pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.services.cntlm;
8
9 configFile = if cfg.configText != "" then
10 pkgs.writeText "cntlm.conf" ''
11 ${cfg.configText}
12 ''
13 else
14 pkgs.writeText "lighttpd.conf" ''
15 # Cntlm Authentication Proxy Configuration
16 Username ${cfg.username}
17 Domain ${cfg.domain}
18 Password ${cfg.password}
19 ${optionalString (cfg.netbios_hostname != "") "Workstation ${cfg.netbios_hostname}"}
20 ${concatMapStrings (entry: "Proxy ${entry}\n") cfg.proxy}
21 ${optionalString (cfg.noproxy != []) "NoProxy ${concatStringsSep ", " cfg.noproxy}"}
22
23 ${concatMapStrings (port: ''
24 Listen ${toString port}
25 '') cfg.port}
26
27 ${cfg.extraConfig}
28 '';
29
30in
31
32{
33
34 options.services.cntlm = {
35
36 enable = mkOption {
37 default = false;
38 description = ''
39 Whether to enable the cntlm, which start a local proxy.
40 '';
41 };
42
43 username = mkOption {
44 description = ''
45 Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally).
46 '';
47 };
48
49 domain = mkOption {
50 description = ''Proxy account domain/workgroup name.'';
51 };
52
53 password = mkOption {
54 default = "/etc/cntlm.password";
55 type = types.str;
56 description = ''Proxy account password. Note: use chmod 0600 on /etc/cntlm.password for security.'';
57 };
58
59 netbios_hostname = mkOption {
60 type = types.str;
61 default = "";
62 description = ''
63 The hostname of your machine.
64 '';
65 };
66
67 proxy = mkOption {
68 description = ''
69 A list of NTLM/NTLMv2 authenticating HTTP proxies.
70
71 Parent proxy, which requires authentication. The same as proxy on the command-line, can be used more than once to specify unlimited
72 number of proxies. Should one proxy fail, cntlm automatically moves on to the next one. The connect request fails only if the whole
73 list of proxies is scanned and (for each request) and found to be invalid. Command-line takes precedence over the configuration file.
74 '';
75 example = [ "proxy.example.com:81" ];
76 };
77
78 noproxy = mkOption {
79 description = ''
80 A list of domains where the proxy is skipped.
81 '';
82 default = [];
83 example = [ "*.example.com" "example.com" ];
84 };
85
86 port = mkOption {
87 default = [3128];
88 description = "Specifies on which ports the cntlm daemon listens.";
89 };
90
91 extraConfig = mkOption {
92 type = types.lines;
93 default = "";
94 description = "Additional config appended to the end of the generated <filename>cntlm.conf</filename>.";
95 };
96
97 configText = mkOption {
98 type = types.lines;
99 default = "";
100 description = "Verbatim contents of <filename>cntlm.conf</filename>.";
101 };
102
103 };
104
105 ###### implementation
106
107 config = mkIf cfg.enable {
108 systemd.services.cntlm = {
109 description = "CNTLM is an NTLM / NTLM Session Response / NTLMv2 authenticating HTTP proxy";
110 after = [ "network.target" ];
111 wantedBy = [ "multi-user.target" ];
112 serviceConfig = {
113 User = "cntlm";
114 ExecStart = ''
115 ${pkgs.cntlm}/bin/cntlm -U cntlm -c ${configFile} -v -f
116 '';
117 };
118 };
119
120 users.extraUsers.cntlm = {
121 name = "cntlm";
122 description = "cntlm system-wide daemon";
123 isSystemUser = true;
124 };
125 };
126}