From e45a06ebd1d761ccd48b6279c7ebb4429b17a6aa Mon Sep 17 00:00:00 2001
From: Leon Schuermann <leon.git@is.currently.online>
Date: Mon, 15 Jan 2018 14:34:58 +0700
Subject: openvpn: add option to store credentials

---
 nixos/modules/services/networking/openvpn.nix | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

(limited to 'nixos')

diff --git a/nixos/modules/services/networking/openvpn.nix b/nixos/modules/services/networking/openvpn.nix
index 3fbf5a9f0227..8a059f609546 100644
--- a/nixos/modules/services/networking/openvpn.nix
+++ b/nixos/modules/services/networking/openvpn.nix
@@ -50,6 +50,11 @@ let
               "up ${pkgs.writeScript "openvpn-${name}-up" upScript}"}
           ${optionalString (cfg.down != "" || cfg.updateResolvConf)
               "down ${pkgs.writeScript "openvpn-${name}-down" downScript}"}
+          ${optionalString (cfg.authUserPass != null)
+              "auth-user-pass ${pkgs.writeText "openvpn-credentials-${name}" ''
+                ${cfg.authUserPass.username}
+                ${cfg.authUserPass.password}
+              ''}"}
         '';
 
     in {
@@ -161,6 +166,27 @@ in
             '';
           };
 
+          authUserPass = mkOption {
+            default = null;
+            description = ''
+              This option can be used to store the username / password credentials
+              with the "auth-user-pass" authentication method.
+            '';
+            type = types.nullOr (types.submodule {
+
+              options = {
+                username = mkOption {
+                  description = "The username to store inside the credentials file.";
+                  type = types.string;
+                };
+
+                password = mkOption {
+                  description = "The password to store inside the credentials file.";
+                  type = types.string;
+                };
+              };
+            });
+          };
         };
 
       });
-- 
cgit 1.4.1


From 22e83d26673160bc7ad6f5a36b9ee01373806cd8 Mon Sep 17 00:00:00 2001
From: Leon Schuermann <leon.git@is.currently.online>
Date: Tue, 16 Jan 2018 11:40:16 +0700
Subject: openvpn: add warning about world-readable credentials

---
 nixos/modules/services/networking/openvpn.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'nixos')

diff --git a/nixos/modules/services/networking/openvpn.nix b/nixos/modules/services/networking/openvpn.nix
index 8a059f609546..7a96b673c51e 100644
--- a/nixos/modules/services/networking/openvpn.nix
+++ b/nixos/modules/services/networking/openvpn.nix
@@ -171,6 +171,8 @@ in
             description = ''
               This option can be used to store the username / password credentials
               with the "auth-user-pass" authentication method.
+
+              WARNING: Using this option will put the credentials WORLD-READABLE in the Nix store!
             '';
             type = types.nullOr (types.submodule {
 
-- 
cgit 1.4.1