-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
18 changed files
with
503 additions
and
178 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| { | ||
| lib, | ||
| config, | ||
| ... | ||
| }: let | ||
| cfg = config.services.dnscrypt-proxy2; | ||
| in { | ||
| networking = | ||
| if cfg.enable | ||
| then { | ||
| nameservers = ["127.0.0.2" "127.0.0.55"]; | ||
| # resolvconf.enable = lib.mkForce false; | ||
| dhcpcd.extraConfig = "nohook resolv.conf"; | ||
| networkmanager.dns = lib.mkForce "none"; | ||
| # resolvconf.useLocalResolver = true; | ||
| } | ||
| else {}; | ||
| services = { | ||
| resolved = | ||
| if cfg.enable | ||
| then { | ||
| enable = true; | ||
| dnssec = "allow-downgrade"; | ||
| extraConfig = '' | ||
| MulticastDNS=true | ||
| DNSStubListener=no | ||
| ''; | ||
| fallbackDns = | ||
| if config.services.tailscale.enable | ||
| then ["100.100.100.100"] | ||
| else []; | ||
| } | ||
| else {}; | ||
| dnscrypt-proxy2 = { | ||
| enable = lib.mkDefault false; | ||
| settings = { | ||
| listen_addresses = ["127.0.0.55:53"]; | ||
| ipv4_servers = true; | ||
| ipv6_servers = true; | ||
| require_dnssec = true; | ||
| doh_servers = true; | ||
| odoh_servers = true; | ||
| require_nolog = true; | ||
| bootstrap_resolvers = ["1.0.0.1:53" "1.1.1.1:53" "9.9.9.9:53"]; | ||
| cache = true; | ||
|
|
||
| sources.public-resolvers = { | ||
| urls = [ | ||
| "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md" | ||
| "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md" | ||
| ]; | ||
| cache_file = "/var/lib/dnscrypt-proxy/public-resolvers.md"; | ||
| minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3"; | ||
| }; | ||
|
|
||
| # You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md | ||
| server_names = [ | ||
| "cloudflare" | ||
| "google" | ||
| "quad9-doh-ip4-port443-filter-pri" | ||
| "quad9-doh-ip4-port5053-filter-pri" | ||
| "quad9-doh-ip6-port443-filter-pri" | ||
| "quad9-doh-ip6-port5053-filter-pri" | ||
| #"cloudflare-security-ipv6" | ||
| #"doh-crypto-sx" | ||
| ]; | ||
| }; | ||
| }; | ||
| }; | ||
| # systemd.services.dnscrypt-proxy2.serviceConfig = { | ||
| # StateDirectory = "dnscrypt-proxy"; | ||
| # }; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,127 @@ | ||
| { | ||
| config, | ||
| lib, | ||
| pkgs, | ||
| ... | ||
| }: | ||
| with lib; let | ||
| enable = true; | ||
| configFile = "/var/lib/sing-box/config.json"; | ||
| updateTimeoutMin = "720"; | ||
| subscriptionEnv = config.sops.secrets.sing-box.path; | ||
|
|
||
| uiPackage = pkgs.clash-webui-yacd-meta; | ||
| in { | ||
| sops.secrets.sing-box = {}; | ||
|
|
||
| systemd.services.sing-box = optionalAttrs enable ( | ||
| let | ||
| caps = ["CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE"]; | ||
| in { | ||
| description = "Sing-box networking service"; | ||
| wantedBy = ["multi-user.target"]; | ||
| requires = ["network-online.target"]; | ||
| after = ["network-online.target"]; | ||
| path = with pkgs; [curl sing-box]; | ||
|
|
||
| environment = { | ||
| SB_WORK_DIR = "/var/lib/sing-box"; | ||
| SB_CONF_FILE = configFile; | ||
| }; | ||
|
|
||
| serviceConfig = { | ||
| Type = "simple"; | ||
| # User = "sing-box"; | ||
| # Group = "sing-box"; | ||
| StateDirectory = "sing-box"; | ||
| EnvironmentFile = [subscriptionEnv]; | ||
| ExecStart = "${pkgs.sing-box}/bin/sing-box run -D $SB_WORK_DIR -c $SB_CONF_FILE"; | ||
|
|
||
| # Sing-box Auto Update | ||
| Restart = "always"; | ||
| # RuntimeMaxSec = "${updateTimeoutMin}min"; | ||
|
|
||
| # OOM Killer | ||
| OOMPolicy = "kill"; | ||
| MemoryMax = "200M"; | ||
|
|
||
| # DynamicUser = "yes"; | ||
| # Capabilities | ||
| CapabilityBoundingSet = caps; | ||
| AmbientCapabilities = caps; | ||
| # Proc filesystem | ||
