openvpn: support for updating systemd-resolved with DNS servers

1 files changed, 28 insertions, 8 deletions

diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 358c53f453b..2fe7a64a546 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -1,5 +1,6 @@
-{ stdenv, fetchurl, iproute, lzo, openssl, pam, pkgconfig
-, useSystemd ? stdenv.isLinux, systemd ? null
+{ stdenv, fetchurl, pkgconfig
+, iproute, lzo, openssl, pam
+, useSystemd ? stdenv.isLinux, systemd ? null, utillinux ? null
 , pkcs11Support ? false, pkcs11helper ? null,
 }:
 
@@ -8,7 +9,15 @@ assert pkcs11Support -> (pkcs11helper != null);
 
 with stdenv.lib;
 
-stdenv.mkDerivation rec {
+let
+  # There is some fairly brittle string substitutions going on to replace paths,
+  # so please verify this script in case you are upgrading it
+  update-resolved = fetchurl {
+    url = "https://raw.githubusercontent.com/jonathanio/update-systemd-resolved/v1.2.7/update-systemd-resolved";
+    sha256 = "12zfzh42apwbj7ks5kfxf3far7kaghlby4yapbhn00q8pbdlw7pq";
+  };
+
+in stdenv.mkDerivation rec {
   name = "openvpn-${version}";
   version = "2.4.6";
 
@@ -18,6 +27,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
+
   buildInputs = [ lzo openssl ]
                   ++ optionals stdenv.isLinux [ pam iproute ]
                   ++ optional useSystemd systemd
@@ -35,17 +45,27 @@ stdenv.mkDerivation rec {
     cp -r sample/sample-config-files/ $out/share/doc/openvpn/examples
     cp -r sample/sample-keys/ $out/share/doc/openvpn/examples
     cp -r sample/sample-scripts/ $out/share/doc/openvpn/examples
+
+    ${optionalString useSystemd ''
+      install -Dm755 ${update-resolved} $out/libexec/update-systemd-resolved
+
+      substituteInPlace $out/libexec/update-systemd-resolved \
+        --replace '/usr/bin/env bash' '${stdenv.shell} -e' \
+        --replace 'busctl call'       '${getBin systemd}/bin/busctl call' \
+        --replace '(ip '              '(${getBin iproute}/bin/ip ' \
+        --replace 'logger '           '${getBin utillinux}/bin/logger '
+    ''}
   '';
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A robust and highly flexible tunneling application";
-    homepage = https://openvpn.net/;
     downloadPage = "https://openvpn.net/index.php/open-source/downloads.html";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.viric ];
-    platforms = stdenv.lib.platforms.unix;
+    homepage = https://openvpn.net/;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ viric ];
+    platforms = platforms.unix;
     updateWalker = true;
   };
 }