pyrox.dev
1{ config, lib, pkgs, ... }:
2
3let
4 cfg = config.programs.captive-browser;
5
6 inherit (lib)
7 concatStringsSep escapeShellArgs optionalString
8 literalExpression mkEnableOption mkIf mkOption mkOptionDefault types;
9
10 requiresSetcapWrapper = config.boot.kernelPackages.kernelOlder "5.7" && cfg.bindInterface;
11
12 browserDefault = chromium: concatStringsSep " " [
13 ''env XDG_CONFIG_HOME="$PREV_CONFIG_HOME"''
14 ''${chromium}/bin/chromium''
15 ''--user-data-dir=''${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive''
16 ''--proxy-server="socks5://$PROXY"''
17 ''--host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost"''
18 ''--no-first-run''
19 ''--new-window''
20 ''--incognito''
21 ''-no-default-browser-check''
22 ''http://cache.nixos.org/''
23 ];
24
25 desktopItem = pkgs.makeDesktopItem {
26 name = "captive-browser";
27 desktopName = "Captive Portal Browser";
28 exec = "captive-browser";
29 icon = "nix-snowflake";
30 categories = [ "Network" ];
31 };
32
33 captive-browser-configured = pkgs.writeShellScriptBin "captive-browser" ''
34 export PREV_CONFIG_HOME="$XDG_CONFIG_HOME"
35 export XDG_CONFIG_HOME=${pkgs.writeTextDir "captive-browser.toml" ''
36 browser = """${cfg.browser}"""
37 dhcp-dns = """${cfg.dhcp-dns}"""
38 socks5-addr = """${cfg.socks5-addr}"""
39 ${optionalString cfg.bindInterface ''
40 bind-device = """${cfg.interface}"""
41 ''}
42 ''}
43 exec ${cfg.package}/bin/captive-browser
44 '';
45in
46{
47 ###### interface
48
49 options = {
50 programs.captive-browser = {
51 enable = mkEnableOption (lib.mdDoc "captive browser");
52
53 package = mkOption {
54 type = types.package;
55 default = pkgs.captive-browser;
56 defaultText = literalExpression "pkgs.captive-browser";
57 description = lib.mdDoc "Which package to use for captive-browser";
58 };
59
60 interface = mkOption {
61 type = types.str;
62 description = lib.mdDoc "your public network interface (wlp3s0, wlan0, eth0, ...)";
63 };
64
65 # the options below are the same as in "captive-browser.toml"
66 browser = mkOption {
67 type = types.str;
68 default = browserDefault pkgs.chromium;
69 defaultText = literalExpression (browserDefault "\${pkgs.chromium}");
70 description = lib.mdDoc ''
71 The shell (/bin/sh) command executed once the proxy starts.
72 When browser exits, the proxy exits. An extra env var PROXY is available.
73
74 Here, we use a separate Chrome instance in Incognito mode, so that
75 it can run (and be waited for) alongside the default one, and that
76 it maintains no state across runs. To configure this browser open a
77 normal window in it, settings will be preserved.
78
79 @volth: chromium is to open a plain HTTP (not HTTPS nor redirect to HTTPS!) website.
80 upstream uses http://example.com but I have seen captive portals whose DNS server resolves "example.com" to 127.0.0.1
81 '';
82 };
83
84 dhcp-dns = mkOption {
85 type = types.str;
86 description = lib.mdDoc ''
87 The shell (/bin/sh) command executed to obtain the DHCP
88 DNS server address. The first match of an IPv4 regex is used.
89 IPv4 only, because let's be real, it's a captive portal.
90 '';
91 };
92
93 socks5-addr = mkOption {
94 type = types.str;
95 default = "localhost:1666";
96 description = lib.mdDoc "the listen address for the SOCKS5 proxy server";
97 };
98
99 bindInterface = mkOption {
100 default = true;
101 type = types.bool;
102 description = lib.mdDoc ''
103 Binds `captive-browser` to the network interface declared in
104 `cfg.interface`. This can be used to avoid collisions
105 with private subnets.
106 '';
107 };
108 };
109 };
110
111 ###### implementation
112
113 config = mkIf cfg.enable {
114 environment.systemPackages = [
115 (pkgs.runCommand "captive-browser-desktop-item" { } ''
116 install -Dm444 -t $out/share/applications ${desktopItem}/share/applications/*.desktop
117 '')
118 captive-browser-configured
119 ];
120
121 programs.captive-browser.dhcp-dns =
122 let
123 iface = prefixes:
124 optionalString cfg.bindInterface (escapeShellArgs (prefixes ++ [ cfg.interface ]));
125 in
126 mkOptionDefault (
127 if config.networking.networkmanager.enable then
128 "${pkgs.networkmanager}/bin/nmcli dev show ${iface []} | ${pkgs.gnugrep}/bin/fgrep IP4.DNS"
129 else if config.networking.dhcpcd.enable then
130 "${pkgs.dhcpcd}/bin/dhcpcd ${iface ["-U"]} | ${pkgs.gnugrep}/bin/fgrep domain_name_servers"
131 else if config.networking.useNetworkd then
132 "${cfg.package}/bin/systemd-networkd-dns ${iface []}"
133 else
134 "${config.security.wrapperDir}/udhcpc --quit --now -f ${iface ["-i"]} -O dns --script ${
135 pkgs.writeShellScript "udhcp-script" ''
136 if [ "$1" = bound ]; then
137 echo "$dns"
138 fi
139 ''}"
140 );
141
142 security.wrappers.udhcpc = {
143 owner = "root";
144 group = "root";
145 capabilities = "cap_net_raw+p";
146 source = "${pkgs.busybox}/bin/udhcpc";
147 };
148
149 security.wrappers.captive-browser = mkIf requiresSetcapWrapper {
150 owner = "root";
151 group = "root";
152 capabilities = "cap_net_raw+p";
153 source = "${captive-browser-configured}/bin/captive-browser";
154 };
155 };
156}