nordvpn: init at 4.0.0 #406725

different-error · 2025-05-13T09:42:59Z

Add the popular NordVPN to NixOS. Tested using the following configuration:

{
  config,
  lib,
  pkgs,
  ...
}:

{
  imports = [
    ./hardware-configuration.nix
  ];

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.firewall.enable = false;  # required

  services.nordvpn.enable = true;  # required

  virtualisation.vmVariant = {
    virtualisation = {
      memorySize = 4096;
      cores = 3;
    };
  };

  users.groups.alice = {};
  users.users.alice = {
    isSystemUser = true;
    password = "alice";
    group = "alice";
    extraGroups = [
      "wheel"
      "nordvpn"  # strongly recommended
    ];
    shell = pkgs.bash;
    home = "/home/alice";
    createHome = true;
    packages = with pkgs; [
      tree
    ];
  };

  system.stateVersion = "24.11"; # Did you read the comment?
}

The configuration was tested by running:

nixos-rebuild build-vm --use-remote-sudo -I nixos-config=/path/to/above/configuration.nix -I nixpkgs=/path/to/this/pr/nixpkgs

There is another PR (#220616) for NordVPN, which is over two years old and has been stale for a year. Additionally, there are issues requesting NordVPN support for NixOS here and here.

I chose to extract the .deb package instead of building from source ~~to avoid modifying or leaking the salt~~. Meshnet is not yet supported, but core NordVPN features work. I’ll create another PR once the Meshnet issues are resolved.

Things done

Add a 👍 reaction to pull requests you find important.

drupol

Hello,

Thanks for your first PR.

I made some feedback, let me know if you need some help.

nixos/modules/services/networking/nordvpn.nix

pkgs/by-name/no/nordvpn/package.nix

NyCodeGHG · 2025-05-13T10:45:12Z

For such a security relevant package such as a vpn software, we should build from source if possible.
I'm not sure why you want to avoid "leaking" the salt, since it can be easily extracted from the binary in the .deb you linked.

This would also allow us to patch out quirks such as relying on /usr

pkgs/by-name/no/nordvpn/package.nix

different-error · 2025-05-13T12:21:49Z

For such a security relevant package such as a vpn software, we should build from source if possible. I'm not sure why you want to avoid "leaking" the salt, since it can be easily extracted from the binary in the .deb you linked.

This would also allow us to patch out quirks such as relying on /usr

Your claims about salts are valid and correct! My earlier statement was based on an incorrect misunderstanding, and I've updated the comment accordingly.

Another way to address quirks is to make changes directly in the NordVPN repository, which was my implicit assumption for the next release.

I could update this to build from scratch, but I don’t see the added security benefit. All other Linux distributions download from repo.nordvpn.com (.deb or .rpm) via their install script. I’ve also noticed that ExpressVPN extracts their .deb. Fortunately, building from source is nearly complete thanks to community efforts. Regardless, I’m not convinced there’s a significant advantage. Lmk your thoughts, thanks!

drupol · 2025-05-13T12:47:10Z

I could update this to build from scratch, but I don’t see the added security benefit. All other Linux distributions download from repo.nordvpn.com (.deb or .rpm) via their install script. I’ve also noticed that ExpressVPN extracts their .deb. Fortunately, building from source is nearly complete thanks to community efforts. Regardless, I’m not convinced there’s a significant advantage. Lmk your thoughts, thanks!

You are right that most distributions fetch the .deb or .rpm packages from repo.nordvpn.com using the official install script, and that ExpressVPN follows a similar approach in Nixpkgs by extracting the .deb archive.

However, the key issue here is trust and verifiability.

At the moment, there's no reliable way to verify that the binaries provided on repo.nordvpn.com are actually built from the publicly available sources. By using those prebuilt packages, we are implicitly trusting the vendor without any way to independently validate the build integrity.

One of the strengths of Nix is its focus on reproducibility. Building from source allows us (most of the time) to produce reproducible outputs. This enables a verifiable 1-to-1 mapping between the source code and the resulting binaries, which significantly improves the security of the software supply chain.

Fortunately, thanks to recent community efforts, we’re getting close to being able to build the client fully from source.

That’s why I believe it’s worth pushing in that direction.

different-error · 2025-05-13T13:30:13Z

I could update this to build from scratch, but I don’t see the added security benefit. All other Linux distributions download from repo.nordvpn.com (.deb or .rpm) via their install script. I’ve also noticed that ExpressVPN extracts their .deb. Fortunately, building from source is nearly complete thanks to community efforts. Regardless, I’m not convinced there’s a significant advantage. Lmk your thoughts, thanks!

You are right that most distributions fetch the .deb or .rpm packages from repo.nordvpn.com using the official install script, and that ExpressVPN follows a similar approach in Nixpkgs by extracting the .deb archive.

However, the key issue here is trust and verifiability.

At the moment, there's no reliable way to verify that the binaries provided on repo.nordvpn.com are actually built from the publicly available sources. By using those prebuilt packages, we are implicitly trusting the vendor without any way to independently validate the build integrity.

