{ config, lib, pkgs, ... }: with lib; let inherit (pkgs) privoxy; cfg = config.services.privoxy; confFile = pkgs.writeText "privoxy.conf" ('' user-manual ${privoxy}/share/doc/privoxy/user-manual confdir ${privoxy}/etc/ listen-address ${cfg.listenAddress} enable-edit-actions ${if (cfg.enableEditActions == true) then "1" else "0"} ${concatMapStrings (f: "actionsfile ${f}\n") cfg.actionsFiles} ${concatMapStrings (f: "filterfile ${f}\n") cfg.filterFiles} '' + optionalString cfg.enableTor '' forward-socks5t / 127.0.0.1:9063 . toggle 1 enable-remote-toggle 0 enable-edit-actions 0 enable-remote-http-toggle 0 '' + '' ${cfg.extraConfig} ''); in { ###### interface options = { services.privoxy = { enable = mkOption { type = types.bool; default = false; description = '' Whether to enable the Privoxy non-caching filtering proxy. ''; }; listenAddress = mkOption { type = types.str; default = "127.0.0.1:8118"; description = '' Address the proxy server is listening to. ''; }; actionsFiles = mkOption { type = types.listOf types.str; example = [ "match-all.action" "default.action" "/etc/privoxy/user.action" ]; default = [ "match-all.action" "default.action" ]; description = '' List of paths to Privoxy action files. These paths may either be absolute or relative to the privoxy configuration directory. ''; }; filterFiles = mkOption { type = types.listOf types.str; example = [ "default.filter" "/etc/privoxy/user.filter" ]; default = [ "default.filter" ]; description = '' List of paths to Privoxy filter files. These paths may either be absolute or relative to the privoxy configuration directory. ''; }; enableEditActions = mkOption { type = types.bool; default = false; description = '' Whether or not the web-based actions file editor may be used. ''; }; enableTor = mkOption { type = types.bool; default = false; description = '' Whether to configure Privoxy to use Tor's faster SOCKS port, suitable for HTTP. ''; }; extraConfig = mkOption { type = types.lines; default = "" ; description = '' Extra configuration. Contents will be added verbatim to the configuration file. ''; }; }; }; ###### implementation config = mkIf cfg.enable { users.users.privoxy = { isSystemUser = true; home = "/var/empty"; group = "privoxy"; }; users.groups.privoxy = {}; systemd.services.privoxy = { description = "Filtering web proxy"; after = [ "network.target" "nss-lookup.target" ]; wantedBy = [ "multi-user.target" ]; serviceConfig.ExecStart = "${privoxy}/bin/privoxy --no-daemon --user privoxy ${confFile}"; serviceConfig.PrivateDevices = true; serviceConfig.PrivateTmp = true; serviceConfig.ProtectHome = true; serviceConfig.ProtectSystem = "full"; }; services.tor.settings.SOCKSPort = mkIf cfg.enableTor [ # Route HTTP traffic over a faster port (without IsolateDestAddr). { addr = "127.0.0.1"; port = 9063; IsolateDestAddr = false; } ]; }; meta.maintainers = with lib.maintainers; [ rnhmjoj ]; }