I’m using ProtonVPN with wg-quick.
{
options.modules.services.protonvpn = with lib.types; {
enable = mkBoolOpt false;
autostart = mkBoolOpt true;
conf = mkOpt str "";
};
config = mkIf cfg.enable {
networking.wg-quick.interfaces."protonvpn" = {
inherit (cfg) autostart;
configFile = cfg.conf; # Absolute path to config file in string format
};
};
}
I very very regularly get blocked from various hosts such as cache.nixos.org when attempting to pull from binary caches. As well as when simply updating / checking inputs like the below
inputs.nixpkgs.url = “https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz”
Error in question (I use tack for dependency management, but same issue with flake inputs)
[✗] nixpkgs failed to unpack `/tmp/.tmptaXGAo/nixpkgs-26.11pre1020805.89570f24e97e/nixos/tests/acme/dns01.nix`: failed to unpack `nixpkgs-26.11pre1020805.89570f24e97e/nixos/tests/acme/dns01.nix` into `/tmp/.tmptaXGAo/nixpkgs-26.11pre1020805.89570f24e97e/nixos/tests/acme/dns01.nix`: Peer disconnected
I can technically resolve by just re-requesting a new ProtonVPN configuration that uses a different endpoint from the same city, pasting it in the target file location and restarting the wireguard service. But inevitably, every endpoint gets blocked and I have to switch again.
Has anyone else encountered this or have any workarounds?
Ideally, I think the best solution would be to somehow exclude various domains such as cache.nixos.org from the tunnel so that they are routed from my public address rather than through the blocked VPN endpoint. Or at least that’s the best solution I could come up with, although it does admittedly have the drawback of allowing a DNS leak for updates.
Though lately, I’ve just been completely disabling the wireguard service to update, and then re-enabling it after.