diff --git a/flake.nix b/flake.nix
index c0c0867..f3b3633 100644
--- a/flake.nix
+++ b/flake.nix
@@ -192,7 +192,7 @@
       {
         devShells = {
           default = pkgs.mkShell {
-            packages = with pkgs; [ git colmena nix-output-monitor ];
+            packages = with pkgs; [ git colmena sops nix-output-monitor ];
           };
         };
       }
diff --git a/machines/calcite/configuration.nix b/machines/calcite/configuration.nix
index b039b1d..3309e68 100644
--- a/machines/calcite/configuration.nix
+++ b/machines/calcite/configuration.nix
@@ -251,6 +251,10 @@
       owner = "xin";
       sopsFile = ./secrets.yaml;
     };
+    sing_box_url = {
+      owner = "root";
+      sopsFile = ./secrets.yaml;
+    };
   };
   custom.restic.enable = true;
   custom.restic.repositoryFile = config.sops.secrets.restic_repo_calcite.path;
diff --git a/machines/calcite/network.nix b/machines/calcite/network.nix
index f0f3e1c..e439899 100644
--- a/machines/calcite/network.nix
+++ b/machines/calcite/network.nix
@@ -1,9 +1,7 @@
-{ pkgs, ...}:
+{ config, pkgs, ...}:
 
 {
-  imports = [
-    ../sing-box.nix
-  ];
+  imports = [ ];
 
   # Enable networking
   networking = {
@@ -21,12 +19,20 @@
   services.tailscale.enable = true;
   # services.tailscale.useRoutingFeatures = "both";
 
+  custom.sing-box = {
+    enable = true;
+    configFile = {
+      urlFile = config.sops.secrets.sing_box_url.path;
+      hash = "6ca5bc8a16f8c413227690aceeee2c12c02cab09473c216b849af1e854b98588";
+    };
+    overrideSettings.experimental.clash_api.external_ui = "${config.nur.repos.linyinfeng.yacd}";
+  };
+
   # Open ports in the firewall.
   networking.firewall.enable = true;
   networking.firewall.allowedTCPPorts = [ 3389 ];
   networking.firewall.allowedUDPPorts = [ 3389 41641 ];
   networking.firewall.trustedInterfaces = [
-    "tun0"
     "tailscale0"
   ];
   # Use nftables to manager firewall
diff --git a/machines/calcite/secrets.yaml b/machines/calcite/secrets.yaml
index 8e918b4..90312d4 100644
--- a/machines/calcite/secrets.yaml
+++ b/machines/calcite/secrets.yaml
@@ -1,5 +1,6 @@
 restic_repo_calcite_password: ENC[AES256_GCM,data:9ALTQULAMyLY4FIxuVztf9r3,iv:fObBBeqpHAVYl8YUopz9fZd3YWB+0sc8l+sR12rmxb4=,tag:l3xDc2/cpQr38X/cd7qMXA==,type:str]
 restic_repo_calcite: ENC[AES256_GCM,data:+m9cjMXrZoCPg/S+/wV4WFBmg6pbFpqJ7JOdwOX0Z37bgoQXh4wcVPKK3CLd7G/iQjpO8SXaqJ1/d8r4Ydk21Gp1WqkB8g==,iv:DweDUujXp6i5XwwxeFjUsLDOJQJlRIT6GKPPxABNWiY=,tag:hdBHIjAcDQ1Ky/8hIv3+Ow==,type:str]
+sing_box_url: ENC[AES256_GCM,data:2z2bDKdn51o1eaqhgE0pTg4FWcO8wcLNlnBZ69Q3Jm5GCxkXxsxN7DgqQvRVeakOHvaenQotF+nc6tlhKPsyzdQeG0yl3YYhGb9o3DkmpUjC6lalMSoiw1rSMVyBg4KYCWxmhR9iRurun62+5INGZwwHVqAjgWJhy/9+pdIFtgKyd/t0JhSU,iv:gIGbvRd88vZu3cVW7e4emZmmNO8QcubLrxS1sCwi4Co=,tag:AzLLtcA9jAbeuo6eWU6ilw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -24,8 +25,8 @@ sops:
             WGlLdXVoZlp3bEFXZjlMdG1VOUZDNUkKQ2NNTE3OsNUr2pOI7qeNFSCVkUIVRS+g
             FG5FbJJcFihXqr+Qo0nZkq+xq07vIia7mKoqyoIfkKwweiVzDKyrkQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-11-30T16:43:19Z"
-    mac: ENC[AES256_GCM,data:U3TilLQvxM01gwIkBM4vT53JRBiE4VBOC0T6dxLjZ9btVMEhGp3MNQMRK0I06JP/vm532/oOTh/No/AwdzOpXxlfNY/hxxij03v83cZraSy8eT53uFV2TfU9HELVmmItqV2rJ96jBvCIzZJ+uif1OwIefcU+ii/MC333sW5DL1A=,iv:9pKUp08MPtECxUE3gxud/4220RsJ/d+xOFljntOdxfo=,tag:vvFpZRDoIz4NGll5XxRhAg==,type:str]
+    lastmodified: "2024-01-07T16:18:51Z"
+    mac: ENC[AES256_GCM,data:lBbtSYZ/UxBPBVVa6Bg0NiZxhFcjEREGBPEgCZau+C9aMQcMJp4s+SPKRaBDGuf2ee95pwuyYOb6M9Jr9dQxRAoAubgyaxAXUrC6U5Q8+VlKxMdvfBNJ5m8OGbkwHACrjkaWTRfHB8rPMH/yuIuuSZl8AB1m2GcT8uoluTsCMGo=,iv:FmFLPhoaR/YAVEJhQIhoUrZGX4p+fw/iCf1BN+NdX/U=,tag:/rZTAt20hd9LretuOHhTbQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1
diff --git a/machines/sing-box.nix b/machines/sing-box.nix
deleted file mode 100644
index 060d028..0000000
--- a/machines/sing-box.nix
+++ /dev/null
