From defb7aac253468fd5b21506fb2128b48e4c86ae7 Mon Sep 17 00:00:00 2001 From: Dom Honey Date: Sun, 4 Jan 2026 19:59:41 +0000 Subject: [PATCH 1/2] mullvad: Remove openvpn to reflect dropped upstream support 2025.14 dropped support for openvpn: https://github.com/mullvad/mullvadvpn-app/blob/04443f9622153e3ff286c7a50b9ca7a0e1c60741/CHANGELOG.md#removed --- .../networking/mullvad/default.nix | 1 - .../networking/mullvad/mullvad.nix | 23 ---- .../networking/mullvad/openvpn.nix | 115 ------------------ 3 files changed, 139 deletions(-) delete mode 100644 pkgs/applications/networking/mullvad/openvpn.nix diff --git a/pkgs/applications/networking/mullvad/default.nix b/pkgs/applications/networking/mullvad/default.nix index 7c987f4b025a..625f0739883c 100644 --- a/pkgs/applications/networking/mullvad/default.nix +++ b/pkgs/applications/networking/mullvad/default.nix @@ -5,5 +5,4 @@ lib.makeScope newScope (self: { libwg = self.callPackage ./libwg.nix { }; mullvad = self.callPackage ./mullvad.nix { }; - openvpn-mullvad = self.callPackage ./openvpn.nix { }; }) diff --git a/pkgs/applications/networking/mullvad/mullvad.nix b/pkgs/applications/networking/mullvad/mullvad.nix index bb8bc8e45659..78a3c36cd698 100644 --- a/pkgs/applications/networking/mullvad/mullvad.nix +++ b/pkgs/applications/networking/mullvad/mullvad.nix @@ -12,9 +12,6 @@ libmnl, libwg, darwin, - enableOpenvpn ? true, - openvpn-mullvad, - shadowsocks-rust, installShellFiles, writeShellScriptBin, versionCheckHook, @@ -49,7 +46,6 @@ rustPlatform.buildRustPackage rec { "-p mullvad-problem-report --bin mullvad-problem-report" "-p mullvad-exclude --bin mullvad-exclude" "-p tunnel-obfuscation --bin tunnel-obfuscation" - "-p talpid-openvpn-plugin --lib" ]; checkFlags = [ @@ -87,24 +83,6 @@ rustPlatform.buildRustPackage rec { --fish $compdir/mullvad.fish ''; - postFixup = - # Files necessary for OpenVPN tunnels to work. - lib.optionalString enableOpenvpn '' - mkdir -p $out/share/mullvad - cp dist-assets/ca.crt $out/share/mullvad - ln -s ${openvpn-mullvad}/bin/openvpn $out/share/mullvad - ln -s ${shadowsocks-rust}/bin/sslocal $out/share/mullvad - '' - + - # Set the directory where Mullvad will look for its resources by default to - # `$out/share`, so that we can avoid putting the files in `$out/bin` -- - # Mullvad defaults to looking inside the directory its binary is located in - # for its resources. - '' - wrapProgram $out/bin/mullvad-daemon \ - --set-default MULLVAD_RESOURCE_DIR "$out/share/mullvad" - ''; - __darwinAllowLocalNetworking = true; nativeInstallCheckInputs = [ @@ -114,7 +92,6 @@ rustPlatform.buildRustPackage rec { passthru = { inherit libwg; - inherit openvpn-mullvad; }; meta = { diff --git a/pkgs/applications/networking/mullvad/openvpn.nix b/pkgs/applications/networking/mullvad/openvpn.nix deleted file mode 100644 index b554997dcba1..000000000000 --- a/pkgs/applications/networking/mullvad/openvpn.nix +++ /dev/null @@ -1,115 +0,0 @@ -{ - lib, - stdenv, - openvpn, - fetchpatch, - fetchurl, - libnl, - autoreconfHook, - pkg-config, -}: - -openvpn.overrideAttrs ( - oldAttrs: - let - inherit (lib) optional; - fetchMullvadPatch = - { commit, sha256 }: - fetchpatch { - url = "https://github.com/mullvad/openvpn/commit/${commit}.patch"; - inherit sha256; - }; - in - rec { - pname = "openvpn-mullvad"; - version = "2.6.8"; - - src = fetchurl { - url = "https://swupdate.openvpn.net/community/releases/openvpn-${version}.tar.gz"; - sha256 = "sha256-Xt4VZcim2IAQD38jUxen7p7qg9UFLbVUfxOp52r3gF0="; - }; - - nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [ - autoreconfHook - pkg-config - ]; - - buildInputs = oldAttrs.buildInputs or [ ] ++ optional stdenv.hostPlatform.isLinux [ libnl.dev ]; - - configureFlags = [ - # Assignment instead of appending to make sure to use exactly the flags required by mullvad - - # Flags are based on https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L17 - "--enable-static" - "--disable-shared" - "--disable-debug" - "--disable-plugin-down-root" - "--disable-management" - "--disable-port-share" - "--disable-systemd" - "--disable-dependency-tracking" - "--disable-pkcs11" - "--disable-plugin-auth-pam" - "--enable-plugins" - "--disable-lzo" - "--disable-lz4" - "--enable-comp-stub" - ] - ++ optional stdenv.hostPlatform.isLinux [ - # Flags are based on https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L35 - "--enable-dco" # requires libnl - "--disable-iproute2" - ]; - - patches = oldAttrs.patches or [ ] ++ [ - # look at compare to find the relevant commits - # https://github.com/OpenVPN/openvpn/compare/release/2.6...mullvad:mullvad-patches - # used openvpn version is the latest tag ending with -mullvad - # https://github.com/mullvad/openvpn/tags - (fetchMullvadPatch { - # "Reduce PUSH_REQUEST_INTERVAL to one second" - commit = "6fb5e33345831e2bb1df884343893b67ecb83be3"; - sha256 = "sha256-MmYeFSw6c/QJh0LqLgkx+UxrbtTVv6zEFcnYEqznR1c="; - }) - (fetchMullvadPatch { - # "Send an event to any plugins when authentication fails" - commit = "96d5bf40610927684ed5d13f8b512b63e8f764ef"; - sha256 = "sha256-HsVx0ZlK7VIFSFet4bG+UEG9W38tavNIP/udesH+Mmg="; - }) - (fetchMullvadPatch { - # "Shutdown when STDIN is closed" - commit = "30708cefbd067928c896e3ef2420b22b82167ab8"; - sha256 = "sha256-apL5CWc470DvleQ/pjracsTL+v0zT00apj5cTHWPQZs="; - }) - (fetchMullvadPatch { - # "Undo dependency on Python docutils" - commit = "debde9db82d8c2bd4857482c5242722eb1c08e6a"; - sha256 = "sha256-UKbQa3MDTJLKg0kZ47N7Gier3a6HP2yB6A551yqhWZU="; - }) - (fetchMullvadPatch { - # "Prevent signal when stdin is closed from being cleared (#10)" - commit = "78812c51f3b2b6cb9efb73225e1002d055800889"; - sha256 = "sha256-XaAE90nMgS862NZ5PWcdWKa0YClxr4S24Nq1OVXezTc="; - }) - (fetchMullvadPatch { - # "Disable libcap-ng" - commit = "ca3d25f2eff82b5fbfe1012ce900a961d35b35de"; - sha256 = "sha256-6bEUJ1FHXi1mzxkAaNdrMIHVrhewWenhRnW53rr2o6E="; - }) - (fetchMullvadPatch { - # "Remove libnsl dep" - commit = "2d9821971fb29fff7243b49292a74eedb4036236"; - sha256 = "sha256-Eeci6U6go1ujmbVQvIVM/xa4GSambLPSaowVIvtYlzQ="; - }) - ]; - postPatch = oldAttrs.postPatch or "" + '' - rm ./configure - ''; - - meta = oldAttrs.meta or { } // { - description = "OpenVPN with Mullvad-specific patches applied"; - homepage = "https://github.com/mullvad/openvpn"; - maintainers = with lib.maintainers; [ cole-h ]; - }; - } -) From c001f7763cb504886e16bf50875134c8518c41cb Mon Sep 17 00:00:00 2001 From: Dom Honey Date: Sun, 4 Jan 2026 20:29:04 +0000 Subject: [PATCH 2/2] nixos/mullvad-vpn: add boot blocking service as per upstream In their debs and rpms, Mullvad distributes a oneshot systemd service called mullvad-early-boot-blocking.service so it can enforce firewall rules in the event a user configures lockdown mode and wants traffic always routed through Mullvad. The mullvad NixOS service should offer the same functionality. A new option is included should users want to enable it. --- .../services/networking/mullvad-vpn.nix | 31 ++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/mullvad-vpn.nix b/nixos/modules/services/networking/mullvad-vpn.nix index b6c1a618407d..8ccec7997f82 100644 --- a/nixos/modules/services/networking/mullvad-vpn.nix +++ b/nixos/modules/services/networking/mullvad-vpn.nix @@ -27,6 +27,17 @@ with lib; ''; }; + enableEarlyBootBlocking = mkOption { + type = types.bool; + default = false; + description = '' + This option activates an additional oneshot systemd service to ensure that the mullvad daemon + will start and block traffic before any network configuration will be applied. + This matches what upstream Mullvad distributes for their supported distros, but is disabled by + default in NixOS as it may conflict with non-Mullvad network configuration. + ''; + }; + package = mkPackageOption pkgs "mullvad" { example = "mullvad-vpn"; extraDescription = '' @@ -48,6 +59,23 @@ with lib; source = "${cfg.package}/bin/mullvad-exclude"; }; + # see https://github.com/mullvad/mullvadvpn-app/blob/2025.14/dist-assets/linux/mullvad-early-boot-blocking.service + systemd.services.mullvad-early-boot-blocking = mkIf cfg.enableEarlyBootBlocking { + description = "Mullvad early boot network blocker"; + wantedBy = [ "mullvad-daemon.service" ]; + before = [ + "basic.target" + "mullvad-daemon.service" + ]; + unitConfig = { + DefaultDependencies = "no"; + }; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${cfg.package}/bin/mullvad-daemon --initialize-early-boot-firewall"; + }; + }; + systemd.services.mullvad-daemon = { description = "Mullvad VPN daemon"; wantedBy = [ "multi-user.target" ]; @@ -59,7 +87,8 @@ with lib; "network-online.target" "NetworkManager.service" "systemd-resolved.service" - ]; + ] + ++ lib.optional cfg.enableEarlyBootBlocking "mullvad-early-boot-blocking.service"; # See https://github.com/NixOS/nixpkgs/issues/262681 path = lib.optional config.networking.resolvconf.enable config.networking.resolvconf.package; startLimitBurst = 5;