pyrox.dev
1{ lib, pkgs, ... }: {
2 name = "3proxy";
3 meta.maintainers = with lib.maintainers; [ misuzu ];
4
5 nodes = {
6 peer0 = { lib, ... }: {
7 networking.useDHCP = false;
8 networking.interfaces.eth1 = {
9 ipv4.addresses = [
10 {
11 address = "192.168.0.1";
12 prefixLength = 24;
13 }
14 {
15 address = "216.58.211.111";
16 prefixLength = 24;
17 }
18 ];
19 };
20 };
21
22 peer1 = { lib, ... }: {
23 networking.useDHCP = false;
24 networking.interfaces.eth1 = {
25 ipv4.addresses = [
26 {
27 address = "192.168.0.2";
28 prefixLength = 24;
29 }
30 {
31 address = "216.58.211.112";
32 prefixLength = 24;
33 }
34 ];
35 };
36 # test that binding to [::] is working when ipv6 is disabled
37 networking.enableIPv6 = false;
38 services._3proxy = {
39 enable = true;
40 services = [
41 {
42 type = "admin";
43 bindPort = 9999;
44 auth = [ "none" ];
45 }
46 {
47 type = "proxy";
48 bindPort = 3128;
49 auth = [ "none" ];
50 }
51 ];
52 };
53 networking.firewall.allowedTCPPorts = [ 3128 9999 ];
54 };
55
56 peer2 = { lib, ... }: {
57 networking.useDHCP = false;
58 networking.interfaces.eth1 = {
59 ipv4.addresses = [
60 {
61 address = "192.168.0.3";
62 prefixLength = 24;
63 }
64 {
65 address = "216.58.211.113";
66 prefixLength = 24;
67 }
68 ];
69 };
70 services._3proxy = {
71 enable = true;
72 services = [
73 {
74 type = "admin";
75 bindPort = 9999;
76 auth = [ "none" ];
77 }
78 {
79 type = "proxy";
80 bindPort = 3128;
81 auth = [ "iponly" ];
82 acl = [
83 {
84 rule = "allow";
85 }
86 ];
87 }
88 ];
89 };
90 networking.firewall.allowedTCPPorts = [ 3128 9999 ];
91 };
92
93 peer3 = { lib, pkgs, ... }: {
94 networking.useDHCP = false;
95 networking.interfaces.eth1 = {
96 ipv4.addresses = [
97 {
98 address = "192.168.0.4";
99 prefixLength = 24;
100 }
101 {
102 address = "216.58.211.114";
103 prefixLength = 24;
104 }
105 ];
106 };
107 services._3proxy = {
108 enable = true;
109 usersFile = pkgs.writeText "3proxy.passwd" ''
110 admin:CR:$1$.GUV4Wvk$WnEVQtaqutD9.beO5ar1W/
111 '';
112 services = [
113 {
114 type = "admin";
115 bindPort = 9999;
116 auth = [ "none" ];
117 }
118 {
119 type = "proxy";
120 bindPort = 3128;
121 auth = [ "strong" ];
122 acl = [
123 {
124 rule = "allow";
125 }
126 ];
127 }
128 ];
129 };
130 networking.firewall.allowedTCPPorts = [ 3128 9999 ];
131 };
132 };
133
134 testScript = ''
135 start_all()
136
137 peer0.systemctl("start network-online.target")
138 peer0.wait_for_unit("network-online.target")
139
140 peer1.wait_for_unit("3proxy.service")
141 peer1.wait_for_open_port(9999)
142
143 # test none auth
144 peer0.succeed(
145 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.2:3128 -S -O /dev/null http://216.58.211.112:9999"
146 )
147 peer0.succeed(
148 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.2:3128 -S -O /dev/null http://192.168.0.2:9999"
149 )
150 peer0.succeed(
151 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.2:3128 -S -O /dev/null http://127.0.0.1:9999"
152 )
153
154 peer2.wait_for_unit("3proxy.service")
155 peer2.wait_for_open_port(9999)
156
157 # test iponly auth
158 peer0.succeed(
159 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.3:3128 -S -O /dev/null http://216.58.211.113:9999"
160 )
161 peer0.fail(
162 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.3:3128 -S -O /dev/null http://192.168.0.3:9999"
163 )
164 peer0.fail(
165 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.3:3128 -S -O /dev/null http://127.0.0.1:9999"
166 )
167
168 peer3.wait_for_unit("3proxy.service")
169 peer3.wait_for_open_port(9999)
170
171 # test strong auth
172 peer0.succeed(
173 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://admin:bigsecret\@192.168.0.4:3128 -S -O /dev/null http://216.58.211.114:9999"
174 )
175 peer0.fail(
176 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://admin:bigsecret\@192.168.0.4:3128 -S -O /dev/null http://192.168.0.4:9999"
177 )
178 peer0.fail(
179 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.4:3128 -S -O /dev/null http://216.58.211.114:9999"
180 )
181 peer0.fail(
182 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.4:3128 -S -O /dev/null http://192.168.0.4:9999"
183 )
184 peer0.fail(
185 "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.4:3128 -S -O /dev/null http://127.0.0.1:9999"
186 )
187 '';
188}