modules: add sing-box module
This commit is contained in:
parent
b0facfa211
commit
29d7585e27
7 changed files with 104 additions and 158 deletions
|
|
@ -192,7 +192,7 @@
|
|||
{
|
||||
devShells = {
|
||||
default = pkgs.mkShell {
|
||||
packages = with pkgs; [ git colmena nix-output-monitor ];
|
||||
packages = with pkgs; [ git colmena sops nix-output-monitor ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -251,6 +251,10 @@
|
|||
owner = "xin";
|
||||
sopsFile = ./secrets.yaml;
|
||||
};
|
||||
sing_box_url = {
|
||||
owner = "root";
|
||||
sopsFile = ./secrets.yaml;
|
||||
};
|
||||
};
|
||||
custom.restic.enable = true;
|
||||
custom.restic.repositoryFile = config.sops.secrets.restic_repo_calcite.path;
|
||||
|
|
|
|||
|
|
@ -1,9 +1,7 @@
|
|||
{ pkgs, ...}:
|
||||
{ config, pkgs, ...}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../sing-box.nix
|
||||
];
|
||||
imports = [ ];
|
||||
|
||||
# Enable networking
|
||||
networking = {
|
||||
|
|
@ -21,12 +19,20 @@
|
|||
services.tailscale.enable = true;
|
||||
# services.tailscale.useRoutingFeatures = "both";
|
||||
|
||||
custom.sing-box = {
|
||||
enable = true;
|
||||
configFile = {
|
||||
urlFile = config.sops.secrets.sing_box_url.path;
|
||||
hash = "6ca5bc8a16f8c413227690aceeee2c12c02cab09473c216b849af1e854b98588";
|
||||
};
|
||||
overrideSettings.experimental.clash_api.external_ui = "${config.nur.repos.linyinfeng.yacd}";
|
||||
};
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 3389 ];
|
||||
networking.firewall.allowedUDPPorts = [ 3389 41641 ];
|
||||
networking.firewall.trustedInterfaces = [
|
||||
"tun0"
|
||||
"tailscale0"
|
||||
];
|
||||
# Use nftables to manager firewall
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
restic_repo_calcite_password: ENC[AES256_GCM,data:9ALTQULAMyLY4FIxuVztf9r3,iv:fObBBeqpHAVYl8YUopz9fZd3YWB+0sc8l+sR12rmxb4=,tag:l3xDc2/cpQr38X/cd7qMXA==,type:str]
|
||||
restic_repo_calcite: ENC[AES256_GCM,data:+m9cjMXrZoCPg/S+/wV4WFBmg6pbFpqJ7JOdwOX0Z37bgoQXh4wcVPKK3CLd7G/iQjpO8SXaqJ1/d8r4Ydk21Gp1WqkB8g==,iv:DweDUujXp6i5XwwxeFjUsLDOJQJlRIT6GKPPxABNWiY=,tag:hdBHIjAcDQ1Ky/8hIv3+Ow==,type:str]
|
||||
sing_box_url: ENC[AES256_GCM,data:2z2bDKdn51o1eaqhgE0pTg4FWcO8wcLNlnBZ69Q3Jm5GCxkXxsxN7DgqQvRVeakOHvaenQotF+nc6tlhKPsyzdQeG0yl3YYhGb9o3DkmpUjC6lalMSoiw1rSMVyBg4KYCWxmhR9iRurun62+5INGZwwHVqAjgWJhy/9+pdIFtgKyd/t0JhSU,iv:gIGbvRd88vZu3cVW7e4emZmmNO8QcubLrxS1sCwi4Co=,tag:AzLLtcA9jAbeuo6eWU6ilw==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
|
|
@ -24,8 +25,8 @@ sops:
|
|||
WGlLdXVoZlp3bEFXZjlMdG1VOUZDNUkKQ2NNTE3OsNUr2pOI7qeNFSCVkUIVRS+g
|
||||
FG5FbJJcFihXqr+Qo0nZkq+xq07vIia7mKoqyoIfkKwweiVzDKyrkQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2023-11-30T16:43:19Z"
|
||||
mac: ENC[AES256_GCM,data:U3TilLQvxM01gwIkBM4vT53JRBiE4VBOC0T6dxLjZ9btVMEhGp3MNQMRK0I06JP/vm532/oOTh/No/AwdzOpXxlfNY/hxxij03v83cZraSy8eT53uFV2TfU9HELVmmItqV2rJ96jBvCIzZJ+uif1OwIefcU+ii/MC333sW5DL1A=,iv:9pKUp08MPtECxUE3gxud/4220RsJ/d+xOFljntOdxfo=,tag:vvFpZRDoIz4NGll5XxRhAg==,type:str]
|
||||
lastmodified: "2024-01-07T16:18:51Z"
|
||||
mac: ENC[AES256_GCM,data:lBbtSYZ/UxBPBVVa6Bg0NiZxhFcjEREGBPEgCZau+C9aMQcMJp4s+SPKRaBDGuf2ee95pwuyYOb6M9Jr9dQxRAoAubgyaxAXUrC6U5Q8+VlKxMdvfBNJ5m8OGbkwHACrjkaWTRfHB8rPMH/yuIuuSZl8AB1m2GcT8uoluTsCMGo=,iv:FmFLPhoaR/YAVEJhQIhoUrZGX4p+fw/iCf1BN+NdX/U=,tag:/rZTAt20hd9LretuOHhTbQ==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
|
|
|
|||
|
|
@ -1,150 +0,0 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
password = {
|
||||
_secret = config.sops.secrets.singbox_password.path;
