lastpass-cli 1.3.1 overlay

Use an overlay to pick up a critical bug-fix from the lastest version.
Without this, lpass is unusable due to a certificate change that took
place.
lastpass/lastpass-cli#409
lastpass/lastpass-cli#410

.gitignore

@@ -1 +1,3 @@
 /machines/self.nix
+
+*.private.conf

overlays/core/default.nix

@@ -3,6 +3,18 @@ self: super: {
 
   interactive-editor = super.callPackage ./interactive-editor { };
 
+  # get certificate fix
+  # https://github.com/lastpass/lastpass-cli/pull/410
+  lastpass-cli = super.lastpass-cli.overrideAttrs (oldAttrs: rec {
+    version = "1.3.1";
+    src = super.fetchFromGitHub {
+      owner = "lastpass";
+      repo = "lastpass-cli";
+      rev = "v${version}";
+      sha256 = "11drzmfdvb8ydw1dxaz9zz8rk0jjqmfv076vydz05qqvgx59s38h";
+    };
+  });
+
   linuxPackages = (super.linuxPackagesFor super.linuxPackages.kernel).extend (
     self': super': {
       i8042_debounce = super'.callPackage ./i8042-debounce { };

services/default.nix

@@ -1,7 +1,8 @@
 {
   services = {
-    xserver = import ./xserver.nix;
     emacs.enable = true;
     gnome3.gpaste.enable = true;
+    openvpn = import ./openvpn;
+    xserver = import ./xserver.nix;
   };
 }

services/openvpn/default.nix

@@ -0,0 +1,5 @@
+{
+  servers = {
+    sumall = import ./sumall.nix;
+  };
+}

services/openvpn/sumall.nix

@@ -0,0 +1,45 @@
+{
+  autoStart = false;
+
+  # This setting adds the following to the client config:
+  #
+  # script-security 2
+  # up ''${pkgs.update-resolv-conf}/libexec/openvpn/update-resolv-conf
+  # down ''${pkgs.update-resolv-conf}/libexec/openvpn/update-resolv-conf
+  #
+  updateResolvConf = true;
+
+  config = ''
+    # We are a client, using a routed IP tunnel.
+    client
+    dev tun
+
+    # Server is enforcing IPv4 only. We should do the same?
+    proto udp4
+
+    # No need to bind to a specific local port number.
+    nobind
+
+    # Downgrade privileges after initialization.
+    user nobody
+    group nogroup
+
+    # Try to preserve some state across restarts.
+    persist-key
+    persist-tun
+
+    # Verify server certificate to protect against mitm.
+    remote-cert-tls server
+
+    # Specify same cipher option as the server uses.
+    cipher AES-256-CBC
+
+    # Server has compression enabled, so we can too.
+    comp-lzo yes
+
+    # Don't cache passwords in memory
+    auth-nocache
+
+    ${builtins.readFile ./sumall.private.conf}
+  '';
+}