From 36630da39cb82a0fb75991ffeeefcb15623a47ea Mon Sep 17 00:00:00 2001 From: Arpit Chakladar Date: Tue, 28 Jul 2026 23:06:29 +0530 Subject: feat(usque): using usque for connecting with cloudflare warp - Using usque for an opensource alternative to cloudflare-warp client - Created utility script usque-warp that can automatically connect and disconnect channel with cloudflare warp --- modules/desktop/waybar/bar/main.nix | 1 - modules/desktop/waybar/module/default.nix | 1 - modules/desktop/waybar/module/vpn.nix | 21 ----- modules/desktop/waybar/style.nix | 4 +- modules/networking/default.nix | 1 + modules/networking/usque/default.nix | 21 +++++ modules/scripts/default.nix | 3 +- modules/scripts/usque-warp/default.nix | 23 +++++ modules/scripts/usque-warp/script.sh | 130 ++++++++++++++++++++++++++ modules/scripts/vpn-connect/assertions.nix | 11 --- modules/scripts/vpn-connect/default.nix | 32 ------- modules/scripts/vpn-connect/script.sh | 77 --------------- modules/scripts/vpn-disconnect/assertions.nix | 7 -- modules/scripts/vpn-disconnect/default.nix | 21 ----- modules/scripts/vpn-disconnect/script.sh | 27 ------ modules/security/default.nix | 3 +- modules/security/openvpn/default.nix | 17 ---- 17 files changed, 179 insertions(+), 221 deletions(-) delete mode 100644 modules/desktop/waybar/module/vpn.nix create mode 100644 modules/networking/usque/default.nix create mode 100644 modules/scripts/usque-warp/default.nix create mode 100644 modules/scripts/usque-warp/script.sh delete mode 100644 modules/scripts/vpn-connect/assertions.nix delete mode 100644 modules/scripts/vpn-connect/default.nix delete mode 100644 modules/scripts/vpn-connect/script.sh delete mode 100644 modules/scripts/vpn-disconnect/assertions.nix delete mode 100644 modules/scripts/vpn-disconnect/default.nix delete mode 100644 modules/scripts/vpn-disconnect/script.sh delete mode 100644 modules/security/openvpn/default.nix (limited to 'modules') diff --git a/modules/desktop/waybar/bar/main.nix b/modules/desktop/waybar/bar/main.nix index 4bbbc8b..276abd6 100644 --- a/modules/desktop/waybar/bar/main.nix +++ b/modules/desktop/waybar/bar/main.nix @@ -12,7 +12,6 @@ modules-right = [ "pulseaudio" "battery" - "custom/vpn" "network" "memory" "cpu" diff --git a/modules/desktop/waybar/module/default.nix b/modules/desktop/waybar/module/default.nix index 77d97cb..25cdb14 100644 --- a/modules/desktop/waybar/module/default.nix +++ b/modules/desktop/waybar/module/default.nix @@ -17,7 +17,6 @@ let "network" = ./network.nix; "clock#time" = ./time.nix; "pulseaudio" = ./volume.nix; - "custom/vpn" = ./vpn.nix; "hyprland/window" = ./window.nix; "hyprland/workspaces" = ./workspaces.nix; }; diff --git a/modules/desktop/waybar/module/vpn.nix b/modules/desktop/waybar/module/vpn.nix deleted file mode 100644 index 7eb8879..0000000 --- a/modules/desktop/waybar/module/vpn.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ - config, - lib, - pkgs, - mkIcon, - ... -}: -with config.scheme.withHashtag; -let - iconColor = base0C; - vpnCheckScript = pkgs.writeShellScript "vpn-check" '' - if ${lib.getExe' pkgs.iproute2 "ip"} a | ${lib.getExe pkgs.gnugrep} -q tun0; then - printf '${mkIcon iconColor ""} VPN' - fi - ''; -in -{ - exec = "${vpnCheckScript}"; - interval = 5; - format = "{}"; -} diff --git a/modules/desktop/waybar/style.nix b/modules/desktop/waybar/style.nix index 0f697c0..82aca19 100644 --- a/modules/desktop/waybar/style.nix +++ b/modules/desktop/waybar/style.nix @@ -11,7 +11,7 @@ with config.scheme.withHashtag; padding: 0; } - #workspaces, #window, #pulseaudio, #battery, #custom-vpn, #network, + #workspaces, #window, #pulseaudio, #battery, #network, #clock.time, #memory, #cpu, #clock.date { background: ${base00}; margin: 0 5px; @@ -22,7 +22,7 @@ with config.scheme.withHashtag; margin-right: 0; } - #window, #pulseaudio, #battery, #custom-vpn, #network, + #window, #pulseaudio, #battery, #network, #clock.time, #memory, #cpu, #clock.date { border: 1px solid ${base07}; color: ${base07}; diff --git a/modules/networking/default.nix b/modules/networking/default.nix index 17bbf38..ffafea2 100644 --- a/modules/networking/default.nix +++ b/modules/networking/default.nix @@ -4,5 +4,6 @@ imports = [ ./bluetui ./impala + ./usque ]; } diff --git a/modules/networking/usque/default.nix b/modules/networking/usque/default.nix new file mode 100644 index 0000000..c5ef315 --- /dev/null +++ b/modules/networking/usque/default.nix @@ -0,0 +1,21 @@ +# Usque - Open-source reimplementation of the Cloudflare WARP client's MASQUE protocol +{ + config, + pkgs, + lib, + ... +}: +{ + options.networking.usque = { + enable = lib.mkEnableOption "Enables usque."; + package = lib.mkOption { + type = lib.types.package; + default = pkgs.usque; + description = "The usque package to use."; + }; + }; + + config = lib.mkIf config.networking.usque.enable { + home.packages = [ config.networking.usque.package ]; + }; +} diff --git a/modules/scripts/default.nix b/modules/scripts/default.nix index 684ca42..90b7c9c 100644 --- a/modules/scripts/default.nix +++ b/modules/scripts/default.nix @@ -9,8 +9,7 @@ ./neomutt-sync ./screen-recording ./system-monitor - ./vpn-connect - ./vpn-disconnect + ./usque-warp ./yazi-file-chooser ]; diff --git a/modules/scripts/usque-warp/default.nix b/modules/scripts/usque-warp/default.nix new file mode 100644 index 0000000..77bf341 --- /dev/null +++ b/modules/scripts/usque-warp/default.nix @@ -0,0 +1,23 @@ +{ + config, + lib, + pkgs, + ... +}: +let + inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule; + base = mkScriptModule { + name = "usque-warp"; + path = ./script.sh; + description = "Connect/disconnect to Cloudflare WARP via usque MASQUE tunnel"; + deps = [ + config.networking.usque.package + pkgs.bash + ]; + inherit config; + }; +in +{ + options = base.options; + config = base.moduleConfig; +} diff --git a/modules/scripts/usque-warp/script.sh b/modules/scripts/usque-warp/script.sh new file mode 100644 index 0000000..9dc735a --- /dev/null +++ b/modules/scripts/usque-warp/script.sh @@ -0,0 +1,130 @@ +set -euo pipefail + +CONFIG_DIR="$HOME/.cache/usque" +CONFIG="$CONFIG_DIR/config.json" + +TUN_DEV="tun0" +PID_FILE="/tmp/usque-warp.pid" +STATE_FILE="/tmp/usque-warp.state" +LOG_FILE="/tmp/usque-warp.log" + + +ensure_config() { + if [[ -f "$CONFIG" ]]; then + return + fi + + echo "usque config not found." + echo "Creating $CONFIG_DIR..." + + mkdir -p "$CONFIG_DIR" + + echo "Registering Cloudflare WARP account..." + usque register + + echo "Generating usque config..." + usque generate -o "$CONFIG" + + if [[ ! -f "$CONFIG" ]]; then + echo "Failed to create config file: $CONFIG" + exit 1 + fi + + echo "Config created successfully." +} + + +connect() { + ensure_config + + if [[ -f "$PID_FILE" ]]; then + echo "usque-warp is already running" + exit 1 + fi + + echo "Starting usque..." + + sudo usque nativetun -c "$CONFIG" >"$LOG_FILE" 2>&1 & + echo $! > "$PID_FILE" + + echo "Waiting for MASQUE connection..." + + MASQUE_IP="" + + for i in {1..30}; do + MASQUE_IP=$(grep -oP 'MASQUE connection to \K[0-9.]+(?