mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-09-11 15:08:33 +01:00
Code Issues Wiki Activity

nixos/cloudflare-warp: init

Browse source 
Co-authored-by: John Titor <50095635+JohnRTitor@users.noreply.github.com>
removed `with lib;` at the top level
cleanup
This commit is contained in:
Trey Fortmuller 2024-06-19 23:55:41 +01:00 committed by John Titor
parent 3d334228f4
commit 7b32ea9abb
No known key found for this signature in database
GPG key ID: 29B0514F4E3C1CC0
2 changed files with 92 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
nixos/modules/module-list.nix
View file

@ -973,6 +973,7 @@
./services/networking/clatd.nix
./services/networking/cloudflare-dyndns.nix
./services/networking/cloudflared.nix
./services/networking/cloudflare-warp.nix
./services/networking/cntlm.nix
./services/networking/connman.nix
./services/networking/consul.nix

91
nixos/modules/services/networking/cloudflare-warp.nix Normal file
View file

@ -0,0 +1,91 @@
{ config, lib, pkgs, ... }:
let
cfg = config.services.cloudflare-warp;
in
{
options.services.cloudflare-warp = {
enable = lib.mkEnableOption "Cloudflare Zero Trust client daemon";
package = lib.mkPackageOption pkgs "cloudflare-warp" { };
rootDir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/cloudflare-warp";
description = ''
Working directory for the warp-svc daemon.
'';
};
udpPort = lib.mkOption {
type = lib.types.port;
default = 2408;
description = ''
The UDP port to open in the firewall. Warp uses port 2408 by default, but fallback ports can be used
if that conflicts with another service. See the [firewall documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall#warp-udp-ports)
for the pre-configured available fallback ports.
'';
};
openFirewall = lib.mkEnableOption "opening UDP ports in the firewall" // {
default = true;
};
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ cfg.package ];
networking.firewall = lib.mkIf cfg.openFirewall {
allowedUDPPorts = [ cfg.udpPort ];
};
systemd.tmpfiles.rules = [
"d ${cfg.rootDir} - root root"
"z ${cfg.rootDir} - root root"
];
systemd.services.cloudflare-warp = {
enable = true;
description = "Cloudflare Zero Trust Client Daemon";
# lsof is used by the service to determine which UDP port to bind to
# in the case that it detects collisions.
path = [ pkgs.lsof ];
requires = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig =
let
caps = [
"CAP_NET_ADMIN"
"CAP_NET_BIND_SERVICE"
"CAP_SYS_PTRACE"
];
in
{
Type = "simple";
ExecStart = "${cfg.package}/bin/warp-svc";
ReadWritePaths = [ "${cfg.rootDir}" "/etc/resolv.conf" ];
CapabilityBoundingSet = caps;
AmbientCapabilities = caps;
Restart = "always";
RestartSec = 5;
Environment = [ "RUST_BACKTRACE=full" ];
WorkingDirectory = cfg.rootDir;
# See the systemd.exec docs for the canonicalized paths, the service
# makes use of them for logging, and account state info tracking.
# https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=
StateDirectory = "cloudflare-warp";
RuntimeDirectory = "cloudflare-warp";
LogsDirectory = "cloudflare-warp";
# The service needs to write to /etc/resolv.conf to configure DNS, so that file would have to
# be world read/writable to run as anything other than root.
User = "root";
Group = "root";
};
};
};
meta.maintainers = with lib.maintainers; [ treyfortmuller ];
}