feat(usque): using usque for connecting with cloudflare warp

- Using usque for an opensource alternative to cloudflare-warp client
- Created utility script usque-warp that can automatically connect and
disconnect channel with cloudflare warp

9 files changed, 154 insertions, 177 deletions

diff --git a/modules/scripts/default.nix b/modules/scripts/default.nix
index 684ca42..90b7c9c 100644
--- a/modules/scripts/default.nix
+++ b/modules/scripts/default.nix
@@ -9,8 +9,7 @@
     ./neomutt-sync
     ./screen-recording
     ./system-monitor
-    ./vpn-connect
-    ./vpn-disconnect
+    ./usque-warp
     ./yazi-file-chooser
   ];
 
diff --git a/modules/scripts/usque-warp/default.nix b/modules/scripts/usque-warp/default.nix
new file mode 100644
index 0000000..77bf341
--- /dev/null
+++ b/modules/scripts/usque-warp/default.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
+  base = mkScriptModule {
+    name = "usque-warp";
+    path = ./script.sh;
+    description = "Connect/disconnect to Cloudflare WARP via usque MASQUE tunnel";
+    deps = [
+      config.networking.usque.package
+      pkgs.bash
+    ];
+    inherit config;
+  };
+in
+{
+  options = base.options;
+  config = base.moduleConfig;
+}
diff --git a/modules/scripts/usque-warp/script.sh b/modules/scripts/usque-warp/script.sh
new file mode 100644
index 0000000..9dc735a
--- /dev/null
+++ b/modules/scripts/usque-warp/script.sh
@@ -0,0 +1,130 @@
+set -euo pipefail
+
+CONFIG_DIR="$HOME/.cache/usque"
+CONFIG="$CONFIG_DIR/config.json"
+
+TUN_DEV="tun0"
+PID_FILE="/tmp/usque-warp.pid"
+STATE_FILE="/tmp/usque-warp.state"
+LOG_FILE="/tmp/usque-warp.log"
+
+
+ensure_config() {
+  if [[ -f "$CONFIG" ]]; then
+    return
+  fi
+
+  echo "usque config not found."
+  echo "Creating $CONFIG_DIR..."
+
+  mkdir -p "$CONFIG_DIR"
+
+  echo "Registering Cloudflare WARP account..."
+  usque register
+
+  echo "Generating usque config..."
+  usque generate -o "$CONFIG"
+
+  if [[ ! -f "$CONFIG" ]]; then
+    echo "Failed to create config file: $CONFIG"
+    exit 1
+  fi
+
+  echo "Config created successfully."
+}
+
+
+connect() {
+  ensure_config
+
+  if [[ -f "$PID_FILE" ]]; then
+    echo "usque-warp is already running"
+    exit 1
+  fi
+
+  echo "Starting usque..."
+
+  sudo usque nativetun -c "$CONFIG" >"$LOG_FILE" 2>&1 &
+  echo $! > "$PID_FILE"
+
+  echo "Waiting for MASQUE connection..."
+
+  MASQUE_IP=""
+
+  for i in {1..30}; do
+    MASQUE_IP=$(grep -oP 'MASQUE connection to \K[0-9.]+(?=:443)' "$LOG_FILE" 2>/dev/null || true)
+
+    if [[ -n "$MASQUE_IP" ]]; then
+        break
+    fi
+
+    sleep 1
+done
+
+  if [[ -z "$MASQUE_IP" ]]; then
+    echo "Failed to detect MASQUE endpoint"
+    kill "$(cat "$PID_FILE")" || true
+    rm "$PID_FILE"
+    exit 1
+  fi
+
+  DEFAULT_ROUTE=$(ip route show default | head -n1)
+
+  GATEWAY=$(echo "$DEFAULT_ROUTE" | awk '{for(i=1;i<=NF;i++) if($i=="via") print $(i+1)}')
+  INTERFACE=$(echo "$DEFAULT_ROUTE" | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}')
+
+  if [[ -z "$GATEWAY" || -z "$INTERFACE" ]]; then
+    echo "Cannot determine gateway"
+    exit 1
+  fi
+
+  echo "$GATEWAY $INTERFACE $MASQUE_IP" > "$STATE_FILE"
+
+  echo "Allowing MASQUE endpoint outside tunnel..."
