modules: add sing-box module

This commit is contained in:
xinyangli 2024-01-08 01:03:42 +08:00
parent b0facfa211
commit 29d7585e27
7 changed files with 104 additions and 158 deletions

View file

@ -192,7 +192,7 @@
{ {
devShells = { devShells = {
default = pkgs.mkShell { default = pkgs.mkShell {
packages = with pkgs; [ git colmena nix-output-monitor ]; packages = with pkgs; [ git colmena sops nix-output-monitor ];
}; };
}; };
} }

View file

@ -251,6 +251,10 @@
owner = "xin"; owner = "xin";
sopsFile = ./secrets.yaml; sopsFile = ./secrets.yaml;
}; };
sing_box_url = {
owner = "root";
sopsFile = ./secrets.yaml;
};
}; };
custom.restic.enable = true; custom.restic.enable = true;
custom.restic.repositoryFile = config.sops.secrets.restic_repo_calcite.path; custom.restic.repositoryFile = config.sops.secrets.restic_repo_calcite.path;

View file

@ -1,9 +1,7 @@
{ pkgs, ...}: { config, pkgs, ...}:
{ {
imports = [ imports = [ ];
../sing-box.nix
];
# Enable networking # Enable networking
networking = { networking = {
@ -21,12 +19,20 @@
services.tailscale.enable = true; services.tailscale.enable = true;
# services.tailscale.useRoutingFeatures = "both"; # services.tailscale.useRoutingFeatures = "both";
custom.sing-box = {
enable = true;
configFile = {
urlFile = config.sops.secrets.sing_box_url.path;
hash = "6ca5bc8a16f8c413227690aceeee2c12c02cab09473c216b849af1e854b98588";
};
overrideSettings.experimental.clash_api.external_ui = "${config.nur.repos.linyinfeng.yacd}";
};
# Open ports in the firewall. # Open ports in the firewall.
networking.firewall.enable = true; networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ 3389 ]; networking.firewall.allowedTCPPorts = [ 3389 ];
networking.firewall.allowedUDPPorts = [ 3389 41641 ]; networking.firewall.allowedUDPPorts = [ 3389 41641 ];
networking.firewall.trustedInterfaces = [ networking.firewall.trustedInterfaces = [
"tun0"
"tailscale0" "tailscale0"
]; ];
# Use nftables to manager firewall # Use nftables to manager firewall

View file

@ -1,5 +1,6 @@
restic_repo_calcite_password: ENC[AES256_GCM,data:9ALTQULAMyLY4FIxuVztf9r3,iv:fObBBeqpHAVYl8YUopz9fZd3YWB+0sc8l+sR12rmxb4=,tag:l3xDc2/cpQr38X/cd7qMXA==,type:str] restic_repo_calcite_password: ENC[AES256_GCM,data:9ALTQULAMyLY4FIxuVztf9r3,iv:fObBBeqpHAVYl8YUopz9fZd3YWB+0sc8l+sR12rmxb4=,tag:l3xDc2/cpQr38X/cd7qMXA==,type:str]
restic_repo_calcite: ENC[AES256_GCM,data:+m9cjMXrZoCPg/S+/wV4WFBmg6pbFpqJ7JOdwOX0Z37bgoQXh4wcVPKK3CLd7G/iQjpO8SXaqJ1/d8r4Ydk21Gp1WqkB8g==,iv:DweDUujXp6i5XwwxeFjUsLDOJQJlRIT6GKPPxABNWiY=,tag:hdBHIjAcDQ1Ky/8hIv3+Ow==,type:str] restic_repo_calcite: ENC[AES256_GCM,data:+m9cjMXrZoCPg/S+/wV4WFBmg6pbFpqJ7JOdwOX0Z37bgoQXh4wcVPKK3CLd7G/iQjpO8SXaqJ1/d8r4Ydk21Gp1WqkB8g==,iv:DweDUujXp6i5XwwxeFjUsLDOJQJlRIT6GKPPxABNWiY=,tag:hdBHIjAcDQ1Ky/8hIv3+Ow==,type:str]
sing_box_url: ENC[AES256_GCM,data:2z2bDKdn51o1eaqhgE0pTg4FWcO8wcLNlnBZ69Q3Jm5GCxkXxsxN7DgqQvRVeakOHvaenQotF+nc6tlhKPsyzdQeG0yl3YYhGb9o3DkmpUjC6lalMSoiw1rSMVyBg4KYCWxmhR9iRurun62+5INGZwwHVqAjgWJhy/9+pdIFtgKyd/t0JhSU,iv:gIGbvRd88vZu3cVW7e4emZmmNO8QcubLrxS1sCwi4Co=,tag:AzLLtcA9jAbeuo6eWU6ilw==,type:str]
sops: sops:
kms: [] kms: []
gcp_kms: [] gcp_kms: []
@ -24,8 +25,8 @@ sops:
WGlLdXVoZlp3bEFXZjlMdG1VOUZDNUkKQ2NNTE3OsNUr2pOI7qeNFSCVkUIVRS+g WGlLdXVoZlp3bEFXZjlMdG1VOUZDNUkKQ2NNTE3OsNUr2pOI7qeNFSCVkUIVRS+g
FG5FbJJcFihXqr+Qo0nZkq+xq07vIia7mKoqyoIfkKwweiVzDKyrkQ== FG5FbJJcFihXqr+Qo0nZkq+xq07vIia7mKoqyoIfkKwweiVzDKyrkQ==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2023-11-30T16:43:19Z" lastmodified: "2024-01-07T16:18:51Z"
mac: ENC[AES256_GCM,data:U3TilLQvxM01gwIkBM4vT53JRBiE4VBOC0T6dxLjZ9btVMEhGp3MNQMRK0I06JP/vm532/oOTh/No/AwdzOpXxlfNY/hxxij03v83cZraSy8eT53uFV2TfU9HELVmmItqV2rJ96jBvCIzZJ+uif1OwIefcU+ii/MC333sW5DL1A=,iv:9pKUp08MPtECxUE3gxud/4220RsJ/d+xOFljntOdxfo=,tag:vvFpZRDoIz4NGll5XxRhAg==,type:str] mac: ENC[AES256_GCM,data:lBbtSYZ/UxBPBVVa6Bg0NiZxhFcjEREGBPEgCZau+C9aMQcMJp4s+SPKRaBDGuf2ee95pwuyYOb6M9Jr9dQxRAoAubgyaxAXUrC6U5Q8+VlKxMdvfBNJ5m8OGbkwHACrjkaWTRfHB8rPMH/yuIuuSZl8AB1m2GcT8uoluTsCMGo=,iv:FmFLPhoaR/YAVEJhQIhoUrZGX4p+fw/iCf1BN+NdX/U=,tag:/rZTAt20hd9LretuOHhTbQ==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1

