mullvad, nixos/mullvad-vpn: Match upstream config (#476945)
This commit is contained in:
Cole Helbling
@@ -27,6 +27,17 @@ with lib;
|
||||
'';
|
||||
};
|
||||
|
||||
enableEarlyBootBlocking = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
This option activates an additional oneshot systemd service to ensure that the mullvad daemon
|
||||
will start and block traffic before any network configuration will be applied.
|
||||
This matches what upstream Mullvad distributes for their supported distros, but is disabled by
|
||||
default in NixOS as it may conflict with non-Mullvad network configuration.
|
||||
'';
|
||||
};
|
||||
|
||||
package = mkPackageOption pkgs "mullvad" {
|
||||
example = "mullvad-vpn";
|
||||
extraDescription = ''
|
||||
@@ -48,6 +59,23 @@ with lib;
|
||||
source = "${cfg.package}/bin/mullvad-exclude";
|
||||
};
|
||||
|
||||
# see https://github.com/mullvad/mullvadvpn-app/blob/2025.14/dist-assets/linux/mullvad-early-boot-blocking.service
|
||||
systemd.services.mullvad-early-boot-blocking = mkIf cfg.enableEarlyBootBlocking {
|
||||
description = "Mullvad early boot network blocker";
|
||||
wantedBy = [ "mullvad-daemon.service" ];
|
||||
before = [
|
||||
"basic.target"
|
||||
"mullvad-daemon.service"
|
||||
];
|
||||
unitConfig = {
|
||||
DefaultDependencies = "no";
|
||||
};
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${cfg.package}/bin/mullvad-daemon --initialize-early-boot-firewall";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.mullvad-daemon = {
|
||||
description = "Mullvad VPN daemon";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
@@ -59,7 +87,8 @@ with lib;
|
||||
"network-online.target"
|
||||
"NetworkManager.service"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
]
|
||||
++ lib.optional cfg.enableEarlyBootBlocking "mullvad-early-boot-blocking.service";
|
||||
# See https://github.com/NixOS/nixpkgs/issues/262681
|
||||
path = lib.optional config.networking.resolvconf.enable config.networking.resolvconf.package;
|
||||
startLimitBurst = 5;
|
||||
|
||||
@@ -5,5 +5,4 @@
|
||||
lib.makeScope newScope (self: {
|
||||
libwg = self.callPackage ./libwg.nix { };
|
||||
mullvad = self.callPackage ./mullvad.nix { };
|
||||
openvpn-mullvad = self.callPackage ./openvpn.nix { };
|
||||
})
|
||||
|
||||
@@ -12,9 +12,6 @@
|
||||
libmnl,
|
||||
libwg,
|
||||
darwin,
|
||||
enableOpenvpn ? true,
|
||||
openvpn-mullvad,
|
||||
shadowsocks-rust,
|
||||
installShellFiles,
|
||||
writeShellScriptBin,
|
||||
versionCheckHook,
|
||||
@@ -49,7 +46,6 @@ rustPlatform.buildRustPackage rec {
|
||||
"-p mullvad-problem-report --bin mullvad-problem-report"
|
||||
"-p mullvad-exclude --bin mullvad-exclude"
|
||||
"-p tunnel-obfuscation --bin tunnel-obfuscation"
|
||||
"-p talpid-openvpn-plugin --lib"
|
||||
];
|
||||
|
||||
checkFlags = [
|
||||
@@ -87,24 +83,6 @@ rustPlatform.buildRustPackage rec {
|
||||
--fish $compdir/mullvad.fish
|
||||
'';
|
||||
|
||||
postFixup =
|
||||
# Files necessary for OpenVPN tunnels to work.
|
||||
lib.optionalString enableOpenvpn ''
|
||||
mkdir -p $out/share/mullvad
|
||||
cp dist-assets/ca.crt $out/share/mullvad
|
||||
ln -s ${openvpn-mullvad}/bin/openvpn $out/share/mullvad
|
||||
ln -s ${shadowsocks-rust}/bin/sslocal $out/share/mullvad
|
||||
''
