nixos/privoxy: add https and settings options
This is a major rewrite of the Privoxy module: - As per RFC0042, remove privoxy.extraConfig and replace it with a privoxy.settings option, which maps a NixOS freeform submodule to the Privoxy configuration format. - Move all top-level options that mirrored a setting to the real ones in privoxy.settings. This still keeps the type-checking, default values and examples in places. - Add two convenience options: userActions and userFilters, which simplify the operation of creating a file with pkgs.writeText, converting it to a string and adding it to the actionsfile/ filterfile list. - Add a privoxy.inspectHttps option to automagically setup TLS decryption support. I don't know how long have been waiting for this feature: can't believe it has just happened. - Also add a privoxy.certsLifetime to control the periodical cleanup of the temporary certificates generate by Privoxy.
This commit is contained in:
rnhmjoj
parent
7fd9d4bda7
commit
3673ded392
|
|
@ -4,26 +4,46 @@ with lib;
|
||||||
|
|
||||||
let
|
let
|
||||||
|
|
||||||
inherit (pkgs) privoxy;
|
|
||||||
|
|
||||||
cfg = config.services.privoxy;
|
cfg = config.services.privoxy;
|
||||||
|
|
||||||
confFile = pkgs.writeText "privoxy.conf" (''
|
serialise = name: val:
|
||||||
user-manual ${privoxy}/share/doc/privoxy/user-manual
|
if isList val then concatMapStrings (serialise name) val
|
||||||
confdir ${privoxy}/etc/
|
else if isBool val then serialise name (if val then "1" else "0")
|
||||||
listen-address ${cfg.listenAddress}
|
else "${name} ${toString val}\n";
|
||||||
enable-edit-actions ${if (cfg.enableEditActions == true) then "1" else "0"}
|
|
||||||
${concatMapStrings (f: "actionsfile ${f}\n") cfg.actionsFiles}
|
configType = with types;
|
||||||
${concatMapStrings (f: "filterfile ${f}\n") cfg.filterFiles}
|
let atom = oneOf [ int bool string path ];
|
||||||
'' + optionalString cfg.enableTor ''
|
in attrsOf (either atom (listOf atom))
|
||||||
forward-socks5t / 127.0.0.1:9063 .
|
// { description = ''
|
||||||
toggle 1
|
privoxy configuration type. The format consists of an attribute
|
||||||
enable-remote-toggle 0
|
set of settings. Each setting can be either a value (integer, string,
|
||||||
enable-edit-actions 0
|
boolean or path) or a list of such values.
|
||||||
enable-remote-http-toggle 0
|
'';
|
||||||
'' + ''
|
};
|
||||||
${cfg.extraConfig}
|
|
||||||
'');
|
ageType = types.str // {
|
||||||
|
check = x:
|
||||||
|
isString x &&
|
||||||
|
(builtins.match "([0-9]+([smhdw]|min|ms|us)*)+" x != null);
|
||||||
|
description = "tmpfiles.d(5) age format";
|
||||||
|
};
|
||||||
|
|
||||||
|
configFile = pkgs.writeText "privoxy.conf"
