Add openfortivpn.nix with sops secrets.

flake.lock

@@ -23,11 +23,11 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1758835276,
+        "lastModified": 1759394888,
-        "narHash": "sha256-RlfV0236hc1olvLMUDmd6uBOYGqr+77pF+UjGzELPA8=",
+        "narHash": "sha256-FwmvYoAcBtsKW4dGVeD+/zHKov3cIYfyWO1Fwqv3HwQ=",
         "ref": "refs/heads/main",
-        "rev": "38102377bbb3ecc2de852446ad03a6e4e98aba0b",
+        "rev": "e5ceedd0e56ae0272875765da13dccabf8747764",
-        "revCount": 7,
+        "revCount": 10,
         "type": "git",
         "url": "file:///home/beastie/nixos/secrets"
       },

hosts/home-nix/default.nix

@@ -11,7 +11,6 @@
   
   imports = builtins.trace "${inputs.mysecrets}" [
     (modulesPath + "/installer/scan/not-detected.nix")
-    ./network.nix
     ./disk-config.nix
     ./hardware-configuration.nix
     ../../modules/core

hosts/home-nix/network.nix

@@ -1,29 +0,0 @@
-{
-  hostname,
-  ...
-}:
-{
-  networking = {
-    hostName = "${hostname}";
-    interfaces.enp5s0 = {
-      ipv4.addresses = [
-        {
-          address = "192.168.0.2";
-          prefixLength = 24;
-        }
-      ];
-    };
-    defaultGateway = {
-      address = "192.168.0.254";
-      interface = "enp5s0";
-    };
-    nameservers = [
-      "9.9.9.9"
-      "2001:41d0:303:20da::1"
-      "217.182.138.218"
-    ];
-    networkmanager.enable = true;
-
-    firewall.enable = true;
-  };
-}

hosts/test-kvm/network.nix

@@ -1,29 +0,0 @@
-{
-  hostname,
-  ...
-}:
-{
-  networking = {
-    hostName = "${hostname}";
-    interfaces.enp1s0 = {
-      ipv4.addresses = [
-        {
-          address = "192.168.122.100";
-          prefixLength = 24;
-        }
-      ];
-    };
-    defaultGateway = {
-      address = "192.168.122.1";
-      interface = "enp1s0";
-    };
-    nameservers = [
-      "9.9.9.9"
-      "2001:41d0:303:20da::1"
-      "217.182.138.218"
-    ];
-    networkmanager.enable = true;
-
-    firewall.enable = true;
-  };
-}

hosts/work-nix/default.nix

@@ -7,9 +7,10 @@
   ...
 }:
 {
+  system.stateVersion = "25.11";
+
   imports = builtins.trace "${inputs.mysecrets}" [
     (modulesPath + "/installer/scan/not-detected.nix")
-    ./network.nix
     ./hardware-configuration.nix
     ../../modules/core
     ../../modules/optionnals/hosts/${hostname}.nix

hosts/work-nix/network.nix

@@ -1,11 +0,0 @@
-{
-  hostname,
-  ...
-}:
-{
-  networking = {
-    hostName = "${hostname}";
-    networkmanager.enable = true;
-    firewall.enable = true;
-  };
-}

modules/core/system.nix

@@ -0,0 +1,34 @@
+{
+  pkgs,
+  username,
+  hostname,
+  modulesPath,
+  inputs,
+  ...
+}:
+{
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  time.timeZone = "Europe/Paris";
+
+  nix = {
+    settings = {
+      ## Enable flakes
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      ## Users trusted to use flake command
+      trusted-users = [
+        "root"
+        "${username}"
+      ];
+    };
+  };
+
+  networking = {
+    hostName = "${hostname}";
+    networkmanager.enable = true;
+    firewall.enable = true;
+  };
+}

modules/optionnals/desktop/config/etc/xdg/hypr/hyprpaper.conf

@@ -0,0 +1,2 @@
+preload = ~/Downloads/wallpaper.jpeg
+wallpaper = , ~/Downloads/wallpaper.jpeg

modules/optionnals/desktop/kitty.nix

@@ -21,7 +21,7 @@
     starship.enable = true;
     bash = {
       promptInit = ''
-        [[ "$TERM" == "xterm-kitty" ]] && export TERM="xterm" 
+        [[ "$TERM" == "xterm-kitty" ]] && export TERM="xterm-256color" 
 
         [[ -f ${pkgs.nitch}/bin/nitch ]] && nitch
 

modules/optionnals/hosts/home-nix.nix

@@ -1,12 +1,14 @@
 {
+  pkgs,
   ...
 }:
 {
   imports = [
-    ../sops-desktop.nix
-    ../sudo-nopasswd.nix
     ../autologin.nix
+    ../openfortivpn.nix
+    ../sops-desktop.nix
     ../ssh.nix
+    ../sudo-nopasswd.nix
     
