Merge pull request #226514 from AtaraxiaSjel/update/ivpn

- [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake.

- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable).

## Backward Incompatibilities {#sec-release-23.05-incompatibilities}

<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

  ./services/networking/iscsi/initiator.nix

  ./services/networking/iscsi/root-initiator.nix

  ./services/networking/iscsi/target.nix

  ./services/networking/ivpn.nix

  ./services/networking/iwd.nix

  ./services/networking/jibri/default.nix

  ./services/networking/jicofo.nix

{ config, lib, pkgs, ... }:

let

  cfg = config.services.ivpn;

in

with lib;

{

  options.services.ivpn = {

    enable = mkOption {

      type = types.bool;

      default = false;

      description = lib.mdDoc ''

        This option enables iVPN daemon.

        This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security.

      '';

    };

  };

  config = mkIf cfg.enable {

    boot.kernelModules = [ "tun" ];

    environment.systemPackages = with pkgs; [ ivpn ivpn-service ];

    # iVPN writes to /etc/iproute2/rt_tables

    networking.iproute2.enable = true;

    networking.firewall.checkReversePath = "loose";

    systemd.services.ivpn-service = {

      description = "iVPN daemon";

      wantedBy = [ "multi-user.target" ];

      wants = [ "network.target" ];

      after = [

        "network-online.target"

        "NetworkManager.service"

        "systemd-resolved.service"

      ];

      path = [

        # Needed for mount

        "/run/wrappers"

      ];

      startLimitBurst = 5;

      startLimitIntervalSec = 20;

      serviceConfig = {

        ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging";

        Restart = "always";

        RestartSec = 1;

      };

    };

  };

  meta.maintainers = with maintainers; [ ataraxiasjel ];

}

, fetchFromGitHub

, lib

, wirelesstools

, makeWrapper

, wireguard-tools

, openvpn

, obfs4

, iproute2

, dnscrypt-proxy2

, iptables

, gawk

, util-linux

}:

builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {

  inherit pname;

  version = "3.10.0";

  version = "3.10.15";

  src = fetchFromGitHub {

    owner = "ivpn";

    repo = "desktop-app";

    rev = "v${version}";

    hash = "sha256-oX1PWIBPDcvBTxstEiN2WosiVUNXJoloppkpcABSi7Y=";

    hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk=";

  };

  ldflags = [

    homepage = "https://www.ivpn.net/apps";

    changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";

    license = licenses.gpl3Only;

    maintainers = with maintainers; [ urandom ];

    maintainers = with maintainers; [ urandom ataraxiasjel ];

  };

})) {

  ivpn = {

    modRoot = "cli";

    vendorHash = "sha256-5FvKR1Kz91Yi/uILVFyJRnwFZSmZ5qnotXqOI4fKLbY=";

    vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0=";

  };

  ivpn-service = {

    modRoot = "daemon";

    vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8=";

    nativeBuildInputs = [ makeWrapper ];

    buildInputs = [ wirelesstools ];

    patches = [ ./permissions.patch ];

    postPatch = ''

      substituteInPlace daemon/service/platform/platform_linux.go \

        --replace 'openVpnBinaryPath = "/usr/sbin/openvpn"' \

        'openVpnBinaryPath = "${openvpn}/bin/openvpn"' \

        --replace 'routeCommand = "/sbin/ip route"' \

        'routeCommand = "${iproute2}/bin/ip route"'

      substituteInPlace daemon/netinfo/netinfo_linux.go \

        --replace 'retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route")' \

        'retErr := shell.ExecAndProcessOutput(log, outParse, "", "${iproute2}/bin/ip", "route")'

      substituteInPlace daemon/service/platform/platform_linux_release.go \

        --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\"" \

        --replace 'obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")' \

        'obfsproxyStartScript = "${obfs4}/bin/obfs4proxy"' \

        --replace 'wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")' \

        'wgBinaryPath = "${wireguard-tools}/bin/wg-quick"' \

        --replace 'wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")' \

        'wgToolBinaryPath = "${wireguard-tools}/bin/wg"' \

        --replace 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \

        'dnscryptproxyBinPath = "${dnscrypt-proxy2}/bin/dnscrypt-proxy"'

    '';

    postFixup = ''

      mkdir -p $out/etc

      cp -r $src/daemon/References/Linux/etc/* $out/etc/

      cp -r $src/daemon/References/common/etc/* $out/etc/

      patchShebangs --build $out/etc/firewall.sh $out/etc/splittun.sh $out/etc/client.down $out/etc/client.up

      wrapProgram "$out/bin/ivpn-service" \

        --suffix PATH : ${lib.makeBinPath [ iptables gawk util-linux ]}

    '';

  };

}

diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go

index 941a99a7..df821c4d 100644

--- a/daemon/service/platform/platform.go

+++ b/daemon/service/platform/platform.go

@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {

 	}

 	// checking file permissions

-	if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil {

-		errors = append(errors, err)

-	}

-	if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil {

-		errors = append(errors, err)

-	}

 	if len(openvpnUpScript) > 0 {

 		if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil {

@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {

 	if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil {

 		errors = append(errors, err)

 	}

-	if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil {

-		errors = append(errors, err)

-	}

 	if len(routeCommand) > 0 {

 		routeBinary := strings.Split(routeCommand, " ")[0]