[different-error]

• Adds libtelio and libdrop inside the nordvpn directory rather than as standalone packages.
  nordvpn-linux's lib-versions.env pins exact versions, so an independent,
  automated bump of either library could silently desync from the
  bindings nordvpn expects. Keeping them local keeps that version a
  hand-maintained property of the consumer, with no risk of a name
  collision against an unrelated standalone package either.
• Patches nordvpn-linux across nordvpnd, norduserd, and
  nordfileshare to:
  • add a --hosts-readonly flag, which prevents nordvpnd from
    writing to /etc/hosts
  • chown the norduserd/nordfileshare sockets to the nordvpn
    group with permissions 0660, letting the unprivileged nordvpnd reach them
  • upstream declined the --hosts-readonly flag, citing a UX
    cost from losing automatic hostname resolution for peers. See
    meshnet enable fails under unprivileged nordvpnd (NixOS module) NordSecurity/nordvpn-linux#1648.
• Adds nordlynx to trusted interfaces.
• Adds module tests covering the patched socket permissions, the
  trusted-interface rule, and a non-member user's inability to reach
  a group-gated norduserd (ty @novalkun).

Assisted-by: Claude Code (Claude Opus 5.5)

Manual Verification

configuration.nix

{
  pkgs,
  lib,
  ...
}:

{
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.firewall.enable = true;
  #networking.firewall.checkReversePath = "loose";

  services.xserver.enable = true;
  services.displayManager.gdm.enable = true;
  services.desktopManager.plasma6.enable = true;

  services.timesyncd.enable = lib.mkForce true;
  services.timesyncd.servers = [
    "time.google.com"
    "pool.ntp.org"
  ];

  networking.hosts = {
    "1.2.3.4" = [ "my-alias" ];
  };

  services.nordvpn = {
    enable = true;
  };

  virtualisation.vmVariant = {
    virtualisation = {
      memorySize = 8192;
      cores = 3;
    };
  };
  users.groups.alice = { };
  users.users.alice = {
    isNormalUser = true;
    password = "alice";
    group = "alice";
    extraGroups = [
      "wheel"
      "nordvpn"
    ];
    shell = pkgs.bash;
    home = "/home/alice";
    createHome = true;
    packages = with pkgs; [
      dunst
      firefox
      libnotify
      nftables
      socat
      tmux
      tree
      vim
    ];
  };
  system.stateVersion = "24.11"; # Did you read the comment?
}

nixos-rebuild build-vm \
  -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/pull/576413/head.tar.gz \
  -I nixos-config=./path/to/configuration.nix

SSH-related configuration

  # SSH only over NordVPN.
  # Since we have nordlynx inside trusted interfaces,
  # we don't need to open port 22.
  services.openssh = {
    enable = true;
    openFirewall = false;
    settings = {
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
      PermitRootLogin = "no";
    };
  };

  users.users.<user>.openssh.authorizedKeys.keys = [
    "ssh-rsa ABCDE alice@nixos (meshnet: my-alias)"
  ];

Test protocol found in a below comment.

Things done

• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.
• Follows the automation/AI policy.
• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • aarch64-darwin
• Tested, as applicable:
  • Basic functionality of all binary files, usually in ./result/bin/.
  • Ran nixpkgs-review on this PR. See nixpkgs-review usage.
  • Package tests at passthru.tests.
  • NixOS tests in nixos/tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.

[nixpkgs-ci]

Thanks for contributing to the documentation.

Follow the documentation style guide, especially:

• Show, don’t tell. Start with a minimal working example. Explain after the code.
• Avoid meta-commentary. Don’t write "This section explains how to…".
• Use present tense, imperative mood, and active voice. For example: "Run the command," not "The user should run the following command."
• Avoid vague references like "this" when the referent is unclear. Write "This command creates a folder," not "This will create a folder."
• Be direct. Avoid "should", "might", "typically", and "usually".
• Cut filler words like "simply", "just", "easily", and "basically". Use "to" instead of "in order to".

For larger changes, such as adding or removing whole sections, ask the NixOS documentation team for review.

[different-error]

@andersonjoseph @dimkNevidimk @getreu @ruffsl

Hey folks, I can use your help. Meshnet has a lot of moving parts and I'd like to try to get this merged in sooner than later. If you don't mind, could you kindly test this PR and report back with your findings? Ty

[different-error]

@novalkun could you also kindly conduct a manual verification of the PR?

[novalkun]

@novalkun could you also kindly conduct a manual verification of the PR?

Tested 0656322 on real hardware (NixOS 26.05 + unstable): meshnet comes up, my iOS phone shows as a connected peer, ping by meshnet IP works, fileshare works both ways, and /etc/hosts stays untouched. nordvpn.cli build and nixosTests.nordvpn pass too.

[different-error]

@SuperSandro since you reviewed #564752, would you mind reviewing this PR as well? We would greatly appreciate your feedback, as your review could help move this toward a merge sooner. Thank you!

[novalkun]

Re-tested 273e920 (6.0.1) the same way: nordvpn.cli build and nixosTests.nordvpn pass, and on real hardware meshnet, peer ping and fileshare both ways work, /etc/hosts untouched.
really hope this PR also merged and go to stable release

[novalkun]

VM test passes with this PR's nordvpn files on nixpkgs-unstable 885ba4d. Live-tested at 273e920; the only functional change since is the socket ordering fix from #580056.

