pyrox.dev
1{ config, lib, pkgs, ... }:
2
3let
4 cfg = config.programs.captive-browser;
5
6 inherit (lib)
7 concatStringsSep escapeShellArgs optionalString
8 literalExpression mkEnableOption mkIf mkOption mkOptionDefault types;
9
10 browserDefault = chromium: concatStringsSep " " [
11 ''env XDG_CONFIG_HOME="$PREV_CONFIG_HOME"''
12 ''${chromium}/bin/chromium''
13 ''--user-data-dir=''${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive''
14 ''--proxy-server="socks5://$PROXY"''
15 ''--host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost"''
16 ''--no-first-run''
17 ''--new-window''
18 ''--incognito''
19 ''-no-default-browser-check''
20 ''http://cache.nixos.org/''
21 ];
22
23 desktopItem = pkgs.makeDesktopItem {
24 name = "captive-browser";
25 desktopName = "Captive Portal Browser";
26 exec = "/run/wrappers/bin/captive-browser";
27 icon = "nix-snowflake";
28 categories = [ "Network" ];
29 };
30
31in
32{
33 ###### interface
34
35 options = {
36 programs.captive-browser = {
37 enable = mkEnableOption (lib.mdDoc "captive browser");
38
39 package = mkOption {
40 type = types.package;
41 default = pkgs.captive-browser;
42 defaultText = literalExpression "pkgs.captive-browser";
43 description = lib.mdDoc "Which package to use for captive-browser";
44 };
45
46 interface = mkOption {
47 type = types.str;
48 description = lib.mdDoc "your public network interface (wlp3s0, wlan0, eth0, ...)";
49 };
50
51 # the options below are the same as in "captive-browser.toml"
52 browser = mkOption {
53 type = types.str;
54 default = browserDefault pkgs.chromium;
55 defaultText = literalExpression (browserDefault "\${pkgs.chromium}");
56 description = lib.mdDoc ''
57 The shell (/bin/sh) command executed once the proxy starts.
58 When browser exits, the proxy exits. An extra env var PROXY is available.
59
60 Here, we use a separate Chrome instance in Incognito mode, so that
61 it can run (and be waited for) alongside the default one, and that
62 it maintains no state across runs. To configure this browser open a
63 normal window in it, settings will be preserved.
64
65 @volth: chromium is to open a plain HTTP (not HTTPS nor redirect to HTTPS!) website.
66 upstream uses http://example.com but I have seen captive portals whose DNS server resolves "example.com" to 127.0.0.1
67 '';
68 };
69
70 dhcp-dns = mkOption {
71 type = types.str;
72 description = lib.mdDoc ''
73 The shell (/bin/sh) command executed to obtain the DHCP
74 DNS server address. The first match of an IPv4 regex is used.
75 IPv4 only, because let's be real, it's a captive portal.
76 '';
77 };
78
79 socks5-addr = mkOption {
80 type = types.str;
81 default = "localhost:1666";
82 description = lib.mdDoc "the listen address for the SOCKS5 proxy server";
83 };
84
85 bindInterface = mkOption {
86 default = true;
87 type = types.bool;
88 description = lib.mdDoc ''
89 Binds `captive-browser` to the network interface declared in
90 `cfg.interface`. This can be used to avoid collisions
91 with private subnets.
92 '';
93 };
94 };
95 };
96
97 ###### implementation
98
99 config = mkIf cfg.enable {
100 environment.systemPackages = [
101 (pkgs.runCommand "captive-browser-desktop-item" { } ''
102 install -Dm444 -t $out/share/applications ${desktopItem}/share/applications/*.desktop
103 '')
104 ];
105
106 programs.captive-browser.dhcp-dns =
107 let
108 iface = prefixes:
109 optionalString cfg.bindInterface (escapeShellArgs (prefixes ++ [ cfg.interface ]));
110 in
111 mkOptionDefault (
112 if config.networking.networkmanager.enable then
113 "${pkgs.networkmanager}/bin/nmcli dev show ${iface []} | ${pkgs.gnugrep}/bin/fgrep IP4.DNS"
114 else if config.networking.dhcpcd.enable then
115 "${pkgs.dhcpcd}/bin/dhcpcd ${iface ["-U"]} | ${pkgs.gnugrep}/bin/fgrep domain_name_servers"
116 else if config.networking.useNetworkd then
117 "${cfg.package}/bin/systemd-networkd-dns ${iface []}"
118 else
119 "${config.security.wrapperDir}/udhcpc --quit --now -f ${iface ["-i"]} -O dns --script ${
120 pkgs.writeShellScript "udhcp-script" ''
121 if [ "$1" = bound ]; then
122 echo "$dns"
123 fi
124 ''}"
125 );
126
127 security.wrappers.udhcpc = {
128 owner = "root";
129 group = "root";
130 capabilities = "cap_net_raw+p";
131 source = "${pkgs.busybox}/bin/udhcpc";
132 };
133
134 security.wrappers.captive-browser = {
135 owner = "root";
136 group = "root";
137 capabilities = "cap_net_raw+p";
138 source = pkgs.writeShellScript "captive-browser" ''
139 export PREV_CONFIG_HOME="$XDG_CONFIG_HOME"
140 export XDG_CONFIG_HOME=${pkgs.writeTextDir "captive-browser.toml" ''
141 browser = """${cfg.browser}"""
142 dhcp-dns = """${cfg.dhcp-dns}"""
143 socks5-addr = """${cfg.socks5-addr}"""
144 ${optionalString cfg.bindInterface ''
145 bind-device = """${cfg.interface}"""
146 ''}
147 ''}
148 exec ${cfg.package}/bin/captive-browser
149 '';
150 };
151 };
152}