@@ -1,150 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  password = {
-    _secret = config.sops.secrets.singbox_password.path;
-  };
-  uuid = {
-    _secret = config.sops.secrets.singbox_uuid.path;
-  };
-  sg_server = {
-    _secret = config.sops.secrets.singbox_sg_server.path;
-  };
-  jp_server = {
-    _secret = config.sops.secrets.singbox_jp_server.path;
-  };
-in
-{
-  services.sing-box = {
-    enable = true;
-    settings = {
-      log = { level = "warning"; };
-      experimental = {
-        clash_api = {
-          external_controller = "127.0.0.1:9090";
-          store_selected = true;
-          external_ui = "${config.nur.repos.linyinfeng.yacd}";
-        };
-      };
-      dns = {
-        rules = [
-          {
-            disable_cache = true;
-            geosite = "category-ads-all";
-            server = "_dns_block";
-          }
-          {
-            geosite = "cn";
-            server = "_dns_doh_mainland";
-          }
-          {
-            disable_cache = false;
-            domain_suffix = sg_server;
-            server = "_dns_doh_mainland";
-          }
-          {
-            disable_cache = false;
-            domain_suffix = jp_server;
-            server = "_dns_doh_mainland";
-          }
-        ];
-        servers = [
-          {
-            address = "tls://dns.google:853/";
-            address_resolver = "_dns_udp_global";
-            detour = "_proxy_select";
-            tag = "_dns_global";
-          }
-          {
-            address = "1.1.1.1";
-            detour = "_proxy_select";
-            tag = "_dns_udp_global";
-          }
-          {
-            address = "119.29.29.29";
-            detour = "direct";
-            tag = "_dns_udp_mainland";
-          }
-          {
-            address = "tls://1.12.12.12:853/";
-            address_resolver = "_dns_udp_mainland";
-            detour = "direct";
-            tag = "_dns_doh_mainland";
-          }
-          {
-            address = "rcode://success";
-            tag = "_dns_block";
-          }
-        ];
-        final = "_dns_global";
-        strategy = "prefer_ipv4";
-        disable_cache = true;
-      };
-      inbounds = [
-        {
-          type = "mixed";
-          tag = "mixed-in";
-          listen = "127.0.0.1";
-          listen_port = 7891;
-        }
-        {
-          type = "tun";
-          tag = "tun-in";
-          auto_route = true;
-          strict_route = false;
-          inet4_address = "172.19.0.1/30";
-          inet6_address = "fdfe:dcba:9876::1/126";
-          sniff = true;
-        }
-      ];
-      route = {
-        auto_detect_interface = true;
-        final = "_proxy_select";
-        rules = [
-          { outbound = "dns-out"; protocol = "dns"; }
-          {
-            geoip = "cn";
-            geosite = "cn";
-            outbound = "direct";
-          }
-          { geoip = "private"; outbound = "direct"; }
-          {
-            domain = sg_server;
-            outbound = "direct";
-          }
-          { 
-            geosite = "cn";
-            geoip = "cn";
-            invert = true;
-            outbound = "_proxy_select";
-          }
-        ];
-      };
-      outbounds = [ 
-        { tag = "selfhost"; type = "urltest"; outbounds = lib.forEach (lib.range 0 4) (id: "jp" + toString id) ++ lib.forEach (lib.range 0 4) (id: "sg" + toString id); tolerance = 50; url = "http://cp.cloudflare.com/"; }
-        { tag = "sg0"; type = "trojan"; server = sg_server; server_port = 8080; password = password; tls = { enabled = true; server_name = sg_server; utls = { enabled = true; fingerprint = "firefox"; }; }; }
-        { tag = "jp0"; type = "trojan"; server = jp_server; server_port = 8080; password = password; tls = { enabled = true; server_name = jp_server; utls = { enabled = true; fingerprint = "firefox"; }; }; }
