From 29d7585e272ec4e6731a792ee369b16ff385bfcf Mon Sep 17 00:00:00 2001 From: xinyangli Date: Mon, 8 Jan 2024 01:03:42 +0800 Subject: [PATCH] modules: add sing-box module --- flake.nix | 2 +- machines/calcite/configuration.nix | 4 + machines/calcite/network.nix | 16 ++- machines/calcite/secrets.yaml | 5 +- machines/sing-box.nix | 150 ----------------------------- modules/nixos/default.nix | 1 + modules/nixos/sing-box.nix | 84 ++++++++++++++++ 7 files changed, 104 insertions(+), 158 deletions(-) delete mode 100644 machines/sing-box.nix create mode 100644 modules/nixos/sing-box.nix diff --git a/flake.nix b/flake.nix index c0c0867..f3b3633 100644 --- a/flake.nix +++ b/flake.nix @@ -192,7 +192,7 @@ { devShells = { default = pkgs.mkShell { - packages = with pkgs; [ git colmena nix-output-monitor ]; + packages = with pkgs; [ git colmena sops nix-output-monitor ]; }; }; } diff --git a/machines/calcite/configuration.nix b/machines/calcite/configuration.nix index b039b1d..3309e68 100644 --- a/machines/calcite/configuration.nix +++ b/machines/calcite/configuration.nix @@ -251,6 +251,10 @@ owner = "xin"; sopsFile = ./secrets.yaml; }; + sing_box_url = { + owner = "root"; + sopsFile = ./secrets.yaml; + }; }; custom.restic.enable = true; custom.restic.repositoryFile = config.sops.secrets.restic_repo_calcite.path; diff --git a/machines/calcite/network.nix b/machines/calcite/network.nix index f0f3e1c..e439899 100644 --- a/machines/calcite/network.nix +++ b/machines/calcite/network.nix @@ -1,9 +1,7 @@ -{ pkgs, ...}: +{ config, pkgs, ...}: { - imports = [ - ../sing-box.nix - ]; + imports = [ ]; # Enable networking networking = { @@ -21,12 +19,20 @@ services.tailscale.enable = true; # services.tailscale.useRoutingFeatures = "both"; + custom.sing-box = { + enable = true; + configFile = { + urlFile = config.sops.secrets.sing_box_url.path; + hash = "6ca5bc8a16f8c413227690aceeee2c12c02cab09473c216b849af1e854b98588"; + }; + overrideSettings.experimental.clash_api.external_ui = "${config.nur.repos.linyinfeng.yacd}"; + }; + # Open ports in the firewall. networking.firewall.enable = true; networking.firewall.allowedTCPPorts = [ 3389 ]; networking.firewall.allowedUDPPorts = [ 3389 41641 ]; networking.firewall.trustedInterfaces = [ - "tun0" "tailscale0" ]; # Use nftables to manager firewall diff --git a/machines/calcite/secrets.yaml b/machines/calcite/secrets.yaml index 8e918b4..90312d4 100644 --- a/machines/calcite/secrets.yaml +++ b/machines/calcite/secrets.yaml @@ -1,5 +1,6 @@ restic_repo_calcite_password: ENC[AES256_GCM,data:9ALTQULAMyLY4FIxuVztf9r3,iv:fObBBeqpHAVYl8YUopz9fZd3YWB+0sc8l+sR12rmxb4=,tag:l3xDc2/cpQr38X/cd7qMXA==,type:str] restic_repo_calcite: ENC[AES256_GCM,data:+m9cjMXrZoCPg/S+/wV4WFBmg6pbFpqJ7JOdwOX0Z37bgoQXh4wcVPKK3CLd7G/iQjpO8SXaqJ1/d8r4Ydk21Gp1WqkB8g==,iv:DweDUujXp6i5XwwxeFjUsLDOJQJlRIT6GKPPxABNWiY=,tag:hdBHIjAcDQ1Ky/8hIv3+Ow==,type:str] +sing_box_url: ENC[AES256_GCM,data:2z2bDKdn51o1eaqhgE0pTg4FWcO8wcLNlnBZ69Q3Jm5GCxkXxsxN7DgqQvRVeakOHvaenQotF+nc6tlhKPsyzdQeG0yl3YYhGb9o3DkmpUjC6lalMSoiw1rSMVyBg4KYCWxmhR9iRurun62+5INGZwwHVqAjgWJhy/9+pdIFtgKyd/t0JhSU,iv:gIGbvRd88vZu3cVW7e4emZmmNO8QcubLrxS1sCwi4Co=,tag:AzLLtcA9jAbeuo6eWU6ilw==,type:str] sops: kms: [] gcp_kms: [] @@ -24,8 +25,8 @@ sops: WGlLdXVoZlp3bEFXZjlMdG1VOUZDNUkKQ2NNTE3OsNUr2pOI7qeNFSCVkUIVRS+g FG5FbJJcFihXqr+Qo0nZkq+xq07vIia7mKoqyoIfkKwweiVzDKyrkQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-11-30T16:43:19Z" - mac: ENC[AES256_GCM,data:U3TilLQvxM01gwIkBM4vT53JRBiE4VBOC0T6dxLjZ9btVMEhGp3MNQMRK0I06JP/vm532/oOTh/No/AwdzOpXxlfNY/hxxij03v83cZraSy8eT53uFV2TfU9HELVmmItqV2rJ96jBvCIzZJ+uif1OwIefcU+ii/MC333sW5DL1A=,iv:9pKUp08MPtECxUE3gxud/4220RsJ/d+xOFljntOdxfo=,tag:vvFpZRDoIz4NGll5XxRhAg==,type:str] + lastmodified: "2024-01-07T16:18:51Z" + mac: ENC[AES256_GCM,data:lBbtSYZ/UxBPBVVa6Bg0NiZxhFcjEREGBPEgCZau+C9aMQcMJp4s+SPKRaBDGuf2ee95pwuyYOb6M9Jr9dQxRAoAubgyaxAXUrC6U5Q8+VlKxMdvfBNJ5m8OGbkwHACrjkaWTRfHB8rPMH/yuIuuSZl8AB1m2GcT8uoluTsCMGo=,iv:FmFLPhoaR/YAVEJhQIhoUrZGX4p+fw/iCf1BN+NdX/U=,tag:/rZTAt20hd9LretuOHhTbQ==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/machines/sing-box.nix b/machines/sing-box.nix deleted file mode 100644 index 060d028..0000000 --- a/machines/sing-box.nix +++ /dev/null @@ -1,150 +0,0 @@ -{ config, lib, pkgs, ... }: -let - password = { - _secret = config.sops.secrets.singbox_password.path; - }; - uuid = { - _secret = config.sops.secrets.singbox_uuid.path; - }; - sg_server = { - _secret = config.sops.secrets.singbox_sg_server.path; - }; - jp_server = { - _secret = config.sops.secrets.singbox_jp_server.path; - }; -in -{ - services.sing-box = { - enable = true; - settings = { - log = { level = "warning"; }; - experimental = { - clash_api = { - external_controller = "127.0.0.1:9090"; - store_selected = true; - external_ui = "${config.nur.repos.linyinfeng.yacd}"; - }; - }; - dns = { - rules = [ - { - disable_cache = true; - geosite = "category-ads-all"; - server = "_dns_block"; - } - { - geosite = "cn"; - server = "_dns_doh_mainland"; - } - { - disable_cache = false; - domain_suffix = sg_server; - server = "_dns_doh_mainland"; - } - { - disable_cache = false; - domain_suffix = jp_server; - server = "_dns_doh_mainland"; - } - ]; - servers = [ - { - address = "tls://dns.google:853/"; - address_resolver = "_dns_udp_global"; - detour = "_proxy_select"; - tag = "_dns_global"; - } - { - address = "1.1.1.1"; - detour = "_proxy_select"; - tag = "_dns_udp_global"; - } - { - address = "119.29.29.29"; - detour = "direct"; - tag = "_dns_udp_mainland"; - } - { - address = "tls://1.12.12.12:853/"; - address_resolver = "_dns_udp_mainland"; - detour = "direct"; - tag = "_dns_doh_mainland"; - } - { - address = "rcode://success"; - tag = "_dns_block"; - } - ]; - final = "_dns_global"; - strategy = "prefer_ipv4"; - disable_cache = true; - }; - inbounds = [ - { - type = "mixed"; - tag = "mixed-in"; - listen = "127.0.0.1"; - listen_port = 7891; - } - { - type = "tun"; - tag = "tun-in"; - auto_route = true; - strict_route = false; - inet4_address = "172.19.0.1/30"; - inet6_address = "fdfe:dcba:9876::1/126"; - sniff = true; - } - ]; - route = { - auto_detect_interface = true; - final = "_proxy_select"; - rules = [ - { outbound = "dns-out"; protocol = "dns"; } - { - geoip = "cn"; - geosite = "cn"; - outbound = "direct"; - } - { geoip = "private"; outbound = "direct"; } - { - domain = sg_server; - outbound = "direct"; - } - { - geosite = "cn"; - geoip = "cn"; - invert = true; - outbound = "_proxy_select"; - } - ]; - }; - outbounds = [ - { tag = "selfhost"; type = "urltest"; outbounds = lib.forEach (lib.range 0 4) (id: "jp" + toString id) ++ lib.forEach (lib.range 0 4) (id: "sg" + toString id); tolerance = 50; url = "http://cp.cloudflare.com/"; } - { tag = "sg0"; type = "trojan"; server = sg_server; server_port = 8080; password = password; tls = { enabled = true; server_name = sg_server; utls = { enabled = true; fingerprint = "firefox"; }; }; } - { tag = "jp0"; type = "trojan"; server = jp_server; server_port = 8080; password = password; tls = { enabled = true; server_name = jp_server; utls = { enabled = true; fingerprint = "firefox"; }; }; } - { default = "auto"; outbounds = [ "selfhost" "direct" "block"]; tag = "_proxy_select"; type = "selector"; } - { tag = "direct"; type = "direct"; } - { tag = "block"; type = "block"; } - { tag = "dns-out"; type = "dns"; } - ] ++ lib.forEach (lib.range 6311 6314) (port: { - inherit uuid password; - tag = "sg" + toString (port - 6310); - type = "tuic"; - congestion_control = "bbr"; - server = sg_server; - server_port = port; - tls = { enabled = true; server_name = sg_server; }; - }) ++ lib.forEach (lib.range 6311 6314) (port: { - inherit uuid password; - tag = "jp" + toString (port - 6310); - type = "tuic"; - congestion_control = "bbr"; - server = jp_server; - server_port = port; - tls = { enabled = true; server_name = jp_server; }; - }); - }; - }; -} - diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index f963802..81ab1d0 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -5,5 +5,6 @@ ./vaultwarden.nix ./prometheus.nix ./hedgedoc.nix + ./sing-box.nix ]; } diff --git a/modules/nixos/sing-box.nix b/modules/nixos/sing-box.nix new file mode 100644 index 0000000..572291b --- /dev/null +++ b/modules/nixos/sing-box.nix @@ -0,0 +1,84 @@ +{ config, pkgs, lib, utils, ... }: +let + cfg = config.custom.sing-box; + settingsFormat = pkgs.formats.json { }; +in +{ + options = { + custom.sing-box = { + enable = lib.mkEnableOption "sing-box"; + + package = lib.mkPackageOption pkgs "sing-box" { }; + + stateDir = lib.mkOption { + type = lib.types.path; + default = "/var/lib/sing-box"; + }; + + configFile = { + urlFile = lib.mkOption { + type = lib.types.path; + }; + name = lib.mkOption { + type = lib.types.str; + default = "config.json"; + }; + hash = lib.mkOption { + type = lib.types.str; + example = "9a304bcb87d4c3f1e50f6281f25dd78635255ebde06cd4d2555729ecda43aed4"; + }; + }; + + overrideSettings = lib.mkOption { + type = lib.types.submodule { + freeformType = settingsFormat.type; + options = { + route = { + geoip.path = lib.mkOption { + type = lib.types.path; + default = "${pkgs.sing-geoip}/share/sing-box/geoip.db"; + defaultText = lib.literalExpression "\${pkgs.sing-geoip}/share/sing-box/geoip.db"; + description = lib.mdDoc '' + The path to the sing-geoip database. + ''; + }; + geosite.path = lib.mkOption { + type = lib.types.path; + default = "${pkgs.sing-geosite}/share/sing-box/geosite.db"; + defaultText = lib.literalExpression "\${pkgs.sing-geosite}/share/sing-box/geosite.db"; + description = lib.mdDoc '' + The path to the sing-geosite database. + ''; + }; + }; + }; + }; + default = { }; + }; + }; + }; + config = lib.mkIf cfg.enable { + networking.firewall.trustedInterfaces = [ "tun0" ]; + + systemd.packages = [ cfg.package ]; + + systemd.services.sing-box = + let + configFile = cfg.stateDir + "/${cfg.configFile.name}"; + in + { + preStart = '' + umask 0077 + mkdir -p /etc/sing-box + if ! [ -e ${configFile} ]; then + ${pkgs.curl}/bin/curl "$(${pkgs.coreutils}/bin/cat ${cfg.configFile.urlFile})" > '${configFile}' + test "${cfg.configFile.hash}" $(${pkgs.coreutils}/bin/sha256sum '${configFile}' | ${pkgs.coreutils}/bin/cut -d ' ' -f 1) + fi + ${utils.genJqSecretsReplacementSnippet cfg.overrideSettings "/etc/sing-box/config.json"} + ${cfg.package}/bin/sing-box merge -c '${configFile}' -c /etc/sing-box/config.json /etc/sing-box/config.json + ''; + wantedBy = [ "multi-user.target" ]; + }; + }; +} +