|
||||||
|
(concatStrings (
|
||||||
|
# Relative paths in some options are relative to confdir. Privoxy seems
|
||||||
|
# to parse the options in order of appearance, so this must come first.
|
||||||
|
# Nix however doesn't preserve the order in attrsets, so we have to
|
||||||
|
# hardcode confdir here.
|
||||||
|
[ "confdir ${pkgs.privoxy}/etc\n" ]
|
||||||
|
++ mapAttrsToList serialise cfg.settings
|
||||||
|
));
|
||||||
|
|
||||||
|
inspectAction = pkgs.writeText "inspect-all-https.action"
|
||||||
|
''
|
||||||
|
# Enable HTTPS inspection for all requests
|
||||||
|
{+https-inspection}
|
||||||
|
/
|
||||||
|
'';
|
||||||
|
|
||||||
in
|
in
|
||||||
|
|
||||||
|
|
@ -31,70 +51,130 @@ in
|
||||||
|
|
||||||
###### interface
|
###### interface
|
||||||
|
|
||||||
options = {
|
options.services.privoxy = {
|
||||||
|
|
||||||
services.privoxy = {
|
enable = mkEnableOption "Privoxy, non-caching filtering proxy";
|
||||||
|
|
||||||
enable = mkOption {
|
enableTor = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
description = ''
|
description = ''
|
||||||
Whether to enable the Privoxy non-caching filtering proxy.
|
Whether to configure Privoxy to use Tor's faster SOCKS port,
|
||||||
'';
|
suitable for HTTP.
|
||||||
};
|
'';
|
||||||
|
};
|
||||||
listenAddress = mkOption {
|
|
||||||
type = types.str;
|
inspectHttps = mkOption {
|
||||||
default = "127.0.0.1:8118";
|
type = types.bool;
|
||||||
description = ''
|
default = false;
|
||||||
Address the proxy server is listening to.
|
description = ''
|
||||||
'';
|
Whether to configure Privoxy to inspect HTTPS requests, meaning all
|
||||||
};
|
encrypted traffic will be filtered as well. This works by decrypting
|
||||||
|
and re-encrypting the requests using a per-domain generated certificate.
|
||||||
actionsFiles = mkOption {
|
|
||||||
type = types.listOf types.str;
|
To issue per-domain certificates, Privoxy must be provided with a CA
|
||||||
example = [ "match-all.action" "default.action" "/etc/privoxy/user.action" ];
|
certificate, using the <literal>ca-cert-file</literal>,
|
||||||
default = [ "match-all.action" "default.action" ];
|
<literal>ca-key-file</literal> settings.
|
||||||
description = ''
|
|
||||||
List of paths to Privoxy action files.
|
<warning><para>
|
||||||
These paths may either be absolute or relative to the privoxy configuration directory.
|
The CA certificate must also be added to the system trust roots,
|
||||||
'';
|
otherwise browsers will reject all Privoxy certificates as invalid.
|
||||||
};
|
You can do so by using the option
|
||||||
|
<option>security.pki.certificateFiles</option>.
|
||||||
filterFiles = mkOption {
|
</para></warning>
|
||||||
type = types.listOf types.str;
|
'';
|
||||||
example = [ "default.filter" "/etc/privoxy/user.filter" ];
|
};
|
||||||
default = [ "default.filter" ];
|
|
||||||
description = ''
|
certsLifetime = mkOption {
|
||||||
List of paths to Privoxy filter files.
|
type = ageType;
|
||||||
These paths may either be absolute or relative to the privoxy configuration directory.
|
default = "10d";
|
||||||
'';
|
example = "12h";
|
||||||
};
|
description = ''
|
||||||
|
If <literal>inspectHttps</literal> is enabled, the time generated HTTPS
|
||||||
enableEditActions = mkOption {
|
certificates will be stored in a temporary directory for reuse. Once
|
||||||
type = types.bool;
|
the lifetime has expired the directory will cleared and the certificate
|
||||||
default = false;
|
will have to be generated again, on-demand.
|
||||||
description = ''
|
|
||||||
Whether or not the web-based actions file editor may be used.
|
Depending on the traffic, you may want to reduce the lifetime to limit
|
||||||
'';
|
the disk usage, since Privoxy itself never deletes the certificates.
|
||||||
};
|
|
||||||
|
<note><para>The format is that of the <literal>tmpfiles.d(5)</literal>
|
||||||
enableTor = mkOption {
|
Age parameter.</para></note>
|
||||||
type = types.bool;
|
'';
|
||||||
default = false;
|
};
|
||||||
description = ''
|
|
||||||
Whether to configure Privoxy to use Tor's faster SOCKS port,
|
userActions = mkOption {
|
||||||
suitable for HTTP.