|
||||
};
|
||||
uuid = {
|
||||
_secret = config.sops.secrets.singbox_uuid.path;
|
||||
};
|
||||
sg_server = {
|
||||
_secret = config.sops.secrets.singbox_sg_server.path;
|
||||
};
|
||||
jp_server = {
|
||||
_secret = config.sops.secrets.singbox_jp_server.path;
|
||||
};
|
||||
in
|
||||
{
|
||||
services.sing-box = {
|
||||
enable = true;
|
||||
settings = {
|
||||
log = { level = "warning"; };
|
||||
experimental = {
|
||||
clash_api = {
|
||||
external_controller = "127.0.0.1:9090";
|
||||
store_selected = true;
|
||||
external_ui = "${config.nur.repos.linyinfeng.yacd}";
|
||||
};
|
||||
};
|
||||
dns = {
|
||||
rules = [
|
||||
{
|
||||
disable_cache = true;
|
||||
geosite = "category-ads-all";
|
||||
server = "_dns_block";
|
||||
}
|
||||
{
|
||||
geosite = "cn";
|
||||
server = "_dns_doh_mainland";
|
||||
}
|
||||
{
|
||||
disable_cache = false;
|
||||
domain_suffix = sg_server;
|
||||
server = "_dns_doh_mainland";
|
||||
}
|
||||
{
|
||||
disable_cache = false;
|
||||
domain_suffix = jp_server;
|
||||
server = "_dns_doh_mainland";
|
||||
}
|
||||
];
|
||||
servers = [
|
||||
{
|
||||
address = "tls://dns.google:853/";
|
||||
address_resolver = "_dns_udp_global";
|
||||
detour = "_proxy_select";
|
||||
tag = "_dns_global";
|
||||
}
|
||||
{
|
||||
address = "1.1.1.1";
|
||||
detour = "_proxy_select";
|
||||
tag = "_dns_udp_global";
|
||||
}
|
||||
{
|
||||
address = "119.29.29.29";
|
||||
detour = "direct";
|
||||
tag = "_dns_udp_mainland";
|
||||
}
|
||||
{
|
||||
address = "tls://1.12.12.12:853/";
|
||||
address_resolver = "_dns_udp_mainland";
|
||||
detour = "direct";
|
||||
tag = "_dns_doh_mainland";
|
||||
}
|
||||
{
|
||||
address = "rcode://success";
|
||||
tag = "_dns_block";
|
||||
}
|
||||
];
|
||||
final = "_dns_global";
|
||||
strategy = "prefer_ipv4";
|
||||
disable_cache = true;
|
||||
};
|
||||
inbounds = [
|
||||
{
|
||||
type = "mixed";
|
||||
tag = "mixed-in";
|
||||
listen = "127.0.0.1";
|
||||
listen_port = 7891;
|
||||
}
|
||||
{
|
||||
type = "tun";
|
||||
tag = "tun-in";
|
||||
auto_route = true;
|
||||
strict_route = false;
|
||||
inet4_address = "172.19.0.1/30";
|
||||
inet6_address = "fdfe:dcba:9876::1/126";
|
||||
sniff = true;
|
||||
}
|
||||
];
|
||||
route = {
|
||||
auto_detect_interface = true;
|
||||
final = "_proxy_select";
|
||||
rules = [
|
||||
{ outbound = "dns-out"; protocol = "dns"; }
|
||||
{
|
||||
geoip = "cn";
|
||||
geosite = "cn";
|
||||
outbound = "direct";
|
||||
}
|
||||
{ geoip = "private"; outbound = "direct"; }
|
||||
{
|
||||
domain = sg_server;
|
||||
outbound = "direct";
|
||||
}
|
||||
{
|
||||
geosite = "cn";
|
||||
geoip = "cn";
|
||||
invert = true;
|
||||
outbound = "_proxy_select";
|
||||
}
|
||||
];
|
||||
};
|
||||
outbounds = [
|
||||
{ tag = "selfhost"; type = "urltest"; outbounds = lib.forEach (lib.range 0 4) (id: "jp" + toString id) ++ lib.forEach (lib.range 0 4) (id: "sg" + toString id); tolerance = 50; url = "http://cp.cloudflare.com/"; }
|
||||
{ tag = "sg0"; type = "trojan"; server = sg_server; server_port = 8080; password = password; tls = { enabled = true; server_name = sg_server; utls = { enabled = true; fingerprint = "firefox"; }; }; }
|
||||
{ tag = "jp0"; type = "trojan"; server = jp_server; server_port = 8080; password = password; tls = { enabled = true; server_name = jp_server; utls = { enabled = true; fingerprint = "firefox"; }; }; }
|
||||
{ default = "auto"; outbounds = [ "selfhost" "direct" "block"]; tag = "_proxy_select"; type = "selector"; }
|
||||
{ tag = "direct"; type = "direct"; }
