mirror of
https://github.com/unman/shaker.git
synced 2024-10-01 01:25:41 -04:00
90 lines
3.1 KiB
RPMSpec
90 lines
3.1 KiB
RPMSpec
Name: 3isec-qubes-sys-vpn
|
|
Version: 2.01
|
|
Release: 1%{?dist}
|
|
Summary: Create an openvpn proxy in Qubes
|
|
|
|
License: GPLv3+
|
|
SOURCE0: openvpn
|
|
|
|
%description
|
|
This package sets up a VPN gateway, named sys-vpn, using openvpn.
|
|
It follows the method detailed in the Qubes docs,
|
|
https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md
|
|
using nftables and CLI scripts.
|
|
|
|
The package creates a qube called sys-vpn based on the debian-12-minimal
|
|
template. If the debian-12-minimal template is not present, it will
|
|
be downloaded and installed - this may take some time depending on your
|
|
net connection.
|
|
|
|
There are minor changes to the firewall rules on sys-vpn to ensure
|
|
blocking of outbound connections via eth0.
|
|
When the VPN is inactive only DNS traffic is allowed from sys-vpn.
|
|
When the VPN is active, no traffic is allowed except through the VPN
|
|
tunnel.
|
|
If the VPN uses Google's 8.8.8.8 server for DNS, this will be changed
|
|
to use Quad-9 servers.
|
|
sys-vpn will have the netvm set to the global default_netvm. Change this
|
|
as you will.
|
|
|
|
After installing, copy your openvpn configuration file or zip file
|
|
to sys-vpn.
|
|
Run setup_vpn to set up the VPN.
|
|
There should be a menu item for this script - if you cannot see it, you may
|
|
need to refresh the application list in sys-vpn settings.
|
|
When finished, restart sys-vpn.
|
|
|
|
To use the VPN, set sys-vpn as the netvm for your qubes(s).
|
|
All traffic will go through the VPN.
|
|
The VPN will fail closed if the connection drops.
|
|
No traffic will go through clear.
|
|
|
|
If you remove the package, the salt files will be removed.
|
|
**The sys-vpn gateway will also be removed.**
|
|
To do this ALL qubes will be checked to see if they use sys-vpn.
|
|
If they do, their netvm will be set to `none`.
|
|
|
|
You can, of course, use template-openvpn to create other VPN gateways.
|
|
|
|
|
|
%install
|
|
rm -rf %{buildroot}
|
|
mkdir -p %{buildroot}/srv/salt
|
|
cp -rv %{SOURCE0}/ %{buildroot}/srv/salt
|
|
|
|
%files
|
|
%defattr(-,root,root,-)
|
|
/srv/salt/openvpn/*
|
|
|
|
%post
|
|
if [ $1 -eq 1 ]; then
|
|
qubesctl state.apply openvpn.clone
|
|
qubesctl --skip-dom0 --targets=template-openvpn state.apply openvpn.install
|
|
qubesctl state.apply openvpn.create
|
|
qubesctl --skip-dom0 --targets=sys-vpn state.apply openvpn.client_install
|
|
fi
|
|
|
|
%postun
|
|
if [ $1 -eq 0 ]; then
|
|
for i in `qvm-ls -O NAME,NETVM | awk '/ sys-vpn/{ print $1 }'`;do qvm-prefs $i netvm none; done
|
|
qvm-kill sys-vpn
|
|
qvm-remove --force sys-vpn template-openvpn
|
|
fi
|
|
|
|
%changelog
|
|
* Tue Fri 13 2024 unman <unman@thirdeyesecurity.org> - 2.01
|
|
- Attach sys-vpn to global default_netvm
|
|
* Mon Fri 05 2024 unman <unman@thirdeyesecurity.org> - 2.0
|
|
- Change to nftables implementation
|
|
* Mon Jun 12 2023 unman <unman@thirdeyesecurity.org> - 1.4
|
|
- Fix typo
|
|
* Mon Feb 20 2023 unman <unman@thirdeyesecurity.org> - 1.3
|
|
- Use pillar for cacher to determine repo changes
|
|
* Thu Sep 29 2022 unman <unman@thirdeyesecurity.org> - 1.2
|
|
- Force creation of menu item for setup script.
|
|
* Sat Sep 17 2022 unman <unman@thirdeyesecurity.org> - 1.1
|
|
- Change in menu creation for setup item.
|
|
- Improve description.
|
|
* Wed May 18 2022 unman <unman@thirdeyesecurity.org> - 1.0
|
|
- First Build
|