-        { default = "auto"; outbounds = [ "selfhost" "direct" "block"]; tag = "_proxy_select"; type = "selector"; }
-        { tag = "direct"; type = "direct"; }
-        { tag = "block"; type = "block"; }
-        { tag = "dns-out"; type = "dns"; }
-      ] ++ lib.forEach (lib.range 6311 6314) (port: {
-        inherit uuid password;
-        tag = "sg" + toString (port - 6310);
-        type = "tuic";
-        congestion_control = "bbr";
-        server = sg_server;
-        server_port = port;
-        tls = { enabled = true; server_name = sg_server; };
-      }) ++ lib.forEach (lib.range 6311 6314) (port: {
-        inherit uuid password;
-        tag = "jp" + toString (port - 6310);
-        type = "tuic";
-        congestion_control = "bbr";
-        server = jp_server;
-        server_port = port;
-        tls = { enabled = true; server_name = jp_server; };
-      });
-    };
-  };
-}
-
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index f963802..81ab1d0 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -5,5 +5,6 @@
     ./vaultwarden.nix
     ./prometheus.nix
     ./hedgedoc.nix
+    ./sing-box.nix
   ];
 }
diff --git a/modules/nixos/sing-box.nix b/modules/nixos/sing-box.nix
new file mode 100644
index 0000000..572291b
--- /dev/null
+++ b/modules/nixos/sing-box.nix
@@ -0,0 +1,84 @@
+{ config, pkgs, lib, utils, ... }:
+let
+  cfg = config.custom.sing-box;
+  settingsFormat = pkgs.formats.json { };
+in
+{
+  options = {
+    custom.sing-box = {
+      enable = lib.mkEnableOption "sing-box";
+
+      package = lib.mkPackageOption pkgs "sing-box" { };
+
+      stateDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/sing-box";
+      };
+
+      configFile = {
+        urlFile = lib.mkOption {
+          type = lib.types.path;
+        };
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "config.json";
+        };
+        hash = lib.mkOption {
+          type = lib.types.str;
+          example = "9a304bcb87d4c3f1e50f6281f25dd78635255ebde06cd4d2555729ecda43aed4";
+        };
+      };
+
+      overrideSettings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            route = {
+              geoip.path = lib.mkOption {
+                type = lib.types.path;
+                default = "${pkgs.sing-geoip}/share/sing-box/geoip.db";
+                defaultText = lib.literalExpression "\${pkgs.sing-geoip}/share/sing-box/geoip.db";
+                description = lib.mdDoc ''
+                  The path to the sing-geoip database.
+                '';
+              };
+              geosite.path = lib.mkOption {
+                type = lib.types.path;
+                default = "${pkgs.sing-geosite}/share/sing-box/geosite.db";
+                defaultText = lib.literalExpression "\${pkgs.sing-geosite}/share/sing-box/geosite.db";
+                description = lib.mdDoc ''
+                  The path to the sing-geosite database.
+                '';
+              };
+            };
+          };
+        };
+        default = { };
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    networking.firewall.trustedInterfaces = [ "tun0" ];
+
+    systemd.packages = [ cfg.package ];
+
+    systemd.services.sing-box = 
+    let
+      configFile = cfg.stateDir + "/${cfg.configFile.name}";
+    in
+      {
+        preStart = ''
+          umask 0077
+          mkdir -p /etc/sing-box
+          if ! [ -e ${configFile} ]; then
+            ${pkgs.curl}/bin/curl "$(${pkgs.coreutils}/bin/cat ${cfg.configFile.urlFile})" > '${configFile}'
+            test "${cfg.configFile.hash}" $(${pkgs.coreutils}/bin/sha256sum '${configFile}' | ${pkgs.coreutils}/bin/cut -d ' ' -f 1)
+          fi 
+          ${utils.genJqSecretsReplacementSnippet cfg.overrideSettings "/etc/sing-box/config.json"}
+          ${cfg.package}/bin/sing-box merge -c '${configFile}' -c /etc/sing-box/config.json /etc/sing-box/config.json
+        '';
+        wantedBy = [ "multi-user.target" ];
+      };
+  };
+}
+