+  sudo ip route replace "$MASQUE_IP" via "$GATEWAY" dev "$INTERFACE"
+
+  echo "Switching default route to tun0..."
+  sudo ip route replace default dev "$TUN_DEV" metric 1
+
+  echo "Connected"
+}
+
+
+disconnect() {
+  echo "Disconnecting..."
+
+  if [[ -f "$STATE_FILE" ]]; then
+    read GATEWAY INTERFACE MASQUE_IP < "$STATE_FILE"
+
+    echo "Restoring normal route..."
+
+    sudo ip route replace default via "$GATEWAY" dev "$INTERFACE"
+
+    sudo ip route del "$MASQUE_IP" 2>/dev/null || true
+
+    rm "$STATE_FILE"
+  fi
+
+  if [[ -f "$PID_FILE" ]]; then
+    kill "$(cat "$PID_FILE")" 2>/dev/null || true
+    rm "$PID_FILE"
+  fi
+
+  sudo ip route del default dev "$TUN_DEV" 2>/dev/null || true
+
+  echo "Disconnected"
+}
+
+
+case "${1:-}" in
+  connect)
+    connect
+    ;;
+  disconnect)
+    disconnect
+    ;;
+  *)
+    echo "Usage: $0 {connect|disconnect}"
+    exit 1
+    ;;
+esac
diff --git a/modules/scripts/vpn-connect/assertions.nix b/modules/scripts/vpn-connect/assertions.nix
deleted file mode 100644
index 252df86..0000000
--- a/modules/scripts/vpn-connect/assertions.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ config, ... }:
-[
-  {
-    assertion = !config.scripts.vpn-connect.enable || config.security.openvpn.enable;
-    message = "scripts.vpn-connect is enabled but requires `security.openvpn.enable`.";
-  }
-  {
-    assertion = !config.scripts.vpn-connect.enable || config.terminal.fzf.enable;
-    message = "scripts.vpn-connect is enabled but requires `terminal.fzf.enable`.";
-  }
-]
diff --git a/modules/scripts/vpn-connect/default.nix b/modules/scripts/vpn-connect/default.nix
deleted file mode 100644
index 194513f..0000000
--- a/modules/scripts/vpn-connect/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "vpn-connect";
-    path = ./script.sh;
-    description = "VPN-connect - OpenVPN connection script with credential caching and monitoring";
-    env = {
-      SYSTEMD_RESOLVED_PATH = "${config.security.openvpn.package}/libexec/update-systemd-resolved";
-    };
-    deps = [
-      config.terminal.fzf.package
-      config.security.openvpn.package
-      pkgs.coreutils
-      pkgs.findutils
-      pkgs.gnugrep
-      pkgs.gnused
-    ];
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig // {
-    assertions = base.moduleConfig.assertions ++ (import ./assertions.nix { inherit config lib; });
-  };
-}
diff --git a/modules/scripts/vpn-connect/script.sh b/modules/scripts/vpn-connect/script.sh
deleted file mode 100644
index 4ba8f3d..0000000
--- a/modules/scripts/vpn-connect/script.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-CONF_DIR="$HOME/.config/openvpn"
-CREDS_DIR="$CONF_DIR/credentials"
-SERVERS_DIR="$CONF_DIR/servers"
-CACHE_FILE="$HOME/.cache/openvpn/last_connection"
-PID_FILE="$HOME/.cache/openvpn/vpn.pid"
-LOG_FILE="$HOME/.cache/openvpn/vpn.log"
-
-mkdir -p "$CREDS_DIR" "$SERVERS_DIR" "$(dirname "$CACHE_FILE")"
-
-REFRESH=false
-if [[ "$1" == "--refresh" || "$1" == "-r" ]]; then
-  REFRESH=true
-fi
-
-# Load cache
-if [[ "$REFRESH" == false && -f "$CACHE_FILE" ]]; then
-  source "$CACHE_FILE"
-  if [[ ! -f "$CRED" || ! -f "$SERVER" ]]; then
-    REFRESH=true
-  fi
-else
-  REFRESH=true
-fi
-
-# Select if needed
-if [[ "$REFRESH" == true ]]; then
-  CRED=$(find "$CREDS_DIR" -type f | fzf --prompt="Select Credentials > ")
-  [ -z "$CRED" ] && exit 1
-
-  SERVER=$(find "$SERVERS_DIR" -type f \( -name "*.conf" -o -name "*.ovpn" \) | fzf --prompt="Select VPN Server > ")
-  [ -z "$SERVER" ] && exit 1
-
-  echo "CRED=\"$CRED\"" > "$CACHE_FILE"
-  echo "SERVER=\"$SERVER\"" >> "$CACHE_FILE"
-fi
-
-echo "Connecting to $SERVER..."