|
||||
{ tag = "block"; type = "block"; }
|
||||
{ tag = "dns-out"; type = "dns"; }
|
||||
] ++ lib.forEach (lib.range 6311 6314) (port: {
|
||||
inherit uuid password;
|
||||
tag = "sg" + toString (port - 6310);
|
||||
type = "tuic";
|
||||
congestion_control = "bbr";
|
||||
server = sg_server;
|
||||
server_port = port;
|
||||
tls = { enabled = true; server_name = sg_server; };
|
||||
}) ++ lib.forEach (lib.range 6311 6314) (port: {
|
||||
inherit uuid password;
|
||||
tag = "jp" + toString (port - 6310);
|
||||
type = "tuic";
|
||||
congestion_control = "bbr";
|
||||
server = jp_server;
|
||||
server_port = port;
|
||||
tls = { enabled = true; server_name = jp_server; };
|
||||
});
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -5,5 +5,6 @@
|
|||
./vaultwarden.nix
|
||||
./prometheus.nix
|
||||
./hedgedoc.nix
|
||||
./sing-box.nix
|
||||
];
|
||||
}
|
||||
|
|
|
|||
84
modules/nixos/sing-box.nix
Normal file
84
modules/nixos/sing-box.nix
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
{ config, pkgs, lib, utils, ... }:
|
||||
let
|
||||
cfg = config.custom.sing-box;
|
||||
settingsFormat = pkgs.formats.json { };
|
||||
in
|
||||
{
|
||||
options = {
|
||||
custom.sing-box = {
|
||||
enable = lib.mkEnableOption "sing-box";
|
||||
|
||||
package = lib.mkPackageOption pkgs "sing-box" { };
|
||||
|
||||
stateDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/sing-box";
|
||||
};
|
||||
|
||||
configFile = {
|
||||
urlFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
};
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "config.json";
|
||||
};
|
||||
hash = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
example = "9a304bcb87d4c3f1e50f6281f25dd78635255ebde06cd4d2555729ecda43aed4";
|
||||
};
|
||||
};
|
||||
|
||||
overrideSettings = lib.mkOption {
|
||||
type = lib.types.submodule {
|
||||
freeformType = settingsFormat.type;
|
||||
options = {
|
||||
route = {
|
||||
geoip.path = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "${pkgs.sing-geoip}/share/sing-box/geoip.db";
|
||||
defaultText = lib.literalExpression "\${pkgs.sing-geoip}/share/sing-box/geoip.db";
|
||||
description = lib.mdDoc ''
|
||||
The path to the sing-geoip database.
|
||||
'';
|
||||
};
|
||||
geosite.path = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "${pkgs.sing-geosite}/share/sing-box/geosite.db";
|
||||
defaultText = lib.literalExpression "\${pkgs.sing-geosite}/share/sing-box/geosite.db";
|
||||
description = lib.mdDoc ''
|
||||
The path to the sing-geosite database.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
};
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.firewall.trustedInterfaces = [ "tun0" ];
|
||||
|
||||
systemd.packages = [ cfg.package ];
|
||||
|
||||
systemd.services.sing-box =
|
||||
let
|
||||
configFile = cfg.stateDir + "/${cfg.configFile.name}";
|
||||
in
|
||||
{
|
||||
preStart = ''
|
||||
umask 0077
|
||||
mkdir -p /etc/sing-box
|
||||
if ! [ -e ${configFile} ]; then
|
||||
${pkgs.curl}/bin/curl "$(${pkgs.coreutils}/bin/cat ${cfg.configFile.urlFile})" > '${configFile}'
|
||||
test "${cfg.configFile.hash}" $(${pkgs.coreutils}/bin/sha256sum '${configFile}' | ${pkgs.coreutils}/bin/cut -d ' ' -f 1)
|
||||
fi
|
||||
${utils.genJqSecretsReplacementSnippet cfg.overrideSettings "/etc/sing-box/config.json"}
|
||||
${cfg.package}/bin/sing-box merge -c '${configFile}' -c /etc/sing-box/config.json /etc/sing-box/config.json
|
||||
'';
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Loading…
Reference in a new issue