Systemd user service to autoconnect to ProtonVPN through their the CLI utility

auto-protonvpn.md

Service definition: ~/.config/systemd/user/auto-protonvpn.service

[Unit]
Description=ProtonVPN Connection
After=network-online.target
BindsTo=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/bin/protonvpn-cli ks --off ; /usr/bin/protonvpn-cli connect -f
ExecStop=/usr/bin/protonvpn-cli disconnect ; /usr/bin/protonvpn-cli ks --off
ExecReload=/usr/bin/protonvpn-cli ks --off ; /usr/bin/protonvpn-cli reconnect 
RemainAfterExit=yes
Restart=on-failure
RestartSec=5

[Install]
WantedBy=graphical-session.target

What to do:

• Make the network-online.target available for the user daemon: systemctl --user link /usr/lib/systemd/system/network-online.target
• Reload the daemon: systemctl --user daemon-reload
• Enable the service: systemctl --user enable auto-protonvpn.service

Note: for networks like eduroam, you should connect through TCP (/usr/bin/protonvpn-cli connect -f -p tcp).

Main caveat: no Wireguard support. For that, you need to generate a configuration file (so, no automatic server switching) in https://account.protonvpn.com/downloads and use sudo nmcli con import type wireguard file path/to/wireguard_config.conf to add it permamently.

Is there a reason why the kill switch is deliberately turned off per command line? I would rather have the kill switch be permanently in place; however, it appears the VPN doesn't automatically (re-)connect when this is active.