easytier: 2.6.4 -> 2.7.0 (#575504)

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -211,6 +211,18 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `easytier` has been updated to 2.7.0 and is stricter about its configuration:
+
+  - [`services.easytier.instances.<name>.configServer`](#opt-services.easytier.instances._name_.configServer)
+    requires a full URL such as `udp://example.com:22020/<token>`; the bare
+    `<token>` shorthand for the official server was removed.
+  - The WireGuard portal no longer accepts `client_cidr` or `wg://host:port/CIDR`.
+    Set `wireguard_private_key` and list the clients under
+    `vpn_portal_config.clients` with a `virtual_ip` each.
+  - Unknown keys in the `[flags]` table are rejected instead of being ignored, so
+    a stale flag now stops the instance with `failed to parse flags`
+    ([upstream #2670](https://github.com/EasyTier/EasyTier/issues/2670)).
+
 - `services.music-assistant` no longer ships the service API credentials that upstream bundles
   only in its official release builds. Providers that rely on them (`spotify`, `qobuz`,
   `apple_music`, `theaudiodb`, `fanarttv`) no longer work out of the box. Register your own

nixos/modules/services/networking/easytier.nix

@@ -134,7 +134,8 @@ let
             except `hostname` will be ignored. Valid formats are:
 
             - full uri for custom server: `udp://example.com:22020/<token>`
-            - username only for official server: `<token>`
+
+            Since 2.7.0 a full URL is required; a bare `<token>` is rejected.
           '';
           example = "udp://example.com:22020/myusername";
         };

pkgs/by-name/ea/easytier/0002-rustls-select-ring-provider-explicitly.patch

@@ -0,0 +1,23 @@
+# rustls has two backends enabled when easytier-web is built alongside the CLI;
+# upstream fix for that is EasyTier/EasyTier#2648 (issue #2607).
+
+diff --git a/easytier-core/src/connectivity/manual/discovery/implementation.rs b/easytier-core/src/connectivity/manual/discovery/implementation.rs
+--- a/easytier-core/src/connectivity/manual/discovery/implementation.rs
++++ b/easytier-core/src/connectivity/manual/discovery/implementation.rs
+@@ -187,9 +187,13 @@ where
+         let root_store = rustls::RootCertStore {
+             roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
+         };
+-        let tls_config = rustls::ClientConfig::builder()
+-            .with_root_certificates(root_store)
+-            .with_no_client_auth();
++        let tls_config = rustls::ClientConfig::builder_with_provider(Arc::new(
++            rustls::crypto::ring::default_provider(),
++        ))
++        .with_safe_default_protocol_versions()
++        .context("selecting HTTPS protocol versions failed")?
++        .with_root_certificates(root_store)
++        .with_no_client_auth();
+         let stream = TlsConnector::from(Arc::new(tls_config))
+             .connect(server_name, socket)
+             .await

pkgs/by-name/ea/easytier/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   rustPlatform,
   protobuf,
   nixosTests,
@@ -17,16 +18,30 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "easytier";
-  version = "2.6.4";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "EasyTier";
     repo = "EasyTier";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lwqpOVKFm85AiBb7NWLAkjSrWSe5pzF0AuEmmDo+v0k=";
+    hash = "sha256-t/a4V1pMoqr9fVfMGHJUfJPk8VD+mbOxB2Cvb2lsX9Q=";
   };
 
-  cargoHash = "sha256-c+rOjokrL0U63s1CMfy6KlGI7VoSmtxuQjBNDAagSdg=";
+  cargoHash = "sha256-/dVCPkDGgvDEUnCb1EfH2Y0Yn48h4mYuUben0GNwvoo=";
+
+  patches = [
+    # TODO: remove after next release
+    # `dep:` in easytier-core drops the implicit `smoltcp` feature that
+    # cargo-auditable expects; see rust-secure-code/cargo-auditable#124.
+    (fetchpatch2 {
+      name = "expose-smoltcp-feature.patch";
+      url = "https://github.com/EasyTier/EasyTier/commit/3a0acccf46eff19c88d372a4b06749eccc9fa708.patch?full_index=1";
+      hash = "sha256-tV7TtBF8WPmVnVYp7KiaS8Ek48Y/6BmRSICF38Q2ESc=";
+    })
+    # Building easytier-web next to the CLI enables two rustls backends, which
+    # makes HTTPS peer discovery panic; backport of EasyTier/EasyTier#2648.
+    ./0002-rustls-select-ring-provider-explicitly.patch
+  ];
 
   nativeBuildInputs = [
     protobuf

pkgs/by-name/ea/easytier/service.nix

@@ -50,7 +50,8 @@ in
           except {option}`easytier.settings.hostname` will be ignored. Valid formats are:
 
           - full uri for custom server: `udp://example.com:22020/<token>`
-          - username only for official server: `<token>`
+
+          Since 2.7.0 a full URL is required; a bare `<token>` is rejected.
         '';
         example = "udp://example.com:22020/myusername";
       };