|
||||
+
|
||||
# Set the directory where Mullvad will look for its resources by default to
|
||||
# `$out/share`, so that we can avoid putting the files in `$out/bin` --
|
||||
# Mullvad defaults to looking inside the directory its binary is located in
|
||||
# for its resources.
|
||||
''
|
||||
wrapProgram $out/bin/mullvad-daemon \
|
||||
--set-default MULLVAD_RESOURCE_DIR "$out/share/mullvad"
|
||||
'';
|
||||
|
||||
__darwinAllowLocalNetworking = true;
|
||||
|
||||
nativeInstallCheckInputs = [
|
||||
@@ -114,7 +92,6 @@ rustPlatform.buildRustPackage rec {
|
||||
|
||||
passthru = {
|
||||
inherit libwg;
|
||||
inherit openvpn-mullvad;
|
||||
};
|
||||
|
||||
meta = {
|
||||
|
||||
@@ -1,115 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
openvpn,
|
||||
fetchpatch,
|
||||
fetchurl,
|
||||
libnl,
|
||||
autoreconfHook,
|
||||
pkg-config,
|
||||
}:
|
||||
|
||||
openvpn.overrideAttrs (
|
||||
oldAttrs:
|
||||
let
|
||||
inherit (lib) optional;
|
||||
fetchMullvadPatch =
|
||||
{ commit, sha256 }:
|
||||
fetchpatch {
|
||||
url = "https://github.com/mullvad/openvpn/commit/${commit}.patch";
|
||||
inherit sha256;
|
||||
};
|
||||
in
|
||||
rec {
|
||||
pname = "openvpn-mullvad";
|
||||
version = "2.6.8";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://swupdate.openvpn.net/community/releases/openvpn-${version}.tar.gz";
|
||||
sha256 = "sha256-Xt4VZcim2IAQD38jUxen7p7qg9UFLbVUfxOp52r3gF0=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [
|
||||
autoreconfHook
|
||||
pkg-config
|
||||
];
|
||||
|
||||
buildInputs = oldAttrs.buildInputs or [ ] ++ optional stdenv.hostPlatform.isLinux [ libnl.dev ];
|
||||
|
||||
configureFlags = [
|
||||
# Assignment instead of appending to make sure to use exactly the flags required by mullvad
|
||||
|
||||
# Flags are based on https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L17
|
||||
"--enable-static"
|
||||
"--disable-shared"
|
||||
"--disable-debug"
|
||||
"--disable-plugin-down-root"
|
||||
"--disable-management"
|
||||
"--disable-port-share"
|
||||
"--disable-systemd"
|
||||
"--disable-dependency-tracking"
|
||||
"--disable-pkcs11"
|
||||
"--disable-plugin-auth-pam"
|
||||
"--enable-plugins"
|
||||
"--disable-lzo"
|
||||
"--disable-lz4"
|
||||
"--enable-comp-stub"
|
||||
]
|
||||
++ optional stdenv.hostPlatform.isLinux [
|
||||
# Flags are based on https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L35
|
||||
"--enable-dco" # requires libnl
|
||||
"--disable-iproute2"
|
||||
];
|
||||
|
||||
patches = oldAttrs.patches or [ ] ++ [
|
||||
# look at compare to find the relevant commits
|
||||
# https://github.com/OpenVPN/openvpn/compare/release/2.6...mullvad:mullvad-patches
|
||||
# used openvpn version is the latest tag ending with -mullvad
|
||||
# https://github.com/mullvad/openvpn/tags
|
||||
(fetchMullvadPatch {
|
||||
# "Reduce PUSH_REQUEST_INTERVAL to one second"
|
||||
commit = "6fb5e33345831e2bb1df884343893b67ecb83be3";
|
||||
sha256 = "sha256-MmYeFSw6c/QJh0LqLgkx+UxrbtTVv6zEFcnYEqznR1c=";
|
||||
})
|
||||
(fetchMullvadPatch {
|
||||
# "Send an event to any plugins when authentication fails"
|
||||
commit = "96d5bf40610927684ed5d13f8b512b63e8f764ef";
|
||||
sha256 = "sha256-HsVx0ZlK7VIFSFet4bG+UEG9W38tavNIP/udesH+Mmg=";
|
||||
})
|
||||
(fetchMullvadPatch {
|
||||
# "Shutdown when STDIN is closed"
|
||||
commit = "30708cefbd067928c896e3ef2420b22b82167ab8";
|
||||
sha256 = "sha256-apL5CWc470DvleQ/pjracsTL+v0zT00apj5cTHWPQZs=";
|
||||
})
|
||||
(fetchMullvadPatch {
|
||||
# "Undo dependency on Python docutils"
|
||||
commit = "debde9db82d8c2bd4857482c5242722eb1c08e6a";
|
||||
sha256 = "sha256-UKbQa3MDTJLKg0kZ47N7Gier3a6HP2yB6A551yqhWZU=";
|
||||
})
|
||||
(fetchMullvadPatch {
|
||||
# "Prevent signal when stdin is closed from being cleared (#10)"
|
||||
commit = "78812c51f3b2b6cb9efb73225e1002d055800889";
|
||||
sha256 = "sha256-XaAE90nMgS862NZ5PWcdWKa0YClxr4S24Nq1OVXezTc=";
|
||||
})
|
||||
(fetchMullvadPatch {
|
||||
# "Disable libcap-ng"
|
||||
commit = "ca3d25f2eff82b5fbfe1012ce900a961d35b35de";
|
||||
sha256 = "sha256-6bEUJ1FHXi1mzxkAaNdrMIHVrhewWenhRnW53rr2o6E=";
|
||||
})
|
||||
(fetchMullvadPatch {
|
||||
# "Remove libnsl dep"
|
||||
commit = "2d9821971fb29fff7243b49292a74eedb4036236";
|
||||
sha256 = "sha256-Eeci6U6go1ujmbVQvIVM/xa4GSambLPSaowVIvtYlzQ=";
|
||||
})
|
||||
];
|
||||
postPatch = oldAttrs.postPatch or "" + ''
|
||||
rm ./configure
|
||||
'';
|
||||
|
||||
meta = oldAttrs.meta or { } // {
|
||||
description = "OpenVPN with Mullvad-specific patches applied";
|
||||
homepage = "https://github.com/mullvad/openvpn";
|
||||
maintainers = with lib.maintainers; [ cole-h ];
|
||||
};
|
||||
}
|
||||
)
|
||||
Reference in New Issue
Block a user