One of the strengths of Nix is its focus on reproducibility. Building from source allows us (most of the time) to produce reproducible outputs. This enables a verifiable 1-to-1 mapping between the source code and the resulting binaries, which significantly improves the security of the software supply chain.

Fortunately, thanks to recent community efforts, we’re getting close to being able to build the client fully from source.

That’s why I believe it’s worth pushing in that direction.

Gotcha. A malicious attacker might somehow tamper with their binaries. Building from source is the secure way to go. Ok, will do, thanks!

different-error · 2025-05-13T20:59:47Z

Modified the package to build from source instead of extracting the .deb file.
Attribution: I adapted the working configuration found here.

Verified that core features function correctly.

Thank you all for your time!

nixos/modules/services/networking/nordvpn.nix

pkgs/by-name/no/nordvpn/package.nix

nixos/modules/services/networking/nordvpn.nix

different-error · 2025-05-15T21:47:28Z

I've reduced privileges by using a dedicated nordvpn user. DynamicUser=true behaved inconsistently when I specified the nordvpn group, including when I set it only in SupplementaryGroups=.

Additionally, the nordvpnd source was modified to find helper executables in the <<pkg>>/bin directory (and the PATH, of course). The PATH configured in the systemd unit file now includes only paths to the binaries that are needed.

One more thing, nordvpnd failed to recognize the norduserd process, even though both ran as the same user, which is incorrect behavior. As far as I know, this only affects notifications for VPN server connection/disconnection. I verified basic connect/disconnect operations using OpenVPN and NordLynx protocols.

Thanks again for the review!

doc/release-notes/rl-2505.section.md

nixos/modules/services/networking/nordvpn.nix

pkgs/by-name/no/nordvpn/package.nix

alyssais · 2025-06-30T10:39:52Z

Requesting security team review due to the pinned libxml2 with known vulnerabilities fixed in the default version.

different-error · 2025-07-03T08:19:00Z

add CVE-2025-6021 to meta.knownVulnerabilities
successful connection to vpn
rebase onto latest master

To test, one may add the following to configuration.nix

nixpkgs.config.permittedInsecurePackages = [
  "libxml2-2.14.3"
];

Requesting security team review due to the pinned libxml2 with known vulnerabilities fixed in the default version.

fwiw - "pinned libxml2" change looks similar to these: one, two, three.

pkgs/by-name/no/nordvpn/package.nix

different-error · 2025-07-12T20:22:20Z

set version to 4.0.0
tested using openvpn and nordlynx technologies
removed CVE-2025-6021 since afaik it does not apply to libxml2 v2.13.8 (and no other CVEs apply to the same version)
stored openvpn patches locally to avoid depending on third party url which may change in the future
I opened an issue upstream to clarify questions regarding configuration encryption

Thanks for the reviews everyone!

drupol · 2025-07-12T20:46:58Z

set version to 4.0.0

Don't forget to update the commit message accordingly.

pkgs/by-name/no/nordvpn/package.nix

getreu · 2025-07-29T07:31:52Z

When can we expect this PR in unstable?

LordGrimmauld · 2025-07-29T07:34:21Z

~~whenever staging-next is merged to master and the channel advances~~
Edit: This PR first needs to be ready. It was waiting on the libxml2_13, which has now reached master: #425387

This means @different-error can now use that libxml version:

I intend to use the libxml2_13 package once that completes

drupol · 2025-07-29T07:34:46Z

When can we expect this PR in unstable?

Dumb answer: when it will be done and merged?

No, but more seriously, it's difficult to evaluate such questions. At the moment, I think the author is waiting for #406725 (comment), and then it will be re-evaluated.

There's also a minor conflict that need work, so, once all of this will be fixed, I guess the review process will continue.

different-error · 2025-07-29T09:32:51Z

~~whenever staging-next is merged to master and the channel advances~~ Edit: This PR first needs to be ready. It was waiting on the libxml2_13, which has now reached master: #425387

This means @different-error can now use that libxml version:

I intend to use the libxml2_13 package once that completes

Unfortunately #425387 did not contain the libxml2_13 changes found in #421740. The master branch currently does not contain libxml2_13 package. Maybe @drupol @leona-ya can shed insights on expected timeline?

LordGrimmauld · 2025-07-29T10:03:30Z

Oh wait damn, indeed you are right, missed that staging cycle by two days, i missed that.
You can target staging instead, where that PR is merged already. While your PR doesn't cause mass rebuilds, it depends on a PR that is currently only in staging, so targetting staging is fine.

different-error · 2025-08-01T08:43:00Z

I face some difficulty atm. I cannot build staging locally. Running the tests suite or building the VM either fails or consumes too much memory. You can find these changes in my fork here. Since I cannot build staging, I cannot push my changes to this PR. I intend to try every so often, but worst case I can change base back to master once libxml2_13 merges.

ruffsl · 2025-08-16T17:03:19Z

I intend to try every so often, but worst case I can change base back to master once libxml2_13 merges.

