Writing a module with fragile stateful data

Ozone6418 · February 27, 2024, 10:54pm

I am planning to write something to make it easier to set up a simple OpenVPN server on NixOS. It would handle all of the boilerplate config, certificate generation, and system setup, similar to openvpn-install. The problem is that in order to connect to the server, each client needs a config. If anything on the server changes, then every client will need a brand new config in order to connect. This is on top of managing all of the files that need to be generated and saved on the server’s end. I am trying to figure out a proper way to do this, but struggling.

I’ve considered:

Just make a module to set things up, use a startup script to generate/regenerate all the stuff if it doesn’t exist. Simplest option, but also the most fragile. Any mistakes on the server admin’s part will require a complete reissuing of client configs.
Module with some sort of “lock” setting. Basically, nothing is touched when the lock is turned on, but when it is turned off the whole thing gets regenerated basically every restart of the service. This idea just feels all-around awkward to me, and more of a bandaid than a real fix.
A shell script similar to the one I linked, that generates all of the necessary files as well as an openvpn.nix file to put into the server config. This would be pretty stable and easy to use (I would think), but doesn’t feel like a “Nix-ic” way to do things.

Lyndeno · February 27, 2024, 11:23pm

I did something similar this when I was using nebula (since switched to tailscale).

The config had information about each host, each host then had a config file generated to make it work.

This file has the bulk of the information. It has paths to other files in the repo (at this commit) that it references to help generate the config. Comments are near non-existent, sorry about that. Hopefully this can help.

github.com

Lyndeno/nix-config/blob/887b269224c258e88dcf9d2ad64c8e45fc888a9b/modules/services/nebula.nix

{config, lib, pkgs, ...}:

with lib;

# This file defines the nebula mesh that all my Nix machines will use
# This it to cleanup the config and remove duplicate information whenever possible

let
  allHosts = builtins.attrNames (builtins.readDir ../../hosts);
  cfg = config.modules.services.nebula;
  hostMap = builtins.listToAttrs (map
    (x: {
      name = x;
      value = (import ../../hosts/${x}/info.nix).nebula.matrix;
    })
    allHosts
  );
  externalHosts = remove null (lib.mapAttrsToList (name: value: 
    if (value ? externalAddress) then name else null) hostMap);
in {

This file has been truncated. show original

Ozone6418 · February 27, 2024, 11:50pm

Thanks for the resource. However, this seems more like a personal setup, somewhat akin to option 1. What I’m trying to do is make a general resource that anyone can plug-n-play, to save people the headache I had getting this working.

Ozone6418 · March 22, 2024, 11:20pm

I ended up going with option 1, but made it work by severely limiting the available configurations in the module. I think this is ok since it’s intended to be “sensible defaults”, not highly configurable. For reference to any googlers, GitHub - fin444/auto-openvpn.nix: Automatic configuration, certificate generation, and user management for OpenVPN on NixOS so you don't have to.