-
-TMP_CONF=$(mktemp /tmp/vpn-config.XXXXXX)
-
-sed -e '/up \/etc\/openvpn\/update-resolv-conf/d' \
-  -e '/down \/etc\/openvpn\/update-resolv-conf/d' "$SERVER" > "$TMP_CONF"
-
-# Run in background
-sudo -v || exit 1
-
-nohup sudo openvpn \
-  --config "$TMP_CONF" \
-  --auth-user-pass "$CRED" \
-  --script-security 2 \
-  --up "$SYSTEMD_RESOLVED_PATH" \
-  --down "$SYSTEMD_RESOLVED_PATH" \
-  --down-pre \
-  > "$LOG_FILE" 2>&1 &
-
-VPN_PID=$!
-
-echo $VPN_PID > "$PID_FILE"
-echo "VPN started in background (PID: $VPN_PID)"
-echo "Logs: $LOG_FILE"
-
-# Wait until connected
-echo -n "Waiting for VPN connection"
-while true; do
-  if grep -q "Initialization Sequence Completed" "$LOG_FILE" 2>/dev/null; then
-    echo ""
-    echo "VPN connected successfully."
-    break
-  fi
-  if ! kill -0 "$VPN_PID" 2>/dev/null; then
-    echo ""
-    echo "VPN process died. Check logs: $LOG_FILE"
-    exit 1
-  fi
-  sleep 1
-  echo -n "."
-done
diff --git a/modules/scripts/vpn-disconnect/assertions.nix b/modules/scripts/vpn-disconnect/assertions.nix
deleted file mode 100644
index 60c4e9b..0000000
--- a/modules/scripts/vpn-disconnect/assertions.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{ config, ... }:
-[
-  {
-    assertion = !config.scripts.vpn-disconnect.enable || config.scripts.vpn-connect.enable;
-    message = "scripts.vpn-disconnect is enabled but requires `scripts.vpn-connect.enable`.";
-  }
-]
diff --git a/modules/scripts/vpn-disconnect/default.nix b/modules/scripts/vpn-disconnect/default.nix
deleted file mode 100644
index 61f4738..0000000
--- a/modules/scripts/vpn-disconnect/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "vpn-disconnect";
-    path = ./script.sh;
-    description = "VPN-disconnect - Kill VPN process and clean up";
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig // {
-    assertions = base.moduleConfig.assertions ++ (import ./assertions.nix { inherit config lib; });
-  };
-}
diff --git a/modules/scripts/vpn-disconnect/script.sh b/modules/scripts/vpn-disconnect/script.sh
deleted file mode 100644
index ead912c..0000000
--- a/modules/scripts/vpn-disconnect/script.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-PID_FILE="$HOME/.cache/openvpn/vpn.pid"
-
-if [[ ! -f "$PID_FILE" ]]; then
-    echo "No VPN PID file found."
-    exit 1
-fi
-
-PID=$(cat "$PID_FILE")
-
-if ps -p "$PID" > /dev/null 2>&1; then
-    echo "Stopping VPN (PID: $PID)..."
-    sudo kill "$PID"
-
-    # Wait for clean shutdown
-    sleep 2
-
-    if ps -p "$PID" > /dev/null 2>&1; then
-        echo "Force killing VPN..."
-        sudo kill -9 "$PID"
-    fi
-
-    echo "VPN disconnected."
-else
-    echo "VPN process not running."
-fi
-
-rm -f "$PID_FILE"