From 8c57ddf379d11c0f84afad0e682ff1798b1a64b5 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 3 Jul 2026 15:08:10 +0200
Subject: [PATCH 1/3] captive-browser: 0-unstable-2021-08-01 ->
 0-unstable-2025-11-05

Switches to a maintained fork: https://github.com/pacoorozco/captive-browser

Diff: https://github.com/pacoorozco/captive-browser/compare/9c707dc32afc6e4146e19b43a3406329c64b6f3c..ca6f74e132ecf298c87936d4c946fd551aefbbf
---
 pkgs/by-name/ca/captive-browser/package.nix | 25 +++++++--------------
 1 file changed, 8 insertions(+), 17 deletions(-)

diff --git a/pkgs/by-name/ca/captive-browser/package.nix b/pkgs/by-name/ca/captive-browser/package.nix
index 7f6f740261e7..927a560c78ea 100644
--- a/pkgs/by-name/ca/captive-browser/package.nix
+++ b/pkgs/by-name/ca/captive-browser/package.nix
@@ -2,34 +2,25 @@
   lib,
   fetchFromGitHub,
   buildGoModule,
-  fetchpatch,
 }:
 
-buildGoModule {
+buildGoModule (finalAttrs: {
   pname = "captive-browser";
-  version = "0-unstable-2021-08-01";
+  version = "0-unstable-2025-11-05";
 
   src = fetchFromGitHub {
-    owner = "FiloSottile";
+    owner = "pacoorozco";
     repo = "captive-browser";
-    rev = "9c707dc32afc6e4146e19b43a3406329c64b6f3c";
-    sha256 = "sha256-65lPo5tpE0M/VyyvlzlcVSuHX4AhhVuqK0UF4BIAH/Y=";
+    rev = "ca6f74e132ecf298c87936d4c946fd551aefbbf7";
+    sha256 = "sha256-wojx28GFg9whfkNxUbOVDVNHp8M7SLsmRBTP/Jh8nLQ=";
   };
 
-  vendorHash = "sha256-2MFdQ2GIDAdLPuwAiGPO9wU3mm2BDXdyTwoVA1xVlcQ=";
-  deleteVendor = true;
-
-  patches = [
-    # Add go modules support
-    (fetchpatch {
-      url = "https://github.com/FiloSottile/captive-browser/commit/ef50837778ef4eaf38b19887e79c8b6fa830c342.patch";
-      hash = "sha256-w+jDFeO94pMu4ir+G5CzqYlXxYOm9+YfyzbU3sbTyiY=";
-    })
-  ];
+  vendorHash = "sha256-8FMFgCJUTalJ45GR5UnyXqN6s0gVFtiy6zjugbngDYQ=";
 
   ldflags = [
     "-s"
     "-w"
+    "-X main.Version=${finalAttrs.version}"
   ];
 
   meta = {
@@ -38,4 +29,4 @@ buildGoModule {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ma27 ];
   };
-}
+})

From 900ed1808da96b6620556c64f958ab4170b774b1 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 3 Jul 2026 15:09:24 +0200
Subject: [PATCH 2/3] nixos/captive-browser: drop setcap wrapper

Linux 5.7 is not supported on NixOS anymore, so this is dead-code.
---
 nixos/modules/programs/captive-browser.nix | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/nixos/modules/programs/captive-browser.nix b/nixos/modules/programs/captive-browser.nix
index 368994e8829f..ba1b2e6114b9 100644
--- a/nixos/modules/programs/captive-browser.nix
+++ b/nixos/modules/programs/captive-browser.nix
@@ -21,8 +21,6 @@ let
     types
     ;
 
-  requiresSetcapWrapper = config.boot.kernelPackages.kernelOlder "5.7" && cfg.bindInterface;
-
   browserDefault =
     chromium:
     concatStringsSep " " [
@@ -144,12 +142,5 @@ in
         else
           throw "programs.captive-browser.dhcp-dns must be set"
       );
-
-    security.wrappers.captive-browser = mkIf requiresSetcapWrapper {
-      owner = "root";
-      group = "root";
-      capabilities = "cap_net_raw+p";
-      source = "${captive-browser-configured}/bin/captive-browser";
-    };
   };
 }

From 6b6b3a6cd82e2f05c460aa9a8f26fac4ab1bf644 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 3 Jul 2026 15:09:44 +0200
Subject: [PATCH 3/3] nixos/captive-browser: update default arguments passed to
 Chromium

Closes #533452

Taken from https://github.com/pacoorozco/captive-browser/blob/9f75ef3/config_examples/captive-browser-linux-networkmanager.toml
---
 nixos/modules/programs/captive-browser.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/programs/captive-browser.nix b/nixos/modules/programs/captive-browser.nix
index ba1b2e6114b9..95c5c37e92be 100644
--- a/nixos/modules/programs/captive-browser.nix
+++ b/nixos/modules/programs/captive-browser.nix
@@ -28,11 +28,20 @@ let
       "${chromium}/bin/chromium"
       "--user-data-dir=\${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive"
       ''--proxy-server="socks5://$PROXY"''
-      ''--host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost"''
+      ''--proxy-bypass-list="<-loopback>"''
       "--no-first-run"
       "--new-window"
       "--incognito"
       "-no-default-browser-check"
+      "--no-crash-upload"
+      "--disable-extensions"
+      "--disable-sync"
+      "--disable-background-networking"
+      "--disable-client-side-phishing-detection"
+      "--disable-component-update"
+      "--disable-translate"
+      "--disable-web-resources"
+      "--safebrowsing-disable-auto-update"
       "http://cache.nixos.org/"
     ];