     ### Import GUI modules
     ../desktop/dunst.nix
@@ -21,4 +23,36 @@
     ### Import Graphics modules
     ../desktop/nvidia.nix
   ];
+
+    networking = {
+    interfaces.enp5s0 = {
+      ipv4.addresses = [
+        {
+          address = "192.168.0.2";
+          prefixLength = 24;
+        }
+      ];
+    };
+    defaultGateway = {
+      address = "192.168.0.254";
+      interface = "enp5s0";
+    };
+    nameservers = [
+      #"9.9.9.9"
+      "2001:41d0:303:20da::1"
+      "217.182.138.218"
+    ];
+    extraHosts = ''
+      172.18.21.172   errorpages.grandbesancon.fr
+      #172.18.23.4    dozzle.grandbesancon.fr
+      #172.18.22.206  toto.grandbesancon.fr
+      #172.18.229.3   sso.grandbesancon.fr
+      #172.18.20.37   sso.grandbesancon.fr
+      #172.18.20.229  auth.grandbesancon.fr
+      #172.18.20.181  traefikauth.grandbesancon.fr
+    '';
+  };
+  environment.systemPackages = [
+    pkgs.tor-browser
+  ];
 }

modules/optionnals/openfortivpn.nix

@@ -0,0 +1,100 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  openfortivpn-addroute = pkgs.writeShellScript "openfortivpn-addroute.sh" ''
+
+    sleep 2
+    ${pkgs.iproute2}/bin/ip route add 172.16.0.0/12 dev ppp0
+    ${pkgs.iproute2}/bin/ip route del default
+    ${pkgs.iproute2}/bin/ip route add default via 192.168.0.254
+    ${pkgs.coreutils-full}/bin/cat << EOF > /etc/resolv.conf
+    search ville.besancon
+    nameserver 172.18.96.1
+    nameserver 172.18.96.2
+    EOF
+  '';
+  openfortivpn-delroute = pkgs.writeShellScript "openfortivpn-delroute.sh" ''
+
+    sleep 2
+    ${pkgs.coreutils-full}/bin/cat << EOF > /etc/resolv.conf
+    nameserver 10.0.0.1
+    nameserver 2001:41d0:303:20da::1
+    nameserver 217.182.138.218
+    nameserver 9.9.9.9
+    EOF
+  '';
+
+  myMount = description: what: where: {
+    inherit description what where;
+    type = "cifs";
+    options = "credentials=/etc/openfortivpn/smb-secrets,uid=beastie,gid=users";
+  };
+  myAutoMount = description: where: {
+    inherit description where;
+    requires = [ "network-online.target" ];
+    after = [ "network-online.service" ];
+    wantedBy = [ "multi-user.target" ];
+    automountConfig = {
+      TimeoutIdleSec = 30;
+    };
+  };
+in
+{
+  sops = {
+    secrets = {
+      "ldap_GBM/username" = { };
+      "ldap_GBM/password" = { };
+      "openfortivpn/host" = { };
+      "openfortivpn/port" = { };
+    };
+    templates."openfortivpn.conf" = {
+      content = ''
+        host = ${config.sops.placeholder."openfortivpn/host"}
+        port = ${config.sops.placeholder."openfortivpn/port"}
+        username = ${config.sops.placeholder."ldap_GBM/username"}
+        password = ${config.sops.placeholder."ldap_GBM/password"}
+      '';
+      mode = "0600";
+      owner = "root";
+    };
+  };
+  environment.systemPackages = [
+    pkgs.openfortivpn
+    pkgs.cifs-utils
+  ];
+  systemd.services."openfortivpn" = {
+    enable = true;
+    #wantedBy = lib.mkForce [ ];
+    unitConfig = {
+      Description = "OpenFortiVPN";
+      After = "network-online.target";
+      Wants = "network-online.target systemd-networkd-wait-online.service";
+      Documentation = [
+        "man:openfortivpn(1) https://github.com/adrienverge/openfortivpn#readme https://github.com/adrienverge/openfortivpn/wiki"
+      ];
+    };
+    serviceConfig = {
+      Type = "notify";
+      PrivateTmp = "true";
+      ExecStart = "${pkgs.openfortivpn}/bin/openfortivpn --no-dns -c ${config.sops.templates."openfortivpn.conf".path}";
+      ExecStartPost = "${openfortivpn-addroute}";
+      ExecStopPost = "${openfortivpn-delroute}";
+      Restart = "on-failure";
+      #OOMScoreAdjust = "-100";
+    };
+  };
+
+  systemd.mounts = [
+    (myMount "GBM Perso" "//vf-mc2-sfic06.ville.besancon/usr_s$/SALVIJER/Mes Documents"
+      "/gbmshares/perso"
+    )
+    (myMount "GBM Services" "//vf-mc2-sfic06.ville.besancon/08TIC" "/gbmshares/services")
+  ];
+  systemd.automounts = [
+    (myAutoMount "GBM Perso automount" "/gbmshares/perso")
+    (myAutoMount "GBM Services automount" "/gbmshares/services")
+  ];
+}