jory
62c70dab19
The diff shows comprehensive code cleanup and formatting improvements across 18 files, including cleaner argument structures, additional package configurations, and improved formatting in the `home/terminal/software/git.nix` hook script.
98 lines
2.8 KiB
Nix
98 lines
2.8 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
# Cisco Secure Client (proprietary VPN client, successor to AnyConnect)
|
|
#
|
|
# Package: pkgs/cisco-secure-client — fetches the Linux pre-deployment .tgz
|
|
# from archive.org and extracts the bundled .deb.
|
|
#
|
|
# The user can override the source by passing a different package:
|
|
# work.cisco.package = pkgs.cisco-secure-client.overrideAttrs (_: {
|
|
# src = /path/to/local/cisco-secure-client-linux64-5.1.17.3394-predeploy-deb-k9.tgz;
|
|
# });
|
|
#
|
|
# Reference: https://github.com/NixOS/nixpkgs/issues/265443
|
|
let
|
|
cfg = config.work.cisco;
|
|
in {
|
|
options.work.cisco = {
|
|
enable =
|
|
lib.mkEnableOption "Cisco Secure Client"
|
|
// {
|
|
default = false;
|
|
};
|
|
|
|
package = lib.mkOption {
|
|
description = "cisco-secure-client package to use";
|
|
type = lib.types.package;
|
|
default = pkgs.cisco-secure-client;
|
|
defaultText = "pkgs.cisco-secure-client";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
environment.systemPackages = with pkgs; [
|
|
cfg.package
|
|
];
|
|
|
|
# The vpnagentd binary has /opt/cisco/secureclient/ hardcoded for runtime
|
|
# config paths (openssl.cnf, ossl-modules/). Create a symlink to the Nix store.
|
|
systemd.tmpfiles.rules = [
|
|
"d /opt 0755 root root -"
|
|
"L+ /opt/cisco/secureclient - - - - ${cfg.package}/cisco/secureclient"
|
|
];
|
|
|
|
# Load the tun module required by the VPN client
|
|
boot.kernelModules = ["tun"];
|
|
|
|
systemd.services.cisco-vpnagentd = {
|
|
description = "Cisco Secure Client VPN Agent Daemon";
|
|
# vpnagentd daemonizes itself; tracked via PID file.
|
|
after = ["network-online.target" "NetworkManager.service"];
|
|
wants = ["network-online.target"];
|
|
wantedBy = ["multi-user.target"];
|
|
|
|
serviceConfig = {
|
|
Type = "forking";
|
|
PIDFile = "/run/vpnagentd.pid";
|
|
# Use the wrapper (sets LD_LIBRARY_PATH) — the raw binary was restored
|
|
# from backup to preserve its embedded Cisco code signature, so it has
|
|
# no RPATH and needs the env var to find its bundled .so files.
|
|
ExecStart = "${cfg.package}/bin/vpnagentd";
|
|
Restart = "on-failure";
|
|
RestartSec = "5";
|
|
|
|
# Minimal capability set for VPN operation
|
|
CapabilityBoundingSet = [
|
|
"CAP_NET_ADMIN"
|
|
"CAP_NET_RAW"
|
|
"CAP_NET_BIND_SERVICE"
|
|
"CAP_DAC_OVERRIDE"
|
|
"CAP_SETUID"
|
|
"CAP_SETGID"
|
|
"CAP_CHOWN"
|
|
"CAP_FOWNER"
|
|
];
|
|
AmbientCapabilities = [
|
|
"CAP_NET_ADMIN"
|
|
"CAP_NET_RAW"
|
|
"CAP_NET_BIND_SERVICE"
|
|
"CAP_DAC_OVERRIDE"
|
|
"CAP_SETUID"
|
|
"CAP_SETGID"
|
|
"CAP_CHOWN"
|
|
"CAP_FOWNER"
|
|
];
|
|
DeviceAllow = ["/dev/net/tun rw"];
|
|
PrivateTmp = true;
|
|
ProtectSystem = "full";
|
|
ProtectHome = false;
|
|
NoNewPrivileges = false;
|
|
};
|
|
};
|
|
};
|
|
}
|