diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a66d32294f7..21e53a2ecc9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14127,6 +14127,12 @@
githubId = 8794235;
name = "Tom Siewert";
};
+ tonyshkurenko = {
+ email = "support@twingate.com";
+ github = "tonyshkurenko";
+ githubId = 8597964;
+ name = "Anton Shkurenko";
+ };
toonn = {
email = "nixpkgs@toonn.io";
matrix = "@toonn:matrix.org";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 688f0f47676..9b6e755fd47 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -561,6 +561,14 @@
services.prometheus.exporters.smartctl.
+
+
+ twingate,
+ a high performance, easy to use zero trust solution that
+ enables access to private resources from any device with
+ better security than a VPN.
+
+
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 1ff2e826c60..fc4b44957c3 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -164,6 +164,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).
+- [twingate](https://docs.twingate.com/docs/linux), a high performance, easy to use zero trust solution that enables access to private resources from any device with better security than a VPN.
+
## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
- The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9faa58409b1..a2d67afe137 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -988,6 +988,7 @@
./services/networking/tox-node.nix
./services/networking/toxvpn.nix
./services/networking/tvheadend.nix
+ ./services/networking/twingate.nix
./services/networking/ucarp.nix
./services/networking/unbound.nix
./services/networking/unifi.nix
diff --git a/nixos/modules/services/networking/twingate.nix b/nixos/modules/services/networking/twingate.nix
new file mode 100644
index 00000000000..17140bffd21
--- /dev/null
+++ b/nixos/modules/services/networking/twingate.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.twingate;
+
+in {
+
+ options.services.twingate = {
+ enable = mkEnableOption (lib.mdDoc "Twingate Client daemon");
+ };
+
+ config = mkIf cfg.enable {
+
+ networking.firewall.checkReversePath = lib.mkDefault false;
+ networking.networkmanager.enable = true;
+
+ environment.systemPackages = [ pkgs.twingate ]; # for the CLI
+ systemd.packages = [ pkgs.twingate ];
+
+ systemd.services.twingate.preStart = ''
+ cp -r -n ${pkgs.twingate}/etc/twingate/. /etc/twingate/
+ '';
+
+ systemd.services.twingate.wantedBy = [ "multi-user.target" ];
+ };
+}
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
new file mode 100644
index 00000000000..33e0820bec9
--- /dev/null
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -0,0 +1,51 @@
+{ autoPatchelfHook
+, curl
+, dpkg
+, dbus
+, fetchurl
+, lib
+, libnl
+, udev
+, cryptsetup
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+ pname = "twingate";
+ version = "1.0.60";
+
+ src = fetchurl {
+ url = "https://binaries.twingate.com/client/linux/DEB/${version}/twingate-amd64.deb";
+ sha256 = "b308c422af8a33ecd58e21a10a72c353351a189df67006e38d1ec029a93d5678";
+ };
+
+ buildInputs = [ dbus curl libnl udev cryptsetup ];
+ nativeBuildInputs = [ dpkg autoPatchelfHook ];
+
+ unpackCmd = "mkdir root ; dpkg-deb -x $curSrc root";
+
+ postPatch = ''
+ while read file; do
+ substituteInPlace "$file" \
+ --replace "/usr/bin" "$out/bin" \
+ --replace "/usr/sbin" "$out/bin"
+ done < <(find etc usr/lib usr/share -type f)
+ '';
+
+ installPhase = ''
+ mkdir $out
+ mv etc $out/
+ mv usr/bin $out/bin
+ mv usr/sbin/* $out/bin
+ mv usr/lib $out/lib
+ mv usr/share $out/share
+ '';
+
+ meta = with lib; {
+ description = "Twingate Client";
+ homepage = "https://twingate.com";
+ license = licenses.unfree;
+ maintainers = with maintainers; [ tonyshkurenko ];
+ platforms = platforms.linux;
+ };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6a75e1aadb7..851ce6eac77 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -26052,6 +26052,8 @@ with pkgs;
twa = callPackage ../tools/networking/twa { };
+ twingate = callPackage ../applications/networking/twingate { };
+
# Upstream U-Boots:
inherit (callPackage ../misc/uboot {})
buildUBoot