View file

@ -1,150 +0,0 @@
{ config, lib, pkgs, ... }:
let
password = {
_secret = config.sops.secrets.singbox_password.path;
};
uuid = {
_secret = config.sops.secrets.singbox_uuid.path;
};
sg_server = {
_secret = config.sops.secrets.singbox_sg_server.path;
};
jp_server = {
_secret = config.sops.secrets.singbox_jp_server.path;
};
in
{
services.sing-box = {
enable = true;
settings = {
log = { level = "warning"; };
experimental = {
clash_api = {
external_controller = "127.0.0.1:9090";
store_selected = true;
external_ui = "${config.nur.repos.linyinfeng.yacd}";
};
};
dns = {
rules = [
{
disable_cache = true;
geosite = "category-ads-all";
server = "_dns_block";
}
{
geosite = "cn";
server = "_dns_doh_mainland";
}
{
disable_cache = false;
domain_suffix = sg_server;
server = "_dns_doh_mainland";
}
{
disable_cache = false;
domain_suffix = jp_server;
server = "_dns_doh_mainland";
}
];
servers = [
{
address = "tls://dns.google:853/";
address_resolver = "_dns_udp_global";
detour = "_proxy_select";
tag = "_dns_global";
}
{
address = "1.1.1.1";
detour = "_proxy_select";
tag = "_dns_udp_global";
}
{
address = "119.29.29.29";
detour = "direct";
tag = "_dns_udp_mainland";
}
{
address = "tls://1.12.12.12:853/";
address_resolver = "_dns_udp_mainland";
detour = "direct";
tag = "_dns_doh_mainland";
}
{
address = "rcode://success";
tag = "_dns_block";
}
];
final = "_dns_global";
strategy = "prefer_ipv4";
disable_cache = true;
};
inbounds = [
{
type = "mixed";
tag = "mixed-in";
listen = "127.0.0.1";
listen_port = 7891;
}
{
type = "tun";
tag = "tun-in";
auto_route = true;
strict_route = false;
inet4_address = "172.19.0.1/30";
inet6_address = "fdfe:dcba:9876::1/126";
sniff = true;
}
];
route = {
auto_detect_interface = true;
final = "_proxy_select";
rules = [
{ outbound = "dns-out"; protocol = "dns"; }
{
geoip = "cn";
geosite = "cn";
outbound = "direct";
}
{ geoip = "private"; outbound = "direct"; }
{
domain = sg_server;
outbound = "direct";
}
{
geosite = "cn";
geoip = "cn";
invert = true;
outbound = "_proxy_select";
}
];
};
outbounds = [
{ tag = "selfhost"; type = "urltest"; outbounds = lib.forEach (lib.range 0 4) (id: "jp" + toString id) ++ lib.forEach (lib.range 0 4) (id: "sg" + toString id); tolerance = 50; url = "http://cp.cloudflare.com/"; }
{ tag = "sg0"; type = "trojan"; server = sg_server; server_port = 8080; password = password; tls = { enabled = true; server_name = sg_server; utls = { enabled = true; fingerprint = "firefox"; }; }; }
{ tag = "jp0"; type = "trojan"; server = jp_server; server_port = 8080; password = password; tls = { enabled = true; server_name = jp_server; utls = { enabled = true; fingerprint = "firefox"; }; }; }
{ default = "auto"; outbounds = [ "selfhost" "direct" "block"]; tag = "_proxy_select"; type = "selector"; }
{ tag = "direct"; type = "direct"; }
{ tag = "block"; type = "block"; }
{ tag = "dns-out"; type = "dns"; }
] ++ lib.forEach (lib.range 6311 6314) (port: {
inherit uuid password;
tag = "sg" + toString (port - 6310);
type = "tuic";
congestion_control = "bbr";
server = sg_server;
server_port = port;
tls = { enabled = true; server_name = sg_server; };
}) ++ lib.forEach (lib.range 6311 6314) (port: {
inherit uuid password;
tag = "jp" + toString (port - 6310);
type = "tuic";
congestion_control = "bbr";
server = jp_server;
server_port = port;
tls = { enabled = true; server_name = jp_server; };
});
};
};
}