|
type = types.lines;
|
||||||
'';
|
default = "";
|
||||||
};
|
description = ''
|
||||||
|
Actions to be included in a <literal>user.action</literal> file. This
|
||||||
extraConfig = mkOption {
|
will have a higher priority and can be used to override all other
|
||||||
type = types.lines;
|
actions.
|
||||||
default = "" ;
|
'';
|
||||||
description = ''
|
};
|
||||||
Extra configuration. Contents will be added verbatim to the configuration file.
|
|
||||||
'';
|
userFilters = mkOption {
|
||||||
|
type = types.lines;
|
||||||
|
default = "";
|
||||||
|
description = ''
|
||||||
|
Filters to be included in a <literal>user.filter</literal> file. This
|
||||||
|
will have a higher priority and can be used to override all other
|
||||||
|
filters definitions.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = mkOption {
|
||||||
|
type = types.submodule {
|
||||||
|
freeformType = configType;
|
||||||
|
|
||||||
|
options.listen-address = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "127.0.0.1:8118";
|
||||||
|
description = "Pair of address:port the proxy server is listening to.";
|
||||||
|
};
|
||||||
|
|
||||||
|
options.enable-edit-actions = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = false;
|
||||||
|
description = "Whether the web-based actions file editor may be used.";
|
||||||
|
};
|
||||||
|
|
||||||
|
options.actionsfile = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
# This must come after all other entries, in order to override the
|
||||||
|
# other actions/filters installed by Privoxy or the user.
|
||||||
|
apply = x: x ++ optional (cfg.userActions != "")
|
||||||
|
(toString (pkgs.writeText "user.actions" cfg.userActions));
|
||||||
|
default = [ "match-all.action" "default.action" ];
|
||||||
|
description = ''
|
||||||
|
List of paths to Privoxy action files. These paths may either be
|
||||||
|
absolute or relative to the privoxy configuration directory.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
options.filterfile = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [ "default.filter" ];
|
||||||
|
apply = x: x ++ optional (cfg.userFilters != "")
|
||||||
|
(toString (pkgs.writeText "user.filter" cfg.userFilters));
|
||||||
|
description = ''
|
||||||
|
List of paths to Privoxy filter files. These paths may either be
|
||||||
|
absolute or relative to the privoxy configuration directory.
|
||||||
|
'';
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
default = {};
|
||||||
|
example = literalExample ''
|
||||||
|
{ listen-address = "[::]:8118"; # listen on IPv6 only
|
||||||
|
forward-socks5 = ".onion localhost:9050 ."; # forward .onion requests to Tor
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
description = ''
|
||||||
|
This option is mapped to the main Privoxy configuration file.
|
||||||
|
Check out the Privoxy user manual at
|
||||||
|
<link xlink:href="file://${pkgs.privoxy}/share/doc/privoxy/user-manual/config.html"/>
|
||||||
|
for available settings and documentation.
