns-search= ip6-privacy=0 method=auto never-default=true -- Damien Cassou "Success is the ability to go from one failure to another without losing enthusiasm." --Winston Churchill From debbugs-submit-bounces@debbugs.gnu.org Sat Aug 01 09:44:39 2020 Received: (at 39542) by debbugs.gnu.org; 1 Aug 2020 13:44:39 +0000 Received: from localhost ([127.0.0.1]:39970 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1k1roV-0001nw-3Y for submit@debbugs.gnu.org; Sat, 01 Aug 2020 09:44:39 -0400 Received: from server0.selfhosted.xyz ([217.64.149.7]:40500) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1k1roS-0001ni-NH for 39542@debbugs.gnu.org; Sat, 01 Aug 2020 09:44:37 -0400 Received: from [127.0.0.1] (localhost [127.0.0.1]) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=selfhosted.xyz; s=dkim; t=1596289469; bh=qbK6fC3fDf6dXXARio19bP4bmIKHjAJvNkMQFTAsqfQ=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=MXZFV4i664BUmdRSdBG7zunhKEyzdQ0a9gZO/MMMt9TejhhSwmbeDApTeoucHRKwf jHqLqZuJdze4m+/Wf8Vqi8zBANXtQ8Gx2EX/bqR0WYBKLeUvWE8wLPaw6pvqG+pVV6 dckZusJmqr8aqU4Z4uR+/U+ZGVI/p5wXlxJU/ipEkdZkzqJwbFUIYMrxyad4D4L/eM g4j3OlKTcQPxhn14OZkOCws5DFH9zMKQYvdupTqOpcZY90v8Rm25fmQy1cDiXXQ5TM kkB9rEWDYKwB/9UA9yglXzxLAYvN8m2rsV7PrAMSoq6Ql4+bItwF2TU/rExpEfj0LY WjRxL9vzTtmwA== X-Fuglu-Suspect: 897c0c9b2ebe4f51a54c45329881ac56 X-Fuglu-Spamstatus: NO Received: from [127.0.0.1] (localhost [127.0.0.1]) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Sat, 01 Aug 2020 13:44:24 +0000 From: david larsson To: Damien Cassou Subject: Re: bug#39542: Adding openvpn client configurations to guix system In-Reply-To: <877e0u306c.fsf@cassou.me> References: <87blq63hyj.fsf@cassou.me> <1BD29F0F-1268-4526-828D-C2AC25CFE2E5@lepiller.eu> <877e0u306c.fsf@cassou.me> Message-ID: X-Sender: david.larsson@selfhosted.xyz X-Spam-Score: -1.8 (-) X-Debbugs-Envelope-To: 39542 Cc: bug-Guix , julien@lepiller.eu, 39542@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.8 (-) On 2020-02-10 15:57, Damien Cassou wrote: > Julien Lepiller writes: >> We already have an openvpn-client-service-type and an >> openvpn-server-service-type. It's not linked to network manager >> though, I have no idea what it expects there. What do you need >> exactly? > > It seems to me that gnu/services/vpn.scm defines > openvpn-server-service-type that triggers the generation of a shepherd > service. > > At the office we use 3 different VPNs that we activate on demand (test, > acceptance and production). If we follow the vpn.scm way, it seems that > this would require 3 shepherd services but I guess it's not possible to > instantiate the openvpn-client-service-type more than once. This seems > to be a dead end to me. Hi Damien, I think I have a solution for you, where you can start 3 different vpn's with herd start vpn1-client, herd start vpn2-client etc. Below is an ovpn-service.scm module, modeled after vpn.scm. which you can include with (use-modules (ovpn-service)) in your config.scm, by saving it in the same dir as config.scm. This is tested and works. Now, I think you can modify all occurences of the word "ovpn", to, say vpn1, vpn2, and vpn3, and save 3 different files, and then use (use-modules (vpn1-service) (vpn2-service) (vpn3-service)) etc. in the config.scm. An example configuration in the config.scm OS-services section would be: (ovpn-client-service #:config (let ([ base-dir "/home/myuser/src/my-guixsd-config/etc_openvpn/"] ) (ovpn-client-configuration ;; client (dev 'tun) ;; remote-random (proto 'udp) ;; mute-replay-warnings ;; replay-window 256 ;; remote-cert-tls server lines is generated somehow ;; remote-cert-tls server ;; cipher aes-256-cbc ;; ncp-ciphers AES-256-GCM:AES-256-CBC:AES-128-GCM ;; pull ;; nobind (bind? #f) ;; reneg-sec 432000 ;; resolv-retry infinite (resolv-retry? #t) ;; compress lzo (comp-lzo? #t) ;; verb 3 (verbosity 3) ;; persist-key (persist-key? #t) ;; persist-tun (persist-tun? #t) ;; auth-user-pass /etc/openvpn/credentials (auth-user-pass (string-append base-dir "credentials")) ;; ca /etc/openvpn/ovpn-ca.crt (ca (string-append base-dir "ovpn-ca.crt")) ;; tls-auth /etc/openvpn/ovpn-tls.key 1 (tls-auth (string-append base-dir "ovpn-tls.key")) ;; log /tmp/openvpn.log ;; script-security 2 ;; resolv-conf scripts not needed for guix ;; up /etc/openvpn/update-resolv-conf ;; down /etc/openvpn/update-resolv-conf (fast-io? #t) (remote (list ;; Resolves to multiple vpn servers in location (ovpn-remote-configuration (name "whatever.ovpn.com") (port 1196)) (ovpn-remote-configuration (name "whatever.ovpn.com") (port 1197)) (ovpn-remote-configuration (name "whatever.ovpn.com") (port 1196)) (ovpn-remote-configuration (name "whatever.ovpn.com") (port 1197)) ))))) Please let me know if this works for you! Best regards, David Larsson From debbugs-submit-bounces@debbugs.gnu.org Sat Aug 01 10:58:42 2020 Received: (at 39542) by debbugs.gnu.org; 1 Aug 2020 14:58:42 +0000 Received: from localhost ([127.0.0.1]:40875 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1k1sy9-0003kt-V1 for submit@debbugs.gnu.org; Sat, 01 Aug 2020 10:58:42 -0400 Received: from server0.selfhosted.xyz ([217.64.149.7]:46488) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1k1sy6-0003kh-I3 for 39542@debbugs.gnu.org; Sat, 01 Aug 2020 10:58:40 -0400 Received: from [127.0.0.1] (localhost [127.0.0.1]) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=selfhosted.xyz; s=dkim; t=1596293912; bh=gWBhxPgv3qj0P2th0wRmT4+8500gn/HqACZRmN8gfQA=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=x6gWzA9uSsgo1NHuyG9yOmMB2cC+qJbmnMRFl3CQzWSVLZlF6KAE6XcMRvcl4f3Tc OPXT6N1S2cydySFQrrsTBgfA+qYgbCPR7SAmTnF+P4J5Smx7j+DEgGtC8o2x5kVEIh K3Ia1dYfgVPIVCTZ3RlUzuodBnlubLlwcJ/r0cJzu/0wtzUSVkvpDO8apRl4LWTuKV 6iONfFc3BasMuRhnapkYhy7GhPJywDWg9SteCWsIs2ljMz4xQSVuc/aZuObQrH53dz 48z5vaWf5nQIEgxk1Sv9j+h0Susw9SnXFEO09cd8ecZRyLDOc53UpxyuM20fQE2Ph2 PfApUF7Dpa+8g== X-Fuglu-Suspect: a408be8dc8714216a9f4de3526fc6957 X-Fuglu-Spamstatus: NO Received: from [127.0.0.1] (localhost [127.0.0.1]) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Date: Sat, 01 Aug 2020 14:58:26 +0000 From: david larsson To: Damien Cassou Subject: Re: bug#39542: Adding openvpn client configurations to guix system In-Reply-To: References: <87blq63hyj.fsf@cassou.me> <1BD29F0F-1268-4526-828D-C2AC25CFE2E5@lepiller.eu> <877e0u306c.fsf@cassou.me> Message-ID: X-Sender: david.larsson@selfhosted.xyz X-Spam-Score: -1.8 (-) X-Debbugs-Envelope-To: 39542 Cc: bug-Guix , 39542@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.8 (-) On 2020-08-01 13:44, david larsson wrote: > On 2020-02-10 15:57, Damien Cassou wrote: >> Julien Lepiller writes: >>> We already have an openvpn-client-service-type and an >>> openvpn-server-service-type. It's not linked to network manager >>> though, I have no idea what it expects there. What do you need >>> exactly? >> >> It seems to me that gnu/services/vpn.scm defines >> openvpn-server-service-type that triggers the generation of a shepherd >> service. >> >> At the office we use 3 different VPNs that we activate on demand >> (test, >> acceptance and production). If we follow the vpn.scm way, it seems >> that >> this would require 3 shepherd services but I guess it's not possible >> to >> instantiate the openvpn-client-service-type more than once. This seems >> to be a dead end to me. > > Hi Damien, > > I think I have a solution for you, where you can start 3 different > vpn's with herd start vpn1-client, herd start vpn2-client etc. > > Below is an ovpn-service.scm