From b92a2fb8218fc534cb49de515ca5616f69fc7303 Mon Sep 17 00:00:00 2001
From: Tibo De Peuter <tibo@depeuter.dev>
Date: Tue, 29 Sep 2026 20:56:57 +0200
Subject: [PATCH] fix(openconnect): ugent sso

---
 nixos/hosts/Tibo-NixDesk/default.nix          |  2 +-
 nixos/hosts/Tibo-NixFat/default.nix           |  2 +-
 nixos/hosts/Tibo-NixTop/default.nix           |  2 +-
 nixos/modules/networking/default.nix          |  2 +-
 .../networking/openconnect-sso/default.nix    | 13 -----------
 .../networking/openconnect/default.nix        | 22 +++++++++++++++++++
 .../networking/openconnect/ugent-vpn.sh       | 15 +++++++++++++
 7 files changed, 41 insertions(+), 17 deletions(-)
 delete mode 100644 nixos/modules/networking/openconnect-sso/default.nix
 create mode 100644 nixos/modules/networking/openconnect/default.nix
 create mode 100644 nixos/modules/networking/openconnect/ugent-vpn.sh

diff --git a/nixos/hosts/Tibo-NixDesk/default.nix b/nixos/hosts/Tibo-NixDesk/default.nix
index 012eba6..de8562e 100644
--- a/nixos/hosts/Tibo-NixDesk/default.nix
+++ b/nixos/hosts/Tibo-NixDesk/default.nix
@@ -19,7 +19,7 @@
 
     networking = {
       networkmanager.enable = true;
-      openconnect-sso.enable = true;
+      openconnect.enable = true;
       openvpn.enable = true;
       tailscale.enable = true;
     };
diff --git a/nixos/hosts/Tibo-NixFat/default.nix b/nixos/hosts/Tibo-NixFat/default.nix
index 80d9d98..44967df 100644
--- a/nixos/hosts/Tibo-NixFat/default.nix
+++ b/nixos/hosts/Tibo-NixFat/default.nix
@@ -22,7 +22,7 @@
 
     networking = {
       networkmanager.enable = true;
-      openconnect-sso.enable = true;
+      openconnect.enable = true;
       tailscale.enable = true;
     };
 
diff --git a/nixos/hosts/Tibo-NixTop/default.nix b/nixos/hosts/Tibo-NixTop/default.nix
index 3877c19..01285d5 100644
--- a/nixos/hosts/Tibo-NixTop/default.nix
+++ b/nixos/hosts/Tibo-NixTop/default.nix
@@ -25,7 +25,7 @@
 
     networking = {
       networkmanager.enable = true;
-      #openconnect-sso.enable = true;
+      openconnect.enable = true;
       openvpn.enable = true;
       tailscale.enable = true;
     };
diff --git a/nixos/modules/networking/default.nix b/nixos/modules/networking/default.nix
index 897a716..2a08361 100644
--- a/nixos/modules/networking/default.nix
+++ b/nixos/modules/networking/default.nix
@@ -1,7 +1,7 @@
 {
   imports = [
     ./networkmanager
-    ./openconnect-sso
+    ./openconnect
     ./openvpn
     ./tailscale
   ];
diff --git a/nixos/modules/networking/openconnect-sso/default.nix b/nixos/modules/networking/openconnect-sso/default.nix
deleted file mode 100644
index db5b91d..0000000
--- a/nixos/modules/networking/openconnect-sso/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ config, inputs, lib, pkgs, ... }:
-
-let
-  cfg = config.sisyphus.networking.openconnect-sso;
-in {
-  options.sisyphus.networking.openconnect-sso.enable = lib.mkEnableOption "OpenConnect SSO";
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
-      inputs.openconnect-sso.packages.${config.nixpkgs.localSystem.system}.default
-    ];
-  };
-}
diff --git a/nixos/modules/networking/openconnect/default.nix b/nixos/modules/networking/openconnect/default.nix
new file mode 100644
index 0000000..99b4644
--- /dev/null
+++ b/nixos/modules/networking/openconnect/default.nix
@@ -0,0 +1,22 @@
+{ config, inputs, lib, pkgs, ... }:
+
+let
+  cfg = config.sisyphus.networking.openconnect;
+
+  ugentVpn = pkgs.writeShellApplication {
+    name = "ugent-vpn";
+    runtimeInputs = with pkgs; [
+      openconnect
+    ];
+    text = builtins.readFile ./ugent-vpn.sh;
+  };
+in {
+  options.sisyphus.networking.openconnect.enable = lib.mkEnableOption "OpenConnect";
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      openconnect
+      ugentVpn
+    ];
+  };
+}
diff --git a/nixos/modules/networking/openconnect/ugent-vpn.sh b/nixos/modules/networking/openconnect/ugent-vpn.sh
new file mode 100644
index 0000000..5942d81
--- /dev/null
+++ b/nixos/modules/networking/openconnect/ugent-vpn.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -e
+
+echo 'Starting UGent SSO authentication...'
+eval "$( openconnect --authenticate --protocol=anyconnect vpn.ugent.be )"
+
+if [ -z "${COOKIE}" ]; then
+  echo 'Authentication failed or was aborted.'
+  exit 1
+fi
+
+echo 'Authentication successful. Establishing tunnel...'
+sudo openconnect --protocol=anyconnect --cookie="${COOKIE}" "${CONNECT_URL}" --servercert="${FINGERPRINT}" --resolve="${RESOLVE}"
+