(define-module (machines vpn)
  #:use-module (guix gexp)
  #:use-module (gnu system)
  #:use-module (gnu services)
  #:use-module (gnu services certbot)
  #:use-module (gnu services vpn)
  #:use-module (system base-system)

  #:export (vpn.metznet.ca vpn-services))

(define-public vpn-services
  (append (list (service openvpn-server-service-type
                         (openvpn-server-configuration (tls-auth
                                                        "/etc/openvpn/ta.key")
                                                       (server
                                                        "10.0.80.0 255.255.255.0")))

                (simple-service 'vpn-server-etc etc-service-type
                                (let ((pki-dir (getenv "VPN_PKI_DIR")))
                                  (if pki-dir
                                      `(("openvpn/dh2048.pem" ,(local-file (string-append
                                                                            pki-dir
                                                                            "/dh2048.pem"))))
                                      `())))
                (service certbot-service-type
                         (certbot-configuration (email "admin@metznet.ca")
                                                (certificates (list (certificate-configuration
                                                                     (domains '
                                                                              ("vpn.metznet.ca"))))))))
          (modify-services %metznet-server-services
            (delete openvpn-client-service-type))))

(define-public vpn.metznet.ca
  (operating-system
    (inherit %metznet-base-server-system)
    (host-name "vpn.metznet.ca")
    (services
     vpn-services)))