split the Rust code into smaller, Tauri-independent crates in preparation for adding CLI

.github/workflows/cross-platform-check.yml

@@ -0,0 +1,63 @@
+name: Cross-platform check
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+      - "release/**"
+    paths-ignore:
+      - "*.md"
+      - "LICENSE"
+  pull_request:
+    branches:
+      - main
+      - dev
+      - "release/**"
+    paths-ignore:
+      - "*.md"
+      - "LICENSE"
+
+env:
+  CARGO_TERM_COLOR: always
+  SQLX_OFFLINE: "1"
+  SCCACHE_GHA_ENABLED: "true"
+  RUSTC_WRAPPER: "sccache"
+
+jobs:
+  check:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - macOS
+          - Windows
+
+    runs-on:
+      - self-hosted
+      - ${{ matrix.os }}
+
+    defaults:
+      run:
+        working-directory: ./src-tauri
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@v0.0.10
+
+      - name: Install protoc
+        if: matrix.os != 'Windows'
+        uses: arduino/setup-protoc@v3
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check compilation
+        run: cargo check --workspace

.github/workflows/test.yml

@@ -58,7 +58,7 @@ jobs:
           scanners: "vuln"
 
       - name: Run sccache-cache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: mozilla-actions/sccache-action@v0.0.10
 
       - name: Install required packages
         run: |

LICENSE.md

@@ -1,8 +1,8 @@
 # Dual license info
 The code in this repository is available under a dual licensing model:
 
-1. Open Source License: The code, except for the contents of the "src-tauri/src/enterprise/" directory, is licensed under the AGPL license (this license). This applies to the open core components of the software.
-2. Enterprise License: All code in this repository (including within the "src-tauri/src/enterprise/" directory) is licensed under a separate Enterprise License (see file src/enterprise/LICENSE.md).
+1. Open Source License: The code, except for the contents of the "src-tauri/enterprise/" directory, is licensed under the AGPL license (this license). This applies to the open core components of the software.
+2. Enterprise License: All code in this repository (including within the "src-tauri/enterprise/" directory) is licensed under a separate Enterprise License (see file src-tauri/enterprise/LICENSE.md).
 
 # GNU AFFERO GENERAL PUBLIC LICENSE
 

flake.nix

@@ -3,6 +3,7 @@
     nixpkgs.url = "nixpkgs";
     flake-utils.url = "github:numtide/flake-utils";
     rust-overlay.url = "github:oxalica/rust-overlay";
+    crane.url = "github:ipetkov/crane";
 
     # let git manage submodules
     self.submodules = true;
@@ -25,26 +26,55 @@
     nixpkgs,
     flake-utils,
     rust-overlay,
+    crane,
     ...
   }:
     flake-utils.lib.eachDefaultSystem (system: let
-      # add rust overlay
-      pkgs = import nixpkgs {
+      # Plain nixpkgs — used for packages and checks.
+      pkgs = import nixpkgs {inherit system;};
+
+      # nixpkgs with rust-overlay — only needed for the dev shell, which uses
+      # pkgs.rust-bin to get a customised Rust toolchain.
+      devPkgs = import nixpkgs {
         inherit system;
         overlays = [rust-overlay.overlays.default];
       };
+
+      craneLib = crane.mkLib pkgs;
+
+      defguard-client = pkgs.callPackage ./nix/package.nix {
+        inherit pkgs craneLib;
+      };
     in {
       devShells.default = import ./nix/shell.nix {
-        inherit pkgs;
+        pkgs = devPkgs;
+        inherit crane;
       };
 
-      packages.default = pkgs.callPackage ./nix/package.nix {
-        inherit pkgs;
+      packages = {
+        default = defguard-client;
+        inherit defguard-client;
+        defguard-service =
+          pkgs.runCommand "defguard-service" {
+            nativeBuildInputs = [pkgs.makeWrapper];
+          } ''
+            mkdir -p $out/bin
+            cp ${defguard-client}/bin/defguard-service $out/bin/
+          '';
+        dg =
+          pkgs.runCommand "dg" {
+            nativeBuildInputs = [pkgs.makeWrapper];
+          } ''
+            mkdir -p $out/bin
+            cp ${defguard-client}/bin/dg $out/bin/
+          '';
       };
 
+      checks.default = defguard-client;
+
       formatter = pkgs.alejandra;
     })
     // {
-      nixosModules.default = import ./nix/nixos-module.nix;
+      nixosModules.default = import ./nix/nixos-module.nix {mkCraneLib = crane.mkLib;};
     };
 }

nix/nixos-module.nix

@@ -1,61 +1,69 @@
-{
+{mkCraneLib}: {
   config,
   lib,
   pkgs,
   ...
-}:
-with lib; let
-  defguard-client = pkgs.callPackage ./package.nix {};
+}: let
+  craneLib = mkCraneLib pkgs;
+  defguard-client = pkgs.callPackage ./package.nix {inherit pkgs craneLib;};
   cfg = config.programs.defguard-client;
 in {
   options.programs.defguard-client = {
-    enable = mkEnableOption "Defguard VPN client and service";
+    enable = lib.mkEnableOption "Defguard VPN client and service";
 
-    package = mkOption {
-      type = types.package;
+    package = lib.mkOption {
+      type = lib.types.package;
       default = defguard-client;
       description = "defguard-client package to use";
     };
 
-    logLevel = mkOption {
-      type = types.str;
+    logLevel = lib.mkOption {
+      type = lib.types.str;
       default = "info";
       description = "Log level for defguard-service";
     };
 
-    statsPeriod = mkOption {
-      type = types.int;
+    statsPeriod = lib.mkOption {
+      type = lib.types.int;
       default = 30;
       description = "Interval in seconds for interface statistics updates";
     };
   };
 
-  config = mkIf cfg.enable {
-    # Add client package
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [cfg.package];
 
-    # Setup systemd service for the intrerface management daemon
     systemd.services.defguard-service = {
       description = "Defguard VPN Service";
+      documentation = ["https://docs.defguard.net"];
       wantedBy = ["multi-user.target"];
       wants = ["network-online.target"];
       after = ["network-online.target"];
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/defguard-service --log-level ${cfg.logLevel} --stats-period ${toString cfg.statsPeriod}";
-        ExecReload = "/bin/kill -HUP $MAINPID";
         Group = "defguard";
-        Restart = "on-failure";
-        RestartSec = 2;
+        ExecStart = "${cfg.package}/bin/defguard-service --log-level ${cfg.logLevel} --stats-period ${toString cfg.statsPeriod}";
+        ExecReload = "kill -HUP $MAINPID";
         KillMode = "process";
         KillSignal = "SIGINT";
         LimitNOFILE = 65536;
         LimitNPROC = "infinity";
+        Restart = "on-failure";
+        RestartSec = 2;
         TasksMax = "infinity";
         OOMScoreAdjust = -1000;
+        # Security hardening
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectControlGroups = true;
+        # Requires WireGuard to be built into the kernel or pre-loaded via
+        # boot.kernelModules. If WireGuard is a loadable module, auto-loading
+        # will be blocked by ProtectKernelModules.
+        ProtectKernelModules = true;
+        RestrictRealtime = true;
+        LockPersonality = true;
       };
     };
 
-    # Make sure the defguard group exists
     users.groups.defguard = {};
   };
 }