Setting Up mitmproxy With NixOS in Podman

Entrypoint is set through these three steps:

• Create a script using pkgs.writeScriptBin <Script Name> <Script Content> (Line 5) This creates a file in /nix/store/hashvaluegoeshere/bin/<Script Name>. Unlike files created with pkgs.writeFile, this has executable permission by default. Unlike pkgs.writeShellScriptBin, this does not add NixOS-specific shebang at the front, which would make no sense within the container.
• Mount the script via volumes (Line 27) Note that the script's actual location is ${start}/bin/podman-start.sh like how most binaries end up when they're packages with Nix.
• Set entrypoint to that script (Line 12) The script will be run on container startup instead of the usual command.

The entrypoint option available for now does not accept parameters at the time of writing this article, so this particular approach was necessary. This script runs mitmweb, the web frontend, instead of the usual TUI. It also sets the web UI's password with web_password, which accepts an argon2 hash. Oh, and another benefit of using entrypoint script, you don't have to escape as much characters too.

The /etc/mitm directory within the container is set to /home/main/.config/sops-nix/secrets/mitm on the host machine through line 26. This kind of setup is completely optional, and you can just mount /etc/mitm anywhere, and if that directory is writeable, it will create cryptographic materials for you.

This part isn't necessary, but I added it just in case you want to see how I set my reverse proxy. I am using Traefik, and that means I need to set certain labels so that Traefik can automatically route traffic to it. There are total of seven labels to set up TLS using my personal certificate authority.

"traefik.enable" = "true";  

This line enables Traefik for this container.

"traefik.http.routers.mitm-web.entrypoints" = "websecure";  

This is the start of the definition of the router named mitm-web. This makes the router mitm-web to accept traffic from the entrypoint named websecure. The definition of websecure is handled by Traefik, and is not part of the container's config.

"traefik.http.routers.mitm-web.rule" = "Host(`mitmweb.local`)";

This makes the traffic to be handled by mitm-web router if the host is mitmweb.local. In other words, if I visit https://mitmweb.local, I can see the mitmproxy's web UI.

"traefik.http.routers.mitm-web.service" = "s-mitm-web";

If the incoming traffic is to be handled by mitm-web, then the traffic should be redirected to a service named s-mitm-web. The configuration for this service is defined below.

"traefik.http.routers.mitm-web.tls" = "true";

This line enables TLS for the router mitm-web.

"traefik.http.routers.mitm-web.tls.certResolver" = "localca";

This line makes the router to get its TLS certificates from my personal CA, named localca. The definition of this CA is handled by Traefik.

"traefik.http.services.s-mitm-web.loadbalancer.server.port" = "8081";

The service s-mitm-web should access this container's port 8081, which is the port mitmweb uses to serve its website.

The container also need to be in the same network as my Traefik container, which is the proxy network in the config. This is set in line 23.

Note that if you are not interested in reverse proxy, you can remove all the labels, and it should work just fine. Web should also be accessible over port 8081.

We need to create a config file that stores this Wireguard tunnel information. Create a file anywhere you want, but by default wireproxy will read the config from ~/.config/wireproxy.conf.

[Interface]
# Address specifies the IP of the Wireguard client (i.e. our device). This seems to be 10.0.0.1 by default.
Address = 10.0.0.1/32
# Our private key goes here  
PrivateKey = <Client's Private Key>
# The DNS we will use. This is 10.0.0.53 by default.
DNS = 10.0.0.53

# This section specifies the server to connect to.  
[Peer]
# This is the public key of the server.  
PublicKey = <Server's Public Key>
# This is the server we are going to connect to.  
Endpoint = <Server IP>:51820

# Finally, we need to assign a port that wireproxy will listen to.
# Any traffic that uses this as the proxy (if the program supports it, that is) will go through mitmproxy.  
[http]
# This binds local port 45162 to wireproxy.
# You can choose any as long as it is valid (above 1024 and under 65535). 45162 below was chosen randomly.
# Ensure the port is not in use by any other program.
# If you want to know if a port is already in use, enter the following command. If the port is not in use, it should give you nothing.
# lsof -i :<Port Number>  
BindAddress = localhost:45162

Now, we will run wireproxy. Whilst it is running, we can use localhost:45162 as proxy to make the traffic go through mitmproxy.

[nix-shell:~]$ wireproxy
DEBUG: 2025/10/17 21:45:20 UAPI: Updating private key
DEBUG: 2025/10/17 21:45:20 Routine: encryption worker 12 - started
...  

To test this out, we will use curl, and see if any results come up in the webpage. -x localhost:45162 is what you need to include to use the proxy, and ultimately, MITM the traffic. -k was included to ignore the SSL warnings you will get if you have not added mitmproxy's certificate to the list of trusted certificates.

[main@main:~]$ curl -k -x localhost:45162 https://ip.me
<My server's IP appeared here because ip.me gives you your own IP>  

When you run this, you should see some entries appearing in mitmweb.