=:443)' "$LOG_FILE" 2>/dev/null || true) + + if [[ -n "$MASQUE_IP" ]]; then + break + fi + + sleep 1 +done + + if [[ -z "$MASQUE_IP" ]]; then + echo "Failed to detect MASQUE endpoint" + kill "$(cat "$PID_FILE")" || true + rm "$PID_FILE" + exit 1 + fi + + DEFAULT_ROUTE=$(ip route show default | head -n1) + + GATEWAY=$(echo "$DEFAULT_ROUTE" | awk '{for(i=1;i<=NF;i++) if($i=="via") print $(i+1)}') + INTERFACE=$(echo "$DEFAULT_ROUTE" | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}') + + if [[ -z "$GATEWAY" || -z "$INTERFACE" ]]; then + echo "Cannot determine gateway" + exit 1 + fi + + echo "$GATEWAY $INTERFACE $MASQUE_IP" > "$STATE_FILE" + + echo "Allowing MASQUE endpoint outside tunnel..." + sudo ip route replace "$MASQUE_IP" via "$GATEWAY" dev "$INTERFACE" + + echo "Switching default route to tun0..." + sudo ip route replace default dev "$TUN_DEV" metric 1 + + echo "Connected" +} + + +disconnect() { + echo "Disconnecting..." + + if [[ -f "$STATE_FILE" ]]; then + read GATEWAY INTERFACE MASQUE_IP < "$STATE_FILE" + + echo "Restoring normal route..." + + sudo ip route replace default via "$GATEWAY" dev "$INTERFACE" + + sudo ip route del "$MASQUE_IP" 2>/dev/null || true + + rm "$STATE_FILE" + fi + + if [[ -f "$PID_FILE" ]]; then + kill "$(cat "$PID_FILE")" 2>/dev/null || true + rm "$PID_FILE" + fi + + sudo ip route del default dev "$TUN_DEV" 2>/dev/null || true + + echo "Disconnected" +} + + +case "${1:-}" in + connect) + connect + ;; + disconnect) + disconnect + ;; + *) + echo "Usage: $0 {connect|disconnect}" + exit 1 + ;; +esac diff --git a/modules/scripts/vpn-connect/assertions.nix b/modules/scripts/vpn-connect/assertions.nix deleted file mode 100644 index 252df86..0000000 --- a/modules/scripts/vpn-connect/assertions.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ config, ... }: -[ - { - assertion = !config.scripts.vpn-connect.enable || config.security.openvpn.enable; - message = "scripts.vpn-connect is enabled but requires `security.openvpn.enable`."; - } - { - assertion = !config.scripts.vpn-connect.enable || config.terminal.fzf.enable; - message = "scripts.vpn-connect is enabled but requires `terminal.fzf.enable`."; - } -] diff --git a/modules/scripts/vpn-connect/default.nix b/modules/scripts/vpn-connect/default.nix deleted file mode 100644 index 194513f..0000000 --- a/modules/scripts/vpn-connect/default.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule; - base = mkScriptModule { - name = "vpn-connect"; - path = ./script.sh; - description = "VPN-connect - OpenVPN connection script with credential caching and monitoring"; - env = { - SYSTEMD_RESOLVED_PATH = "${config.security.openvpn.package}/libexec/update-systemd-resolved"; - }; - deps = [ - config.terminal.fzf.package - config.security.openvpn.package - pkgs.coreutils - pkgs.findutils - pkgs.gnugrep - pkgs.gnused - ]; - inherit config; - }; -in -{ - options = base.options; - config = base.moduleConfig // { - assertions = base.moduleConfig.assertions ++ (import ./assertions.nix { inherit config lib; }); - }; -} diff --git a/modules/scripts/vpn-connect/script.sh b/modules/scripts/vpn-connect/script.sh deleted file mode 100644 index 4ba8f3d..0000000 --- a/modules/scripts/vpn-connect/script.sh +++ /dev/null @@ -1,77 +0,0 @@ -CONF_DIR="$HOME/.config/openvpn" -CREDS_DIR="$CONF_DIR/credentials" -SERVERS_DIR="$CONF_DIR/servers" -CACHE_FILE="$HOME/.cache/openvpn/last_connection" -PID_FILE="$HOME/.cache/openvpn/vpn.pid" -LOG_FILE="$HOME/.cache/openvpn/vpn.log" - -mkdir -p "$CREDS_DIR" "$SERVERS_DIR" "$(dirname "$CACHE_FILE")" - -REFRESH=false -if [[ "$1" == "--refresh" || "$1" == "-r" ]]; then - REFRESH=true -fi - -# Load cache -if [[ "$REFRESH" == false && -f "$CACHE_FILE" ]]; then - source "$CACHE_FILE" - if [[ ! -f "$CRED" || ! -f "$SERVER" ]]; then - REFRESH=true - fi -else - REFRESH=true -fi - -# Select if needed -if [[ "$REFRESH" == true ]]; then - CRED=$(find "$CREDS_DIR" -type f | fzf --prompt="Select Credentials > ") - [ -z "$CRED" ] && exit 1 - - SERVER=$(find "$SERVERS_DIR" -type f \( -name "*.conf" -o -name "*.ovpn" \) | fzf --prompt="Select VPN Server > ") - [ -z "$SERVER" ] && exit 1 - - echo "CRED=\"$CRED\"" > "$CACHE_FILE" - echo "SERVER=\"$SERVER\"" >> "$CACHE_FILE" -fi - -echo "Connecting to $SERVER..." - -TMP_CONF=$(mktemp /tmp/vpn-config.XXXXXX) - -sed -e '/up \/etc\/openvpn\/update-resolv-conf/d' \ - -e '/down \/etc\/openvpn\/update-resolv-conf/d' "$SERVER" > "$TMP_CONF" - -# Run in background -sudo -v || exit 1 - -nohup sudo openvpn \ - --config "$TMP_CONF" \ - --auth-user-pass "$CRED" \ - --script-security 2 \ - --up "$SYSTEMD_RESOLVED_PATH" \ - --down "$SYSTEMD_RESOLVED_PATH" \ - --down-pre \ - > "$LOG_FILE" 2>&1 & - -VPN_PID=$! - -echo $VPN_PID > "$PID_FILE" -echo "VPN started in background (PID: $VPN_PID)" -echo "Logs: $LOG_FILE" - -# Wait until connected -echo -n "Waiting for VPN connection" -while true; do - if grep -q "Initialization Sequence Completed" "$LOG_FILE" 2>/dev/null; then - echo "" - echo "VPN connected successfully." - break - fi - if ! kill -0 "$VPN_PID" 2>/dev/null; then - echo "" - echo "VPN process died. Check logs: $LOG_FILE" - exit 1 - fi - sleep 1 - echo -n "." -done diff --git a/modules/scripts/vpn-disconnect/assertions.nix b/modules/scripts/vpn-disconnect/assertions.nix deleted file mode 100644 index 60c4e9b..0000000 --- a/modules/scripts/vpn-disconnect/assertions.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ config, ... }: -[ - { - assertion = !config.scripts.vpn-disconnect.enable || config.scripts.vpn-connect.enable; - message = "scripts.vpn-disconnect is enabled but requires `scripts.vpn-connect.enable`."; - } -] diff --git a/modules/scripts/vpn-disconnect/default.nix b/modules/scripts/vpn-disconnect/default.nix deleted file mode 100644 index 61f4738..0000000 --- a/modules/scripts/vpn-disconnect/default.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule; - base = mkScriptModule { - name = "vpn-disconnect"; - path = ./script.sh; - description = "VPN-disconnect - Kill VPN process and clean up"; - inherit config; - }; -in -{ - options = base.options; - config = base.moduleConfig // { - assertions = base.moduleConfig.assertions ++ (import ./assertions.nix { inherit config lib; }); - }; -} diff --git a/modules/scripts/vpn-disconnect/script.sh b/modules/scripts/vpn-disconnect/script.sh deleted file mode 100644 index ead912c..0000000 --- a/modules/scripts/vpn-disconnect/script.sh +++ /dev/null @@ -1,27 +0,0 @@ -PID_FILE="$HOME/.cache/openvpn/vpn.pid" - -if [[ ! -f "$PID_FILE" ]]; then - echo "No VPN PID file found." - exit 1 -fi - -PID=$(cat "$PID_FILE") - -if ps -p "$PID" > /dev/null 2>&1; then - echo "Stopping VPN (PID: $PID)..." - sudo kill "$PID" - - # Wait for clean shutdown - sleep 2 - - if ps -p "$PID" > /dev/null 2>&1; then - echo "Force killing VPN..." - sudo kill -9 "$PID" - fi - - echo "VPN disconnected." -else - echo "VPN process not running." -fi - -rm -f "$PID_FILE" diff --git a/modules/security/default.nix b/modules/security/default.nix index 3803897..2f01c7a 100644 --- a/modules/security/default.nix +++ b/modules/security/default.nix @@ -1,4 +1,4 @@ -# Security - Security tools (enteauth, gopass, gpg, openvpn, ssh) +# Security - Security tools (enteauth, gopass, gpg, ssh) { ... }: { @@ -6,7 +6,6 @@ ./enteauth ./gopass ./gpg - ./openvpn ./ssh ]; } diff --git a/modules/security/openvpn/default.nix b/modules/security/openvpn/default.nix deleted file mode 100644 index 58e53cf..0000000 --- a/modules/security/openvpn/default.nix +++ /dev/null @@ -1,17 +0,0 @@ -# OpenVPN - Open-source VPN client for secure remote access -{ - config, - lib, - pkgs, - ... -}: -{ - options.security.openvpn = { - enable = lib.mkEnableOption "Enables openvpn."; - package = lib.mkPackageOption pkgs "openvpn" { }; - }; - - config = lib.mkIf config.security.openvpn.enable { - home.packages = [ config.security.openvpn.package ]; - }; -} -- cgit v1.2.3