Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nixos/system/boot/initrd-openvpn: New openvpn options for initrd #63165

Merged
merged 1 commit into from Jul 5, 2020
Merged

nixos/system/boot/initrd-openvpn: New openvpn options for initrd #63165

merged 1 commit into from Jul 5, 2020

Conversation

CRTified
Copy link
Contributor

@CRTified CRTified commented Jun 15, 2019 •
edited

The module in this commit adds new options that allows the integration of an OpenVPN client into the initrd.

Motivation for this change

The main motivation for this change is the ability to remotely unlock LUKS containers on hosts that are behind a restrictive firewall, but are able to connect to other hosts. Using a VPN connection allows that host to tunnel into a network that might be reachable by external devices (either by providing a public IPv4/6 address or by connecting into a private VPN).

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@CRTified CRTified requested a review from infinisil as a code owner June 15, 2019 15:43
@peterhoeg
Copy link
Member

I like this - I don't have a need for it, but it looks like the right thing to do.

The only thing that concerns me is stuff that messes around with initrd without a test. Something basic would be fine as long as we are sure that enabling this doesn't break booting.

@CRTified
Copy link
Contributor Author

I'll have a look into writing a test and will add it as soon as it is ready.

@CRTified
Copy link
Contributor Author

Would it make sense to squash the two commits, as they both just add tests (and one commit consumes the other one)?

@lheckemann
Copy link
Member

This is cool! I'm still a bit -1 on this though. While we don't have any formal criteria for inclusion/exclusion of features, I think this is a use case specific and rare enough that it will only be used by you and might be better off in your personal config than in nixpkgs.

@duhirsch
Copy link

I support this.

I think the usecase is not too niche.
Imagine the following usecase:
You want to run a homeserver with encrypted disks
Your ISP does not give you a public IP
Your homeserver reboots/looses power
You are currently not at home

Now you need a possibility to connect to the homeserver and unlock the disks.
Assuming you have another server which has a public IP address you can connect to it via VPN and use it as a jump server to enter the password

@Lassulus
Copy link
Member

I'm also a big fan of this PR, sadly I couldn't test it because of general busyness. Codewise it looks good to me.

@peterhoeg
Copy link
Member

@Amarandus, can you get someone else to test it as well (again due it messing with the boot process) to make sure all is good? Maybe a post on https://discourse.nixos.org if you don't have anyone at hand to try it out?

@stale
Copy link

stale bot commented Jun 1, 2020

Thank you for your contributions.
This has been automatically marked as stale because it has had no activity for 180 days.
If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.
Here are suggestions that might help resolve this more quickly:

  1. Search for maintainers and people that previously touched the
    related code and @ mention them in a comment.
  2. Ask on the NixOS Discourse. 3. Ask on the #nixos channel on
    irc.freenode.net.

@stale stale bot added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jun 1, 2020
@stale stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jun 2, 2020
@CRTified
nixos/system/boot/initrd-openvpn: Add openvpn options for initrd
c684398 
nixos/tests/initrd-openvpn: Add test for openvpn in the initramfs

The module in this commit adds new options that allows the
integration of an OpenVPN client into the initrd.
This can be used e.g. to remotely unlock LUKS devices.

This commit also adds two tests for `boot.initrd.network.openvpn`.
The first one is a basic test to validate that a failing connection
does not prevent the machine from booting.

The second test validates that this module actually creates a valid
openvpn connection.
For this, it spawns three nodes:

  - The client that uses boot.initrd.network.openvpn
  - An OpenVPN server that acts as gateway and forwards a port
    to the client
  - A node that is external to the OpenVPN network

The client connects to the OpenVPN server and spawns a netcat instance
that echos a value to every client.
Afterwards, the external node checks if it receives this value over the
forwarded port on the OpenVPN gateway.
@CRTified
Copy link
Contributor Author

So, I finally got time to update this PR and squashed the commits together.

  • I removed most options as they were unnecessary (adding additional files like certificates should be possible with boot.initrd.secrets directly, as the internal-attribute was removed recently there. Alternatively, you can inline them into the configuration)
    • Besides enable, there is only the option configuration, which expects a file path as a string (similar to boot.initrd.network.ssh.hostKeys)
    • Configuration is now always handled by boot.initrd.secrets, so there is only one place which decides whether files get into the store or not (depends on the bootloader)
    • It is not expected anymore to add iproute /bin/ip to the config - it will be appended automatically
  • The test now uses the python test infrastructure
    • First test: Checks whether booting with an invalid config breaks
    • Second test: Checks whether a valid configuration really works

@CRTified CRTified requested review from Lassulus and Mic92 June 30, 2020 22:15
@Lassulus Lassulus merged commit e0f07f9 into NixOS:master Jul 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@peterhoeg peterhoeg peterhoeg left review comments

@Lassulus Lassulus Lassulus approved these changes

@infinisil infinisil Awaiting requested review from infinisil

@fpletz fpletz Awaiting requested review from fpletz

@Mic92 Mic92 Awaiting requested review from Mic92

Assignees
No one assigned
Labels
6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 10.rebuild-linux: 1 12. first-time contribution
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@CRTified @peterhoeg @lheckemann @duhirsch @Lassulus @Mic92 @Janik-Haag