pyrox.dev
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7let
8
9 cfg = config.services.cntlm;
10
11 configFile =
12 if cfg.configText != "" then
13 pkgs.writeText "cntlm.conf" ''
14 ${cfg.configText}
15 ''
16 else
17 pkgs.writeText "lighttpd.conf" ''
18 # Cntlm Authentication Proxy Configuration
19 Username ${cfg.username}
20 Domain ${cfg.domain}
21 Password ${cfg.password}
22 ${lib.optionalString (cfg.netbios_hostname != "") "Workstation ${cfg.netbios_hostname}"}
23 ${lib.concatMapStrings (entry: "Proxy ${entry}\n") cfg.proxy}
24 ${lib.optionalString (cfg.noproxy != [ ]) "NoProxy ${lib.concatStringsSep ", " cfg.noproxy}"}
25
26 ${lib.concatMapStrings (port: ''
27 Listen ${toString port}
28 '') cfg.port}
29
30 ${cfg.extraConfig}
31 '';
32
33in
34
35{
36
37 options.services.cntlm = {
38
39 enable = lib.mkEnableOption "cntlm, which starts a local proxy";
40
41 username = lib.mkOption {
42 type = lib.types.str;
43 description = ''
44 Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally).
45 '';
46 };
47
48 domain = lib.mkOption {
49 type = lib.types.str;
50 description = "Proxy account domain/workgroup name.";
51 };
52
53 password = lib.mkOption {
54 default = "/etc/cntlm.password";
55 type = lib.types.str;
56 description = "Proxy account password. Note: use chmod 0600 on /etc/cntlm.password for security.";
57 };
58
59 netbios_hostname = lib.mkOption {
60 type = lib.types.str;
61 default = "";
62 description = ''
63 The hostname of your machine.
64 '';
65 };
66
67 proxy = lib.mkOption {
68 type = lib.types.listOf lib.types.str;
69 description = ''
70 A list of NTLM/NTLMv2 authenticating HTTP proxies.
71
72 Parent proxy, which requires authentication. The same as proxy on the command-line, can be used more than once to specify unlimited
73 number of proxies. Should one proxy fail, cntlm automatically moves on to the next one. The connect request fails only if the whole
74 list of proxies is scanned and (for each request) and found to be invalid. Command-line takes precedence over the configuration file.
75 '';
76 example = [ "proxy.example.com:81" ];
77 };
78
79 noproxy = lib.mkOption {
80 description = ''
81 A list of domains where the proxy is skipped.
82 '';
83 default = [ ];
84 type = lib.types.listOf lib.types.str;
85 example = [
86 "*.example.com"
87 "example.com"
88 ];
89 };
90
91 port = lib.mkOption {
92 default = [ 3128 ];
93 type = lib.types.listOf lib.types.port;
94 description = "Specifies on which ports the cntlm daemon listens.";
95 };
96
97 extraConfig = lib.mkOption {
98 type = lib.types.lines;
99 default = "";
100 description = "Additional config appended to the end of the generated {file}`cntlm.conf`.";
101 };
102
103 configText = lib.mkOption {
104 type = lib.types.lines;
105 default = "";
106 description = "Verbatim contents of {file}`cntlm.conf`.";
107 };
108
109 };
110
111 ###### implementation
112
113 config = lib.mkIf cfg.enable {
114 systemd.services.cntlm = {
115 description = "CNTLM is an NTLM / NTLM Session Response / NTLMv2 authenticating HTTP proxy";
116 after = [ "network.target" ];
117 wantedBy = [ "multi-user.target" ];
118 serviceConfig = {
119 User = "cntlm";
120 ExecStart = ''
121 ${pkgs.cntlm}/bin/cntlm -U cntlm -c ${configFile} -v -f
122 '';
123 };
124 };
125
126 users.users.cntlm = {
127 name = "cntlm";
128 description = "cntlm system-wide daemon";
129 isSystemUser = true;
130 };
131 };
132}