module, modeled after vpn.scm. which you > can include with (use-modules (ovpn-service)) in your config.scm, by > saving it in the same dir as config.scm. This is tested and works. > > Now, I think you can modify all occurences of the word "ovpn", to, say > vpn1, vpn2, and vpn3, and save 3 different files, and then use > (use-modules (vpn1-service) (vpn2-service) (vpn3-service)) etc. in the > config.scm. An example configuration in the config.scm OS-services > section would be: > > (ovpn-client-service > #:config > (let ([ base-dir > "/home/myuser/src/my-guixsd-config/etc_openvpn/"] > ) > (ovpn-client-configuration > ;; client > (dev 'tun) > ;; remote-random > (proto 'udp) > ;; mute-replay-warnings > ;; replay-window 256 > > ;; remote-cert-tls server lines is generated > somehow > ;; remote-cert-tls server > > ;; cipher aes-256-cbc > ;; ncp-ciphers > AES-256-GCM:AES-256-CBC:AES-128-GCM > ;; pull > ;; nobind > (bind? #f) > ;; reneg-sec 432000 > ;; resolv-retry infinite > (resolv-retry? #t) > ;; compress lzo > (comp-lzo? #t) > ;; verb 3 > (verbosity 3) > ;; persist-key > (persist-key? #t) > ;; persist-tun > (persist-tun? #t) > ;; auth-user-pass /etc/openvpn/credentials > (auth-user-pass (string-append base-dir > "credentials")) > ;; ca /etc/openvpn/ovpn-ca.crt > (ca (string-append base-dir "ovpn-ca.crt")) > ;; tls-auth /etc/openvpn/ovpn-tls.key 1 > (tls-auth (string-append base-dir > "ovpn-tls.key")) > > ;; log /tmp/openvpn.log > ;; script-security 2 > ;; resolv-conf scripts not needed for guix > ;; up /etc/openvpn/update-resolv-conf > ;; down /etc/openvpn/update-resolv-conf > > (fast-io? #t) > (remote > (list > ;; Resolves to multiple vpn servers in location > instead (ovpn-remote-configuration > (name "whatever.ovpn.com") > (port 1196)) > (ovpn-remote-configuration > (name "whatever.ovpn.com") > (port 1197)) > (ovpn-remote-configuration > (name "whatever.ovpn.com") > (port 1196)) > (ovpn-remote-configuration > (name "whatever.ovpn.com") > (port 1197)) > ))))) > > Please let me know if this works for you! > > Best regards, > David Larsson and forgot the module, here: ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2017 Julien Lepiller ;;; Copyright © 2017 Clément Lassieur ;;; Copyright © 2017 Mathieu Othacehe ;;; ;;; This file is part of GNU Guix. ;;; ;;; GNU Guix is free software; you can redistribute it and/or modify it ;;; under the terms of the GNU General Public License as published by ;;; the Free Software Foundation; either version 3 of the License, or (at ;;; your option) any later version. ;;; ;;; GNU Guix is distributed in the hope that it will be useful, but ;;; WITHOUT ANY WARRANTY; without even the implied warranty of ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ;;; GNU General Public License for more details. ;;; ;;; You should have received a copy of the GNU General Public License ;;; along with GNU Guix. If not, see . (define-module (ovpn-service) #:use-module (gnu services) #:use-module (gnu services configuration) #:use-module (gnu services shepherd) #:use-module (gnu system shadow) #:use-module (gnu packages admin) #:use-module (gnu packages vpn) #:use-module (guix packages) #:use-module (guix records) #:use-module (guix gexp) #:use-module (srfi srfi-1) #:use-module (ice-9 match) #:use-module (ice-9 regex) #:export (ovpn-client-service ovpn-server-service ovpn-client-service-type ovpn-server-service-type ovpn-client-configuration ovpn-server-configuration ovpn-remote-configuration ovpn-ccd-configuration generate-ovpn-client-documentation generate-ovpn-server-documentation)) ;;; ;;; Ovpn. ;;; (define (uglify-field-name name) (match name ('verbosity "verb") (_ (let ((str (symbol->string name))) (if (string-suffix? "?" str) (substring str 0 (1- (string-length str))) str))))) (define (serialize-field field-name val) (if (eq? field-name 'pid-file) (format #t "") (format #t "~a ~a\n" (uglify-field-name field-name) val))) (define serialize-string serialize-field) (define-maybe string) (define (serialize-boolean field-name val) (if val (serialize-field field-name "") (format #t ""))) (define (ip-mask? val) (and (string? val) (if (string-match "^([0-9]+\\.){3}[0-9]+ ([0-9]+\\.){3}[0-9]+$" val) (let ((numbers (string-tokenize val char-set:digit))) (all-lte numbers (list 255 255 255 255 255 255 255 255))) #f))) (define serialize-ip-mask serialize-string) (define-syntax define-enumerated-field-type (lambda (x) (define (id-append ctx . parts) (datum->syntax ctx (apply symbol-append (map syntax->datum parts)))) (syntax-case x () ((_ name (option ...)) #`(begin (define (#,(id-append #'name #'name #'?) x) (memq x '(option ...))) (define (#,(id-append #'name #'serialize- #'name) field-name val) (serialize-field field-name val))))))) (define-enumerated-field-type proto (udp tcp udp6 tcp6)) (define-enumerated-field-type dev (tun tap)) (define key-usage? boolean?) (define (serialize-key-usage field-name value) (if value (format #t "remote-cert-tls server\n") #f)) (define bind? boolean?) (define (serialize-bind field-name value) (if value #f (format #t "nobind\n"))) (define resolv-retry? boolean?) (define (serialize-resolv-retry field-name value) (if value (format #t "resolv-retry infinite\n") #f)) (define (serialize-tls-auth role location) (if location (serialize-field 'tls-auth (string-append location " " (match role ('server "0") ('client "1")))) #f)) (define (tls-auth? val) (or (eq? val #f) (string? val))) (define (serialize-tls-auth-server field-name val) (serialize-tls-auth 'server val)) (define (serialize-tls-auth-client field-name val) (serialize-tls-auth 'client val)) (define tls-auth-server? tls-auth?) (define tls-auth-client? tls-auth?) (define (serialize-number field-name val) (serialize-field field-name (number->string val))) (define (all-lte left right) (if (eq? left '()) (eq? right '()) (and (<= (string->number (car left)) (car right)) (all-lte (cdr left) (cdr right))))) (define (cidr4? val) (if (string? val) (if (string-match "^([0-9]+\\.){3}[0-9]+/[0-9]+$" val) (let ((numbers (string-tokenize val char-set:digit))) (all-lte numbers (list 255 255 255 255 32))) #f) (eq? val #f))) (define (cidr6? val) (if (string? val) (string-match "^([0-9a-f]{0,4}:){0,8}/[0-9]{1,3}$" val) (eq? val #f))) (define (serialize-cidr4 field-name val) (if (eq? val #f) #f (serialize-field field-name val))) (define (serialize-cidr6 field-name val) (if (eq? val #f) #f (serialize-field field-name val))) (define (ip? val) (if (string? val) (if (string-match "^([0-9]+\\.){3}[0-9]+$" val) (let ((numbers (string-tokenize val char-set:digit))) (all-lte numbers (list 255 255 255 255))) #f) (eq? val #f))) (define (serialize-ip field-name val) (if (eq? val #f) #f (serialize-field field-name val))) (define (keepalive? val) (and (list? val) (and (number? (car val)) (number? (car (cdr val)))))) (define (serialize-keepalive field-name val) (format #t "~a ~a ~a\n" (uglify-field-name field-name) (number->string (car val)) (number->string (car (cdr val))))) (define gateway? boolean?) (define (serialize-gateway field-name val) (and val (format #t "push \"redirect-gateway\"\n"))) (define-configuration ovpn-remote-configuration (name (string "my-server") "Server name.") (port (number 1194) "Port number the server listens to.")) (define-configuration ovpn-ccd-configuration (name (string "client") "Client name.") (iroute (ip-mask #f) "Client own network") (ifconfig-push (ip-mask #f) "Client VPN IP.")) (define (ovpn-remote-list? val) (and (list? val) (or (eq? val '()) (and (ovpn-remote-configuration? (car val)) (ovpn-remote-list? (cdr val)))))) (define (serialize-ovpn-remote-list field-name val) (for-each (lambda (remote) (format #t "remote ~a ~a\n" (ovpn-remote-configuration-name remote) (number->string (ovpn-remote-configuration-port remote)))) val)) (define (ovpn-ccd-list? val) (and (list? val) (or (eq? val '()) (and (ovpn-ccd-configuration? (car val)) (ovpn-ccd-list? (cdr val)))))) (define (serialize-ovpn-ccd-list field-name val) #f) (define (create-ccd-directory val) "Create a ccd directory containing files for the ccd configuration option of Ovpn. Each file in this directory represents particular settings for a client. Each file is named after the name of the client." (let ((files (map (lambda (ccd) (list (ovpn-ccd-configuration-name ccd) (with-output-to-string (lambda () (serialize-configuration ccd ovpn-ccd-configuration-fields))))) val))) (computed-file "ccd" (with-imported-modules '((guix build utils)) #~(begin (use-modules (guix build utils)) (use-modules (ice-9 match)) (mkdir-p #$output) (for-each (lambda (ccd) (match ccd ((name config-string) (call-with-output-file (string-append #$output "/" name) (lambda (port) (display config-string port)))))) '#$files)))))) (define-syntax define-split-configuration (lambda (x) (syntax-case x () ((_ name1 name2 (common-option ...) (first-option ...) (second-option ...)) #`(begin (define-configuration #,#'name1 common-option ... first-option ...) (define-configuration #,#'name2 common-option ... second-option ...)))))) (define-split-configuration ovpn-client-configuration ovpn-server-configuration ((ovpn (package openvpn) "The OpenVPN package.") (pid-file (string "/var/run/openvpn/openvpn.pid") "The OpenVPN pid file.") (proto (proto 'udp) "The protocol (UDP or TCP) used to open a channel between clients and servers.") (dev (dev 'tun) "The device type used to represent the VPN connection.") (ca (maybe-string "/etc/openvpn/ca.crt") "The certificate authority to check connections against.") (cert ;;(maybe-string "/etc/openvpn/client.crt") (maybe-string 'disabled) "The certificate of the machine the daemon is running on. It should be signed by the authority given in @code{ca}.") (key ;;(string "/etc/openvpn/client.key") (maybe-string 'disabled) "The key of the machine the daemon is running on. It must be the key whose certificate is @code{cert}.") (comp-lzo? (boolean #t) "Whether to use the lzo compression algorithm.") (persist-key? (boolean #t) "Don't re-read key files across SIGUSR1 or --ping-restart.") (persist-tun? (boolean #t) "Don't close and reopen TUN/TAP device or run up/down scripts across SIGUSR1 or --ping-restart restarts.") (fast-io? (boolean #f) "(Experimental) Optimize TUN/TAP/UDP I/O writes by avoiding a call to poll/epoll/select prior to the write operation.") (verbosity (number 3) "Verbosity level.")) ;; client-specific configuration ((tls-auth (tls-auth-client #f) "Add an additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks.") (auth-user-pass (maybe-string 'disabled) "Authenticate with server using username/password. The option is a file containing username/password on 2 lines. Do not use a file-like object as it would be added to the store and readable by any user.") (verify-key-usage? (key-usage #t) "Whether to check the server certificate has server usage extension.") (bind? (bind #f) "Bind to a specific local port number.") (resolv-retry? (resolv-retry #t) "Retry resolving server address.") (remote-random? (boolean #f) "Select remotes randomly") (mute-replay-warnings? (boolean #f) "Mute replay warnings") (replay-window? (number 256) "Dunno") (remote (ovpn-remote-list '()) "A list of remote servers to connect to.")) ;; server-specific configuration ((tls-auth (tls-auth-server #f) "Add an additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks.") (port (number 1194) "Specifies the port number on which the server listens.") (server (ip-mask "10.8.0.0 255.255.255.0") "An ip and mask specifying the subnet inside the virtual network.") (server-ipv6 (cidr6 #f) "A CIDR notation specifying the IPv6 subnet inside the virtual network.") (dh (string "/etc/openvpn/dh2048.pem") "The Diffie-Hellman parameters file.") (ifconfig-pool-persist (string "/etc/openvpn/ipp.txt") "The file that records client IPs.") (redirect-gateway? (gateway #f) "When true, the server will act as a gateway for its clients.") (client-to-client? (boolean #f) "When true, clients are allowed to talk to each other inside the VPN.") (keepalive (keepalive '(10 120)) "Causes ping-like messages to be sent back and forth over the link so that each side knows when the other side has gone down. @code{keepalive} requires a pair. The first element is the period of the ping sending, and the second element is the timeout before considering the other side down.") (max-clients (number 100) "The maximum number of clients.") (status (string "/var/run/openvpn/status") "The status file. This file shows a small report on current connection. It is truncated and rewritten every minute.") (client-config-dir (ovpn-ccd-list '()) "The list of configuration for some clients."))) (define (ovpn-config-file role config) (let ((config-str (with-output-to-string (lambda () (serialize-configuration config (match role ('server ovpn-server-configuration-fields) ('client ovpn-client-configuration-fields)))))) (ccd-dir (match role ('server (create-ccd-directory (ovpn-server-configuration-client-config-dir config))) ('client #f)))) (computed-file "openvpn.conf" #~(begin (use-modules (ice-9 match)) (call-with-output-file #$output (lambda (port) (match '#$role ('server (display "" port)) ('client (display "client\n" port))) (display #$config-str port) (match '#$role ('server (display (string-append "client-config-dir " #$ccd-dir "\n") port)) ('client (display "" port))))))))) (define (ovpn-shepherd-service role) (lambda (config) (let* ((config-file (ovpn-config-file role config)) (pid-file ((match role ('server ovpn-server-configuration-pid-file) ('client ovpn-client-configuration-pid-file)) config)) (ovpn ((match role ('server ovpn-server-configuration-ovpn) ('client ovpn-client-configuration-ovpn)) config)) (log-file (match role ('server "/var/log/openvpn-server.log") ('client "/var/log/openvpn-client.log")))) (list (shepherd-service (documentation (string-append "Run the OpenVPN " (match role ('server "server") ('client "client")) " daemon.")) (provision (match role ('server '(ovpn-server)) ('client '(ovpn-client)))) (requirement '(networking)) (start #~(make-forkexec-constructor (list (string-append #$ovpn "/sbin/openvpn") "--writepid" #$pid-file "--config" #$config-file "--daemon") #:pid-file #$pid-file)) (stop #~(make-kill-destructor))))))) (define %ovpn-accounts (list (user-group (name "openvpn") (system? #t)) (user-account (name "openvpn") (group "openvpn") (system? #t) (comment "Openvpn daemon user") (home-directory "/var/empty") (shell (file-append shadow "/sbin/nologin"))))) (define %ovpn-activation #~(begin (use-modules (guix build utils)) (mkdir-p "/var/run/openvpn"))) (define ovpn-server-service-type (service-type (name 'ovpn-server) (extensions (list (service-extension shepherd-root-service-type (ovpn-shepherd-service 'server)) (service-extension account-service-type (const %ovpn-accounts)) (service-extension activation-service-type (const %ovpn-activation)))))) (define ovpn-client-service-type (service-type (name 'ovpn-client) (extensions (list (service-extension shepherd-root-service-type (ovpn-shepherd-service 'client)) (service-extension account-service-type (const %ovpn-accounts)) (service-extension activation-service-type (const %ovpn-activation)))))) (define* (ovpn-client-service #:key (config (ovpn-client-configuration))) (validate-configuration config ovpn-client-configuration-fields) (service ovpn-client-service-type config)) (define* (ovpn-server-service #:key (config (ovpn-server-configuration))) (validate-configuration config ovpn-server-configuration-fields) (service ovpn-server-service-type config)) (define (generate-ovpn-server-documentation) (generate-documentation `((ovpn-server-configuration ,ovpn-server-configuration-fields (ccd ovpn-ccd-configuration)) (ovpn-ccd-configuration ,ovpn-ccd-configuration-fields)) 'ovpn-server-configuration)) (define (generate-ovpn-client-documentation) (generate-documentation `((ovpn-client-configuration ,ovpn-client-configuration-fields (remote ovpn-remote-configuration)) (ovpn-remote-configuration ,ovpn-remote-configuration-fields)) 'ovpn-client-configuration)) From debbugs-submit-bounces@debbugs.gnu.org Sun Aug 02 14:33:47 2020 Received: (at 39542) by debbugs.gnu.org; 2 Aug 2020 18:33:48 +0000 Received: from localhost ([127.0.0.1]:43411 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1k2Inr-0008CK-GC for submit@debbugs.gnu.org; Sun, 02 Aug 2020 14:33:47 -0400 Received: from mail.choca.pics ([80.67.172.235]:45412) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1k2Ino-0008C7-VG for 39542@debbugs.gnu.org; Sun, 02 Aug 2020 14:33:45 -0400 Received: from localhost (localhost.localdomain [IPv6:::1]) by mail.choca.pics (Postfix) with ESMTP id 51B0E1819576F; Sun, 2 Aug 2020 20:33:43 +0200 (CEST) Received: from mail.choca.pics ([IPv6:::1]) by localhost (mail.choca.pics [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id 6BMHAZLOh7Zw; Sun, 2 Aug 2020 20:33:42 +0200 (CEST) Received: from localhost (localhost.localdomain [IPv6:::1]) by mail.choca.pics (Postfix) with ESMTP id 572FD1819578C; Sun, 2 Aug 2020 20:33:42 +0200 (CEST) X-Virus-Scanned: amavisd-new at choca.pics Received: from mail.choca.pics ([IPv6:::1]) by localhost (mail.choca.pics [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id AAwuFlro0qtC; Sun, 2 Aug 2020 20:33:42 +0200 (CEST) Received: from localhost (87-231-56-147.rev.numericable.fr [87.231.56.147]) by mail.choca.pics (Postfix) with ESMTPSA id 131041819576F; Sun, 2 Aug 2020 20:33:42 +0200 (CEST) From: Damien Cassou To: david larsson Subject: Re: bug#39542: Adding openvpn client configurations to guix system In-Reply-To: References: <87blq63hyj.fsf@cassou.me> <1BD29F0F-1268-4526-828D-C2AC25CFE2E5@lepiller.eu> <877e0u306c.fsf@cassou.me> Date: Sun, 02 Aug 2020 20:33:41 +0200 Message-ID: <874kpknbi2.fsf@cassou.me> MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 39542 Cc: bug-Guix , julien@lepiller.eu, 39542@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hi David, david larsson writes: > I think I have a solution for you, where you can start 3 different vpn's > with herd start vpn1-client, herd start vpn2-client etc. thank you very much. I've decided I would go for NixOS though. Best, -- Damien Cassou "Success is the ability to go from one failure to another without losing enthusiasm." --Winston Churchill From debbugs-submit-bounces@debbugs.gnu.org Tue Mar 15 11:10:31 2022 Received: (at 39542-done) by debbugs.gnu.org; 15 Mar 2022 15:10:32 +0000 Received: from localhost ([127.0.0.1]:49325 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nU8oh-0007kC-Mf for submit@debbugs.gnu.org; Tue, 15 Mar 2022 11:10:31 -0400 Received: from mail-qk1-f178.google.com ([209.85.222.178]:46829) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nU8og-0007jy-AL for 39542-done@debbugs.gnu.org; Tue, 