vpn mode to eww

modules/home/wayland/apps/eww/bar/modules/net.yuck

@@ -1,5 +1,5 @@
 (deflisten net
-  :initial '{"wifi":{"connected":false,"enabled":false,"icon":"󰤮","ssid":"","ip":"","freq":0,"band":"","gen":"","signal":0},"ethernet":{"connected":false,"interface":"","ip":"","speed":""},"usb":{"connected":false,"interface":"","ip":""},"wireguard":[],"vpn":{"up":false,"name":""}}'
+  :initial '{"wifi":{"connected":false,"enabled":false,"icon":"󰤮","ssid":"","ip":"","freq":0,"band":"","gen":"","signal":0},"ethernet":{"connected":false,"interface":"","ip":"","speed":""},"usb":{"connected":false,"interface":"","ip":""},"wireguard":[],"vpn":{"up":false,"full":false,"name":""}}'
   "scripts/net/net")
 
 (deflisten bt
@@ -23,7 +23,7 @@
       (label
         :visible {net.vpn.up}
         :class "net-icon net-active"
-        :tooltip "VPN: ${net.vpn.name}"
+        :tooltip {net.vpn.full ? "VPN: all traffic through ${net.vpn.name}" : "WireGuard: ${net.vpn.name}"}
         :text "󰖂")
       (label
         :class "net-icon ${net.wifi.connected ? 'net-active' : 'net-dim'}"

modules/home/wayland/apps/eww/bar/scripts/net/net

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Network state for the bar icons and the net panel: wifi, ethernet and USB
-# tethering.  Refreshes on link/address changes and every 30 s (signal level).
+# tethering.  Refreshes on link/address/rule changes and every 30 s (signal level).
 
 wifi_iface() { awk 'NR > 2 { sub(":", "", $1); print $1; exit }' /proc/net/wireless; }
 eth_iface() { ip -o link 2>/dev/null | awk '$2 ~ /^en[op]/ { sub(":", "", $2); print $2; exit }'; }
@@ -84,7 +84,7 @@ state() {
 wg_ifaces() {
   {
     systemctl list-units --all --plain --no-legend 'wireguard-*.service' 2>/dev/null \
-      | awk '$1 !~ /-peer-/ { sub(/^wireguard-/, "", $1); sub(/\.service$/, "", $1); print $1 }'
+      | awk '$1 !~ /-peer-|-vpn\.service$/ { sub(/^wireguard-/, "", $1); sub(/\.service$/, "", $1); print $1 }'
     ip -d -o link 2>/dev/null | awk '/ wireguard / { sub(":", "", $2); print $2 }'
   } | sort -u
 }
@@ -97,10 +97,12 @@ human_bytes() {
 }
 
 wg_json() { # prints the "wireguard" array and the "vpn" summary
-  local name up ip rx tx peers endpoint peer_unit peer_script sep="" out="[" vpn_up=false vpn_name=""
+  local name up ip rx tx peers endpoint peer_unit peer_script vpn_able vpn sep="" out="[" vpn_up=false vpn_name="" vpn_full=false
   while read -r name; do
     [[ -n $name ]] || continue
-    up=false ip="" rx=0 tx=0 endpoint=""
+    up=false ip="" rx=0 tx=0 endpoint="" vpn_able=false vpn=false
+    [[ $(systemctl show -p LoadState --value "wireguard-$name-vpn.service" 2>/dev/null) == loaded ]] && vpn_able=true
+    systemctl is-active --quiet "wireguard-$name-vpn.service" 2>/dev/null && vpn=true
     if [[ -d /sys/class/net/$name ]]; then
       ip -o link show "$name" 2>/dev/null | grep -q '<[^>]*UP' && up=true
       ip=$(ipv4 "$name")
@@ -120,14 +122,15 @@ wg_json() { # prints the "wireguard" array and the "vpn" summary
     fi
     if [[ $up == true && $vpn_up == false ]]; then vpn_up=true vpn_name=$name; fi
     [[ -z $vpn_name ]] && vpn_name=$name
-    out+="$sep{\"name\":\"$(jstr "$name")\",\"up\":$up,\"ip\":\"$ip\",\"rx\":\"$(human_bytes "$rx")\",\"tx\":\"$(human_bytes "$tx")\",\"peers\":\"$(jstr "$peers")\",\"endpoint\":\"$(jstr "$endpoint")\"}"
+    [[ $vpn == true ]] && vpn_full=true vpn_name=$name
+    out+="$sep{\"name\":\"$(jstr "$name")\",\"up\":$up,\"ip\":\"$ip\",\"rx\":\"$(human_bytes "$rx")\",\"tx\":\"$(human_bytes "$tx")\",\"peers\":\"$(jstr "$peers")\",\"endpoint\":\"$(jstr "$endpoint")\",\"vpn_able\":$vpn_able,\"vpn\":$vpn}"
     sep=,
   done < <(wg_ifaces)
-  printf '"wireguard":%s],"vpn":{"up":%s,"name":"%s"}' "$out" "$vpn_up" "$(jstr "$vpn_name")"
+  printf '"wireguard":%s],"vpn":{"up":%s,"full":%s,"name":"%s"}' "$out" "$vpn_up" "$vpn_full" "$(jstr "$vpn_name")"
 }
 
 refresh() { emit "$(state)"; }
-_link_events() { exec ip monitor link address; }
+_link_events() { exec ip monitor link address rule; }
 
 refresh
 mux_init

modules/home/wayland/apps/eww/bar/scripts/net/wg-vpn-toggle

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Toggle VPN mode (all traffic through the tunnel) of WireGuard interface $1,
+# independently of the tunnel itself.  Starting it brings the tunnel up.
+# Needs the polkit rule from modules/nixos/system/network/wireguard.
+name=$1
+[[ -n $name ]] || exit 64
+detach_self "$@"
+unit=wireguard-$name-vpn.service
+if systemctl is-active --quiet "$unit"; then
+  systemctl stop "$unit"
+else
+  systemctl start "$unit"
+fi

modules/home/wayland/apps/eww/bar/windows/net.yuck

@@ -96,12 +96,19 @@
   (box :orientation "v" :space-evenly false :class "wg-row"
     (box :orientation "h" :space-evenly false :valign "center"
       (label :class "wg-name ${wg.up ? 'wg-up' : 'wg-down'}" :halign "start" :hexpand true :text {wg.name})
+      (button
+        :class "net-toggle-btn net-add-btn ${wg.vpn ? 'net-toggle-on' : 'net-toggle-off'}"
+        :visible {wg.vpn_able}
+        :onclick "scripts/net/wg-vpn-toggle ${wg.name}"
+        :tooltip {wg.vpn ? "VPN: all traffic through ${wg.name}" : "VPN off: only the private subnet"}
+        (label :text "󰖟"))
       (button
         :class "net-toggle-btn ${wg.up ? 'net-toggle-on' : 'net-toggle-off'}"
         :onclick "scripts/net/wg-toggle ${wg.name}"
         :tooltip {wg.up ? "Disconnect" : "Connect"}
         (label :text {wg.up ? "󰖂" : "󰦞"})))
     (box :orientation "v" :space-evenly false :visible {wg.up}
+      (netinfo-row :label "Routing" :value {wg.vpn ? "All traffic" : "Private subnet"})
       (netinfo-row :label "IP"      :value {wg.ip})
       (netinfo-row :label "Peer"    :value {wg.endpoint != "" ? "${wg.peers} · ${wg.endpoint}" : wg.peers})
       (netinfo-row :label "Traffic" :value "󰇚 ${wg.rx}   󰕒 ${wg.tx}"))