[novalkun]

Now that #582148 bumped nordvpn to 6.0.2, its lib-versions.env expects libtelio 6.2.5 (libdrop stays at 9.0.0), so this needs a rebase and a libtelio bump. 6.2.5 changes Cargo.lock and telio-proto, so cargoHash needs updating and it's worth checking llt-proto-rev.patch still applies.

[different-error]

Updated to libtelio 6.2.5. Verified the following:

• Tests pass on x86_64
• Connect via all three protocols using both cli and gui
• List meshnet peers
• Fileshare to and from VM
• SSH from VM to another meshnet peer

@novalkun could you test the changes on your setup?

[novalkun]

Built with libtelio 6.2.5: checkPhase passes and libtelio.so has no test/mock symbols.

[yipfluoric]

This is broken potentially due to the pr related to #570938

       >   AWS_LC_SYS_USE_SYSTEM=1 requires a system-installed AWS-LC, but none was found.
       >   Set AWS_LC_SYS_SYSTEM_DIR to point at an install, provide OPENSSL_DIR, or unset AWS_LC_SYS_US

is what it spits out for libtelio currently but https://github.com/NixOS/nixpkgs/pull/537108/changes may be useful to pick out any other potential ones.

[different-error]

This is broken potentially due to the pr related to #570938

ty!!

[different-error]

DEVICE: machine running this PR's changes
PEER: another nordvpn meshnet peer

Setup

1. On DEVICE: Set protocol to nordlynx, connect

   nordvpn set protocol nordlynx
   nordvpn connect
   

2. On DEVICE: Set meshnet on

   nordvpn set mesh on
   

3. On DEVICE: List meshnet peers

   nordvpn mesh peer list
   

4. On DEVICE: Turn off meshnet, verify list fails

   nordvpn set mesh off
   nordvpn mesh peer list
   # error
   

5. On DEVICE: Turn meshnet back on, set alias, confirm alias

   nordvpn set mesh on
   nordvpn mesh set nick <DEVICE-ALIAS>
   nordvpn mesh peer list
   # shows <DEVICE-ALIAS>
   

(presumes DEVICE connected to meshnet)

6. On DEVICE: deny incoming, routing, local, fileshare for PEER

   nordvpn mesh peer incoming deny <PEER>
   nordvpn mesh peer routing deny <PEER>
   nordvpn mesh peer local deny <PEER>
   nordvpn mesh peer fileshare deny <PEER>
   
   nordvpn mesh peer list
   # verify all four show denied
   

Incoming (presumes DEVICE denies PEER for incoming)

7. On PEER: Attempt ping to DEVICE, should fail

   ping <DEVICE-ALIAS>
   # no reply
   

8. On DEVICE: Allow incoming PEER

   nordvpn mesh peer incoming allow <PEER>
   

9. On PEER: ping DEVICE

   ping <DEVICE-ALIAS>
   

Fileshare (presumes DEVICE denies PEER for fileshare)

10. On PEER: Attempt to send file to DEVICE, should fail

    nordvpn fileshare send <DEVICE-ALIAS> <PATH>
    # error
    

11. On DEVICE: Allow fileshare PEER

    nordvpn mesh peer fileshare allow <PEER>
    

12. On PEER: Send file to DEVICE

    nordvpn fileshare send <DEVICE-ALIAS> <PATH>
    

    On DEVICE:

    nordvpn fileshare list
    nordvpn fileshare accept <transfer-id>
    

13. On PEER: Allow fileshare DEVICE

    nordvpn mesh peer fileshare allow <DEVICE-ALIAS>
    

14. On DEVICE: Send file to PEER

    nordvpn fileshare send <PEER> <PATH>
    

    On PEER:

    nordvpn fileshare list
    nordvpn fileshare accept <transfer-id>
    

Routing (presumes DEVICE denies PEER for routing; PEER on a different network)

15. On PEER: Attempt connect to DEVICE, should fail

    nordvpn mesh peer connect <DEVICE-ALIAS>
    # error
    

16. On DEVICE: Allow routing PEER

    nordvpn mesh peer routing allow <PEER>
    

17. On PEER: Check IP address

    curl ifconfig.me
    

18. On DEVICE: Check IP address

    curl ifconfig.me
    

19. On PEER: Connect to DEVICE

    nordvpn mesh peer connect <DEVICE-ALIAS>
    

20. On PEER: Verify IP changed, matches DEVICE

    curl ifconfig.me
    

Local network (presumes PEER connected to DEVICE)

21. On PEER: Attempt to access device on DEVICE's LAN (e.g. router), should fail

    ping <local-device-ip>
    # error
    

22. On DEVICE: Allow local PEER, set lan-discovery on

    nordvpn mesh peer local allow <PEER>
    nordvpn set lan-discovery on
    

23. On PEER: Verify access to device on DEVICE's LAN

    ping <local-device-ip>
    

SSH

24. On DEVICE: ssh to PEER

    ssh <user>@<PEER>
    

    (Use sshd config snippet on PEER. See PR's description)

VPN Connection

25. Connect with OpenVPN and NordLynx via CLI

    nordvpn set protocol openvpn_tcp && nordvpn c && curl ipinfo.io
    nordvpn set protocol openvpn_udp && nordvpn c && curl ipinfo.io
    nordvpn set protocol nordlynx && nordvpn c && curl ipinfo.io
    

26. Connect via nordvpn GUI

@novalkun @getreu please verify meshnet and basic nordvpn functionality using this test protocol. You do not need to include the entire document in your comment: stating that everything works when tested per the protocol should work, or mention any sections you skipped.