diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 48431198056..47a21d2414c 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -561,6 +561,14 @@
services.prometheus.exporters.smartctl.
+
+
+ twingate,
+ a high performance, easy to use zero trust solution that
+ enables access to private resources from any device with
+ better security than a VPN.
+
+
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index bc3bd639b1b..d887de73029 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -164,6 +164,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).
+- [twingate](https://docs.twingate.com/docs/linux), a high performance, easy to use zero trust solution that enables access to private resources from any device with better security than a VPN.
+
## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
- The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
new file mode 100644
index 00000000000..33e0820bec9
--- /dev/null
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -0,0 +1,51 @@
+{ autoPatchelfHook
+, curl
+, dpkg
+, dbus
+, fetchurl
+, lib
+, libnl
+, udev
+, cryptsetup
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+ pname = "twingate";
+ version = "1.0.60";
+
+ src = fetchurl {
+ url = "https://binaries.twingate.com/client/linux/DEB/${version}/twingate-amd64.deb";
+ sha256 = "b308c422af8a33ecd58e21a10a72c353351a189df67006e38d1ec029a93d5678";
+ };
+
+ buildInputs = [ dbus curl libnl udev cryptsetup ];
+ nativeBuildInputs = [ dpkg autoPatchelfHook ];
+
+ unpackCmd = "mkdir root ; dpkg-deb -x $curSrc root";
+
+ postPatch = ''
+ while read file; do
+ substituteInPlace "$file" \
+ --replace "/usr/bin" "$out/bin" \
+ --replace "/usr/sbin" "$out/bin"
+ done < <(find etc usr/lib usr/share -type f)
+ '';
+
+ installPhase = ''
+ mkdir $out
+ mv etc $out/
+ mv usr/bin $out/bin
+ mv usr/sbin/* $out/bin
+ mv usr/lib $out/lib
+ mv usr/share $out/share
+ '';
+
+ meta = with lib; {
+ description = "Twingate Client";
+ homepage = "https://twingate.com";
+ license = licenses.unfree;
+ maintainers = with maintainers; [ tonyshkurenko ];
+ platforms = platforms.linux;
+ };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0cc34e2a7f4..0b6bc6b3397 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25363,6 +25363,8 @@ with pkgs;
twa = callPackage ../tools/networking/twa { };
+ twingate = callPackage ../applications/networking/twingate { };
+
# Upstream U-Boots:
inherit (callPackage ../misc/uboot {})
buildUBoot