View file

@ -5,5 +5,6 @@
./vaultwarden.nix ./vaultwarden.nix
./prometheus.nix ./prometheus.nix
./hedgedoc.nix ./hedgedoc.nix
./sing-box.nix
]; ];
} }

View file

@ -0,0 +1,84 @@
{ config, pkgs, lib, utils, ... }:
let
cfg = config.custom.sing-box;
settingsFormat = pkgs.formats.json { };
in
{
options = {
custom.sing-box = {
enable = lib.mkEnableOption "sing-box";
package = lib.mkPackageOption pkgs "sing-box" { };
stateDir = lib.mkOption {
type = lib.types.path;
default = "/var/lib/sing-box";
};
configFile = {
urlFile = lib.mkOption {
type = lib.types.path;
};
name = lib.mkOption {
type = lib.types.str;
default = "config.json";
};
hash = lib.mkOption {
type = lib.types.str;
example = "9a304bcb87d4c3f1e50f6281f25dd78635255ebde06cd4d2555729ecda43aed4";
};
};
overrideSettings = lib.mkOption {
type = lib.types.submodule {
freeformType = settingsFormat.type;
options = {
route = {
geoip.path = lib.mkOption {
type = lib.types.path;
default = "${pkgs.sing-geoip}/share/sing-box/geoip.db";
defaultText = lib.literalExpression "\${pkgs.sing-geoip}/share/sing-box/geoip.db";
description = lib.mdDoc ''
The path to the sing-geoip database.
'';
};
geosite.path = lib.mkOption {
type = lib.types.path;
default = "${pkgs.sing-geosite}/share/sing-box/geosite.db";
defaultText = lib.literalExpression "\${pkgs.sing-geosite}/share/sing-box/geosite.db";
description = lib.mdDoc ''
The path to the sing-geosite database.
'';
};
};
};
};
default = { };
};
};
};
config = lib.mkIf cfg.enable {
networking.firewall.trustedInterfaces = [ "tun0" ];
systemd.packages = [ cfg.package ];
systemd.services.sing-box =
let
configFile = cfg.stateDir + "/${cfg.configFile.name}";
in
{
preStart = ''
umask 0077
mkdir -p /etc/sing-box
if ! [ -e ${configFile} ]; then
${pkgs.curl}/bin/curl "$(${pkgs.coreutils}/bin/cat ${cfg.configFile.urlFile})" > '${configFile}'
test "${cfg.configFile.hash}" $(${pkgs.coreutils}/bin/sha256sum '${configFile}' | ${pkgs.coreutils}/bin/cut -d ' ' -f 1)
fi
${utils.genJqSecretsReplacementSnippet cfg.overrideSettings "/etc/sing-box/config.json"}
${cfg.package}/bin/sing-box merge -c '${configFile}' -c /etc/sing-box/config.json /etc/sing-box/config.json
'';
wantedBy = [ "multi-user.target" ];
};
};
}