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
@ -104,23 +184,34 @@ in
|
||||||
config = mkIf cfg.enable {
|
config = mkIf cfg.enable {
|
||||||
|
|
||||||
users.users.privoxy = {
|
users.users.privoxy = {
|
||||||
|
description = "Privoxy daemon user";
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
home = "/var/empty";
|
|
||||||
group = "privoxy";
|
group = "privoxy";
|
||||||
};
|
};
|
||||||
|
|
||||||
users.groups.privoxy = {};
|
users.groups.privoxy = {};
|
||||||
|
|
||||||
|
systemd.tmpfiles.rules = with cfg.settings; [
|
||||||
|
"d ${certificate-directory} 0770 privoxy privoxy ${cfg.certsLifetime}"
|
||||||
|
];
|
||||||
|
|
||||||
systemd.services.privoxy = {
|
systemd.services.privoxy = {
|
||||||
description = "Filtering web proxy";
|
description = "Filtering web proxy";
|
||||||
after = [ "network.target" "nss-lookup.target" ];
|
after = [ "network.target" "nss-lookup.target" ];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
serviceConfig.ExecStart = "${privoxy}/bin/privoxy --no-daemon --user privoxy ${confFile}";
|
serviceConfig = {
|
||||||
|
User = "privoxy";
|
||||||
serviceConfig.PrivateDevices = true;
|
Group = "privoxy";
|
||||||
serviceConfig.PrivateTmp = true;
|
ExecStart = "${pkgs.privoxy}/bin/privoxy --no-daemon ${configFile}";
|
||||||
serviceConfig.ProtectHome = true;
|
PrivateDevices = true;
|
||||||
serviceConfig.ProtectSystem = "full";
|
PrivateTmp = true;
|
||||||
|
ProtectHome = true;
|
||||||
|
ProtectSystem = "full";
|
||||||
|
};
|
||||||
|
unitConfig = mkIf cfg.inspectHttps {
|
||||||
|
ConditionPathExists = with cfg.settings;
|
||||||
|
[ ca-cert-file ca-key-file ];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.tor.settings.SOCKSPort = mkIf cfg.enableTor [
|
services.tor.settings.SOCKSPort = mkIf cfg.enableTor [
|
||||||
|
|
@ -128,8 +219,46 @@ in
|
||||||
{ addr = "127.0.0.1"; port = 9063; IsolateDestAddr = false; }
|
{ addr = "127.0.0.1"; port = 9063; IsolateDestAddr = false; }
|
||||||
];
|
];
|
||||||
|
|
||||||
|
services.privoxy.settings = {
|
||||||
|
user-manual = "${pkgs.privoxy}/share/doc/privoxy/user-manual";
|
||||||
|
filterfile = [ "default.filter" ];
|
||||||
|
actionsfile =
|
||||||
|
[ "match-all.action"
|
||||||
|
"default.action"
|
||||||
|
] ++ optional cfg.inspectHttps (toString inspectAction);
|
||||||
|
} // (optionalAttrs cfg.enableTor {
|
||||||
|
forward-socks5 = "127.0.0.1:9063 .";
|
||||||
|
toggle = true;
|
||||||
|
enable-remote-toggle = false;
|
||||||
|
enable-edit-actions = false;
|
||||||
|
enable-remote-http-toggle = false;
|
||||||
|
}) // (optionalAttrs cfg.inspectHttps {
|
||||||
|
# This allows setting absolute key/crt paths
|
||||||
|
ca-directory = "/var/empty";
|
||||||
|
certificate-directory = "/run/privoxy/certs";
|
||||||
|
trusted-cas-file = "/etc/ssl/certs/ca-certificates.crt";
|
||||||
|
});
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
|
imports =
|
||||||
|
let
|
||||||
|
top = x: [ "services" "privoxy" x ];
|
||||||
|
setting = x: [ "services" "privoxy" "settings" x ];
|
||||||
|
in
|
||||||
|
[ (mkRenamedOptionModule (top "enableEditActions") (setting "enable-edit-actions"))
|
||||||
|
(mkRenamedOptionModule (top "listenAddress") (setting "listen-address"))
|
||||||
|
(mkRenamedOptionModule (top "actionsFiles") (setting "actionsfile"))
|
||||||
|
(mkRenamedOptionModule (top "filterFiles") (setting "filterfile"))
|
||||||
|
(mkRemovedOptionModule (top "extraConfig")
|
||||||
|
''
|
||||||
|
Use services.privoxy.settings instead.
|
||||||
|
This is part of the general move to use structured settings instead of raw
|
||||||
|
text for config as introduced by RFC0042:
|
||||||
|
https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md
|
||||||
|
'')
|
||||||
|
];
|
||||||
|
|
||||||
meta.maintainers = with lib.maintainers; [ rnhmjoj ];
|
meta.maintainers = with lib.maintainers; [ rnhmjoj ];
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue