ocserv: init at 0.12.1 #42871
Merged
ocserv: init at 0.12.1 #42871
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@tenten8401 before somebody merges this, is this patch sufficient for your use-case? |
|
the CI fails since |
|
@GrahamcOfBorg eval |
|
I'll have a look at it, although I do feel that the service should be renamed from "ocserv-server" just to "ocserv", since serv is in the name already. |
|
Success on x86_64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
|
Success on x86_64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
|
Haven't forgotten about this, just haven't had time to test it. Still working on it. |
|
Alright, so I tested this and I've found 2 problems so far.
Looks like it may be missing the freeradius client, possibly oath-toolkit for one-time passwords, and I'm not sure what for PAM. Found this on the ocserv website for Gentoo, but figured it might help in this situation: |
|
thanks a lot for your feedback! I'll have a look at it again in the next days to hopefully fix this :) |
|
@tenten8401 I slightly changed the patch, the service now starts by default and |
|
Sure thing. |
|
Success on x86_64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
|
3 things I've noticed so far:
|
`ocserv` is a VPN server which follows the openconnect protocol (https://github.com/openconnect/protocol). The packaging is slightly inspired by the AUR version (https://aur.archlinux.org/packages/ocserv/). This patch initializes the package written in C, the man pages and a module for a simple systemd unit to run the VPN server. The package supports the following authentication methods for the server: * `plain` (mostly username/password) * `pam` The third method (`radius`) is currently not supported since `nixpkgs` misses a packaged client. The module can be used like this: ``` nix { services.ocserv = { enable = true; config = '' ... ''; }; } ``` The option `services.ocserv.config` is required on purpose to ensure that nobody just enables the service and experiences unexpected side-effects on the system. For a full reference, please refer to the man pages, the online docs or the example value. The docs recommend to simply use `nobody` as user, so no extra user has been added to the internal user list. Instead a configuration like this can be used: ``` run-as-user = nobody run-as-group = nogroup ``` /cc @tenten8401 Fixes NixOS#42594
good catch! I had this in my VM config and forgot to put it into the actual module :)
dammit, sorry :/ |
|
Success on x86_64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
Don't worry about it, I could easily see myself making the same mistakes. I'll test your new commit once more and get back to you on how well it works. |
|
Seems like it works as expected, with me typing this to you connected to ocserv. |
|
Just thought I'd let anyone know this is basically ready to be looked at and merged I'm pretty sure. |
|
@GrahamcOfBorg build ocserv |
|
Success on x86_64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: ocserv Partial log (click to expand)
|
|
No attempt on x86_64-darwin (full log) The following builds were skipped because they don't evaluate on x86_64-darwin: ocserv Partial log (click to expand)
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
ocservis a VPN server which follows the openconnect protocol(https://github.com/openconnect/protocol). The packaging is slightly
inspired by the AUR version
(https://aur.archlinux.org/packages/ocserv/).
This patch initializes the package written in C, the man pages and a
module for a simple systemd unit to run the VPN server. The package
supports the following authentication methods for the server:
plain(mostly username/password)pamThe third method (
radius) is currently not supported sincenixpkgsmisses a packaged client.
The module can be used like this:
The option
services.ocserv.configis required on purpose toensure that nobody just enables the service and experiences unexpected
side-effects on the system. For a full reference, please refer to the
man pages, the online docs or the example value.
The docs recommend to simply use
nobodyas user, so no extra user hasbeen added to the internal user list. Instead a configuration like
this can be used:
/cc @tenten8401
Fixes #42594
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)nix path-info -Sbefore and after)