Looks like libxml2_13 has made its way into staging-next. The PR to watch for when it finally merges into main:

staging-next 2025-08-10 #432489

NixOSInfra added the 12.first-time contribution This PR is the author's first one; please be gentle! label May 13, 2025

different-error force-pushed the nordvpn branch from 00220ff to f8e6b93 Compare May 13, 2025 09:58

different-error marked this pull request as ready for review May 13, 2025 10:08

drupol requested changes May 13, 2025

View reviewed changes

NyCodeGHG suggested changes May 13, 2025

View reviewed changes

pkgs/by-name/no/nordvpn/package.nix Outdated Show resolved Hide resolved

pkgs/by-name/no/nordvpn/package.nix Outdated Show resolved Hide resolved

different-error requested review from drupol and NyCodeGHG May 14, 2025 07:31

drupol requested changes May 14, 2025

View reviewed changes

different-error force-pushed the nordvpn branch from 9411ef5 to 0b1cdb2 Compare May 15, 2025 18:04

NyCodeGHG reviewed May 15, 2025

View reviewed changes

nixos/modules/services/networking/nordvpn.nix Outdated Show resolved Hide resolved

different-error force-pushed the nordvpn branch 3 times, most recently from 6a79c37 to 30f70e6 Compare May 15, 2025 21:33

different-error requested review from drupol and NyCodeGHG May 15, 2025 21:48

NyCodeGHG reviewed May 16, 2025

View reviewed changes

pkgs/by-name/no/nordvpn/package.nix Outdated Show resolved Hide resolved

leona-ya removed their request for review June 30, 2025 11:12

different-error force-pushed the nordvpn branch from f54d4f6 to 5438473 Compare July 3, 2025 08:13

LeSuisse requested changes Jul 3, 2025

View reviewed changes

LeSuisse reviewed Jul 3, 2025

View reviewed changes

pkgs/by-name/no/nordvpn/package.nix Show resolved Hide resolved

pkgs/by-name/no/nordvpn/package.nix Outdated Show resolved Hide resolved

pkgs/by-name/no/nordvpn/package.nix Outdated Show resolved Hide resolved

nixpkgs-ci bot added the 2.status: merge conflict This PR has merge conflicts with the target branch label Jul 7, 2025

different-error mentioned this pull request Jul 12, 2025

security concerns from NixOS NordSecurity/nordvpn-linux#967

Open

maintainers: add sanferdsouza

36c63d8

different-error force-pushed the nordvpn branch from 5438473 to 33c2730 Compare July 12, 2025 20:10

ofborg bot removed the 2.status: merge conflict This PR has merge conflicts with the target branch label Jul 12, 2025

different-error added 2 commits July 12, 2025 23:55

nordvpn: init at 4.0.0

a6019d4

nixos/nordvpn: init module

6e8b0bd

different-error force-pushed the nordvpn branch from 33c2730 to 6e8b0bd Compare July 12, 2025 20:55

ruffsl reviewed Jul 13, 2025

View reviewed changes

pkgs/by-name/no/nordvpn/package.nix Show resolved Hide resolved

nixpkgs-ci bot added the 2.status: merge conflict This PR has merge conflicts with the target branch label Jul 13, 2025

LordGrimmauld mentioned this pull request Jul 13, 2025

libxml2: split to multiple versions, init libxml2_13, add patch for 5 CVEs #421740

Merged

13 tasks

LeSuisse changed the title ~~nordvpn: init at 3.20.2~~ nordvpn: init at 4.0.0 Jul 29, 2025

different-error changed the base branch from master to staging July 30, 2025 11:22

nixpkgs-ci bot closed this Jul 30, 2025

nixpkgs-ci bot reopened this Jul 30, 2025

Uh oh!

nordvpn: init at 4.0.0 #406725

Are you sure you want to change the base?

nordvpn: init at 4.0.0 #406725

Uh oh!

Conversation

different-error commented May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

drupol left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

NyCodeGHG commented May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

different-error commented May 13, 2025

Uh oh!

drupol commented May 13, 2025

Uh oh!

different-error commented May 13, 2025

Uh oh!

different-error commented May 13, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

different-error commented May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alyssais commented Jun 30, 2025

Uh oh!

different-error commented Jul 3, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

different-error commented Jul 12, 2025

Uh oh!

drupol commented Jul 12, 2025

Uh oh!

Uh oh!

getreu commented Jul 29, 2025

Uh oh!

LordGrimmauld commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

drupol commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

different-error commented Jul 29, 2025

Uh oh!

LordGrimmauld commented Jul 29, 2025

different-error commented May 13, 2025 •

edited

Loading

NyCodeGHG commented May 13, 2025 •

edited

Loading

different-error commented May 15, 2025 •

edited

Loading

LordGrimmauld commented Jul 29, 2025 •

edited

Loading

drupol commented Jul 29, 2025 •

edited

Loading