15 Mar 2022 11:10:30 -0400 Received: by mail-qk1-f178.google.com with SMTP id r127so15695873qke.13 for <39542-done@debbugs.gnu.org>; Tue, 15 Mar 2022 08:10:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:references:date:in-reply-to:message-id :user-agent:mime-version; bh=ZjMnmpID/dEssLlg7oODBFRFdav6IQXb1DJNMd2MNSA=; b=FV0o+/oxYrFm9Fl9lqYTUqwuXI5kYdcXaC8SwkzjZuCtXm07BTzdDWRFnnj0Z2otim HgqrYsUuCpvkEF2PCz7QnUgV/5M9dCntDR3Eq86GYISkAAA41d43gQgyh7ln2EJnwQmj Eyvm1twzoW8TSOdqkZDUwo2vKSdw23iN5tzgd9yjBsAa32Sp2oUWCyBRYUWBLC9eIkev 95R2gDG8OEX0tkyw0tFwd6QbI4FhdtpUJBtIo9vNjAm+kOyXJoPrO5ZHdHRKNtUM9FJI vojtCloASfvwhv3YMXHGooLt6AOD9fMTFwzppLht5S92kjIrtOQFJIVsjYhpkWRmQFFp aFvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:references:date:in-reply-to :message-id:user-agent:mime-version; bh=ZjMnmpID/dEssLlg7oODBFRFdav6IQXb1DJNMd2MNSA=; b=b6HsNlkF6H6CHQA/g5Z9BtaIoawgT3hyNOmBCKcIv5xhSvjNPZwIKEvHQMJV+nitqD sh3PEpXKA0p8kBwY6iSElfaXz8T5DtUGZ0c81xIp88Lps1Arc2jMMggr66K4LQhPzk2s FFaDtiYJ+Amt9J9A5QG7cKfFSlM+pUksqqJ4giIFr+lDP2Eehuoq4GzxcebBrseTjEd/ ovIT8b2UZ9MTLiqvmi2IftNZF46MD8HzqKtCsA1jd625KERMGWErk+AChq/ladxvKTtQ yXaM7AGJHYlIDiX8ygMn9W9Xls2inCPXjipWGpjpzLqSqJ+zp+/FJCqfFK9fy4jvyFCQ JTiw== X-Gm-Message-State: AOAM531hsXYBVk+YpUXTQyugGiWJDKR1EnYb3Dvg/8jPL1ie5Z2c7abs hdAghTeCDqwooXCYOamUgVNY5UGIY2Y= X-Google-Smtp-Source: ABdhPJwmJ7EKl3zeJaTh8meRMQNr5jpcMlMKFOdpGoywaeCO9DUxYeCYDLRavDuZMBF9P1nX6rByzw== X-Received: by 2002:a05:620a:20c2:b0:67d:2fb1:d358 with SMTP id f2-20020a05620a20c200b0067d2fb1d358mr18560100qka.55.1647357024577; Tue, 15 Mar 2022 08:10:24 -0700 (PDT) Received: from raisin ([2607:fad8:4:6:235e:8579:8464:aacc]) by smtp.gmail.com with ESMTPSA id q8-20020a05622a030800b002e1c9304db8sm7007168qtw.38.2022.03.15.08.10.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 15 Mar 2022 08:10:24 -0700 (PDT) From: Maxim Cournoyer To: Damien Cassou Subject: Re: bug#39542: Adding openvpn client configurations to guix system References: <87blq63hyj.fsf@cassou.me> <1BD29F0F-1268-4526-828D-C2AC25CFE2E5@lepiller.eu> <877e0u306c.fsf@cassou.me> <874kpknbi2.fsf@cassou.me> Date: Tue, 15 Mar 2022 11:10:10 -0400 In-Reply-To: <874kpknbi2.fsf@cassou.me> (Damien Cassou's message of "Sun, 02 Aug 2020 20:33:41 +0200") Message-ID: <87v8wfckvh.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 1.6 (+) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hi, Damien Cassou writes: > Hi David, > > david larsson writes: >> I think I have a solution for you, where you can start 3 different vpn's >> with herd start vpn1-client, herd start vpn2-client etc. > > thank you very much. [...] Content analysis details: (1.6 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (maxim.cournoyer[at]gmail.com) 1.6 PDS_OTHER_BAD_TLD Untrustworthy TLDs [URI: selfhosted.xyz (xyz)] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [209.85.222.178 listed in list.dnswl.org] -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [209.85.222.178 listed in wl.mailspike.net] -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Debbugs-Envelope-To: 39542-done Cc: david larsson , bug-Guix , julien@lepiller.eu, 39542-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.6 (/) Hi, Damien Cassou writes: > Hi David, > > david larsson writes: >> I think I have a solution for you, where you can start 3 different vpn's >> with herd start vpn1-client, herd start vpn2-client etc. > > thank you very much. I've decided I would go for NixOS though. OK, thanks for letting us know. As this was a feature request rather than a bug report, I'm closing the issue. Thank you, Maxim From unknown Fri Sep 12 09:03:49 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Wed, 13 Apr 2022 11:24:06 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator