From 298186fd067ab4937b3646eae5262569dd4f445d Mon Sep 17 00:00:00 2001
From: Joachim Schiele <js@lastlog.de>
Date: Sun, 9 Oct 2011 22:34:32 +0000
Subject: [PATCH] added cntlm as a system service with its own user 'cntlm'

svn path=/nixos/trunk/; revision=29737
---
 modules/module-list.nix               |   1 +
 modules/services/networking/cntlm.nix | 113 ++++++++++++++++++++++++++
 2 files changed, 114 insertions(+)
 create mode 100644 modules/services/networking/cntlm.nix

diff --git a/modules/module-list.nix b/modules/module-list.nix
index 860922b5672b..e6c72baf4e11 100644
--- a/modules/module-list.nix
+++ b/modules/module-list.nix
@@ -127,6 +127,7 @@
   ./services/networking/sabnzbd.nix
   ./services/networking/ssh/lshd.nix
   ./services/networking/ssh/sshd.nix
+  ./services/networking/cntlm.nix
   ./services/networking/tftpd.nix
   ./services/networking/vsftpd.nix
   ./services/networking/wakeonlan.nix
diff --git a/modules/services/networking/cntlm.nix b/modules/services/networking/cntlm.nix
new file mode 100644
index 000000000000..a79f7c21d7c2
--- /dev/null
+++ b/modules/services/networking/cntlm.nix
@@ -0,0 +1,113 @@
+{ config, pkgs, ... }:
+
+with pkgs.lib;
+
+let
+
+  cfg = config.services.cntlm;
+  uid = config.ids.uids.cntlm;
+
+in
+
+{
+
+  options = {
+
+    services.cntlm= {
+
+      enable = mkOption {
+        default = false;
+        description = ''
+          Whether to enable the cntlm, which start a local proxy.
+        '';
+      };
+
+      username = mkOption {
+        description = ''
+          Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally).
+        '';
+      };
+
+      domain = mkOption {
+        description = ''Proxy account domain/workgroup name.'';
+      };
+
+      password = mkOption {
+        default = "/etc/cntlm.password";
+        type = with pkgs.lib.types; string;
+        description = ''Proxy account password. Note: use chmod 0600 on /etc/cntlm.password for security.'';
+      };
+
+      netbios_hostname = mkOption {
+        default = config.networking.hostName;
+        description = ''
+          The hostname of your workstation.
+        '';
+      };
+
+      proxy = mkOption {
+        description = ''
+          A list of NTLM/NTLMv2 authenticating HTTP proxies.
+
+          Parent proxy, which requires authentication. The same as proxy on the command-line, can be used more than  once  to  specify  unlimited
+          number  of  proxies.  Should  one proxy fail, cntlm automatically moves on to the next one. The connect request fails only if the whole
+          list of proxies is scanned and (for each request) and found to be invalid. Command-line takes precedence over the configuration file.
+        '';
+      };
+
+      port = mkOption {
+        default = [3128];
+        description = "Specifies on which ports the cntlm daemon listens.";
+      };
+
+     extraConfig = mkOption {
+        default = "";
+        description = "Verbatim contents of <filename>cntlm.conf</filename>.";
+     };
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf config.services.cntlm.enable {
+    users.extraUsers = singleton { 
+        name = "cntlm";
+        description = "cntlm system-wide daemon";
+        home = "/var/empty";
+    };
+
+    jobs.cntlm = {
+        description = "cntlm is an NTLM / NTLM Session Response / NTLMv2 authenticating HTTP proxy.";
+        startOn = "started network-interfaces";
+        environment = {
+        };
+
+    preStart = '' '';
+
+    daemonType = "fork";
+
+    exec =
+      ''
+        ${pkgs.cntlm}/bin/cntlm -U cntlm \
+        -c ${pkgs.writeText "cntlm_config" cfg.extraConfig}
+      '';
+    };
+
+    services.cntlm.extraConfig =
+      ''
+        # Cntlm Authentication Proxy Configuration
+        Username        ${cfg.username}
+        Domain          ${cfg.domain}
+        Password        ${cfg.password}
+        Workstation     ${cfg.netbios_hostname}
+        ${concatMapStrings (entry: "Proxy ${entry}\n") cfg.proxy}
+    
+        ${concatMapStrings (port: ''
+          Listen ${toString port}
+        '') cfg.port}
+      '';
+  };
+}