| ProcSubset = "pid"; | ||
| ProtectProc = "invisible"; | ||
| # Security | ||
| NoNewPrivileges = true; | ||
| # Sandboxing | ||
| LockPersonality = true; | ||
| MemoryDenyWriteExecute = true; | ||
| # PrivateDevices = true; # NOT WORK on Tun Mode | ||
| PrivateMounts = true; | ||
| PrivateTmp = true; | ||
| # PrivateUsers = true; # NOT WORK on Tun Mode | ||
| ProtectClock = true; | ||
| ProtectControlGroups = true; | ||
| ProtectHome = true; | ||
| ProtectHostname = true; | ||
| ProtectKernelLogs = true; | ||
| ProtectKernelModules = true; | ||
| ProtectKernelTunables = true; | ||
| ProtectSystem = "strict"; | ||
| RemoveIPC = true; | ||
| RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_NETLINK"]; | ||
| RestrictNamespaces = true; | ||
| RestrictRealtime = true; | ||
| RestrictSUIDSGID = true; | ||
| # System Call Filtering | ||
| SystemCallArchitectures = "native"; | ||
| SystemCallFilter = ["~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" "setrlimit"]; | ||
| }; | ||
|
|
||
| preStop = '' | ||
| if [[ -f $SB_CONF_FILE ]] && test `find $SB_CONF_FILE -mmin -2`; then | ||
| : | ||
| else | ||
| curl --connect-timeout 5 --retry 3 --retry-delay 1 \ | ||
| -L $SB_SUBSCRIPTION_URI \ | ||
| -o $SB_CONF_FILE || true | ||
| fi | ||
| ''; | ||
|
|
||
| preStart = '' | ||
| [[ -d $SB_WORK_DIR ]] || mkdir -p $SB_WORK_DIR | ||
| if [[ -f $SB_CONF_FILE ]] && test `find $SB_CONF_FILE -mmin -3`; then | ||
| : | ||
| elif [[ -f $SB_CONF_FILE ]] && test `find $SB_CONF_FILE -mmin -${updateTimeoutMin}`; then | ||
| curl --connect-timeout 5 \ | ||
| -L $SB_SUBSCRIPTION_URI \ | ||
| -o $SB_CONF_FILE || true | ||
| else | ||
| curl --connect-timeout 5 --retry 3 --retry-delay 1 \ | ||
| -L $SB_SUBSCRIPTION_URI \ | ||
| -o $SB_CONF_FILE || true | ||
| fi | ||
| [[ -f $SB_CONF_FILE ]] && chmod 0600 $SB_CONF_FILE || exit 1 | ||
| ''; | ||
| } | ||
| ); | ||
|
|
||
| services.lighttpd = { | ||
| inherit enable; | ||
| port = 80; | ||
| document-root = "${uiPackage}/share/clash/ui"; | ||
| extraConfig = ''server.bind = "127.0.0.88"''; | ||
| }; | ||
|
|
||
| networking.hosts = { | ||
| "127.0.0.88" = ["yacd.local"]; # Yacd Dashboard | ||
| "127.0.0.64" = ["singbox.local"]; # Sing-box | ||
| }; | ||
|
|
||
| environment.global-persistence.directories = [ | ||
| "/etc/sing-box" | ||
| ]; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,17 +1,33 @@ | ||
| {config, ...}: { | ||
| sops.secrets = { | ||
| "traefik/cloudflare_token" = {}; | ||
| }; | ||
| services.ddclient = { | ||
| enable = true; | ||
| interval = "5min"; | ||
| username = "token"; | ||
| passwordFile = config.sops.secrets."traefik/cloudflare_token".path; | ||
| protocol = "cloudflare"; | ||
| zone = config.networking.domain; | ||
| domains = [config.networking.fqdn]; | ||
| ssl = true; | ||
| use = "web,web=ifconfig.me/ip"; | ||
| verbose = true; | ||
| }; | ||
| } | ||
| { | ||
| config, | ||
| lib, | ||
| ... | ||
| }: let | ||
| inherit (config.networking) enableIPv6; | ||
| in | ||
| with lib; { | ||
| sops.secrets = { | ||
| "traefik/cloudflare_token" = {}; | ||
| }; | ||
| services.ddclient = { | ||
| enable = true; | ||
| interval = "5min"; | ||
| username = "token"; | ||
| passwordFile = config.sops.secrets."traefik/cloudflare_token".path; | ||
| protocol = "cloudflare"; | ||
| zone = config.networking.domain; | ||
| domains = [config.networking.fqdn]; | ||
| ssl = true; | ||
| # use = "web,web=ifconfig.me/ip"; | ||
| extraConfig = mkMerge [ | ||
| (mkIf enableIPv6 '' | ||
| usev6=webv6, webv6=https://ipv6.nsupdate.info/myip | ||
| '') | ||
| '' | ||
| usev4=webv4, webv4=https://ipv4.nsupdate.info/myip | ||
| max-interval=1d | ||
| '' | ||
| ]; | ||
| verbose = true; | ||
| }; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.