146 lines
3.7 KiB
Nix
146 lines
3.7 KiB
Nix
{ inputs, config, pkgs, lib, modulesPath, ... }:
|
|
{
|
|
imports = [
|
|
../sops.nix
|
|
"${modulesPath}/virtualisation/amazon-image.nix"
|
|
];
|
|
|
|
|
|
config = {
|
|
sops = {
|
|
secrets = {
|
|
wg_private_key = {
|
|
owner = "root";
|
|
sopsFile = ./secrets + "/${config.networking.hostName}.yaml";
|
|
};
|
|
wg_ipv6_local_addr = {
|
|
owner = "root";
|
|
sopsFile = ./secrets + "/${config.networking.hostName}.yaml";
|
|
};
|
|
};
|
|
};
|
|
boot.loader.grub.device = lib.mkForce "/dev/nvme0n1";
|
|
boot.kernel.sysctl = {
|
|
"net.core.default_qdisc" = "fq";
|
|
"net.ipv4.tcp_congestion_control" = "bbr";
|
|
};
|
|
|
|
networking.firewall.trustedInterfaces = [ "tun0" ];
|
|
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
certs.${config.deployment.targetHost} = {
|
|
email = "me@namely.icu";
|
|
listenHTTP = ":80";
|
|
};
|
|
};
|
|
networking.firewall.allowedTCPPorts = [ 80 8080 ];
|
|
networking.firewall.allowedUDPPorts = [ ] ++ (lib.range 6311 6314);
|
|
|
|
custom.prometheus = {
|
|
enable = true;
|
|
exporters.enable = true;
|
|
grafana = {
|
|
enable = true;
|
|
password_file = config.sops.secrets.grafana_cloud_api.path;
|
|
};
|
|
};
|
|
|
|
services.sing-box = let
|
|
singTls = {
|
|
enabled = true;
|
|
server_name = config.deployment.targetHost;
|
|
key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
|
|
certificate_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
|
|
};
|
|
password = {
|
|
_secret = config.sops.secrets.singbox_password.path;
|
|
};
|
|
uuid = {
|
|
_secret = config.sops.secrets.singbox_uuid.path;
|
|
};
|
|
in
|
|
{
|
|
enable = true;
|
|
settings = {
|
|
dns = {
|
|
servers = [
|
|
{
|
|
address = "1.1.1.1";
|
|
detour = "wg-out";
|
|
}
|
|
];
|
|
};
|
|
inbounds = [
|
|
{
|
|
tag = "sg0";
|
|
type = "trojan";
|
|
listen = "::";
|
|
listen_port = 8080;
|
|
users = [
|
|
{ name = "proxy";
|
|
password = password;
|
|
}
|
|
];
|
|
tls = singTls;
|
|
}
|
|
] ++ lib.forEach (lib.range 6311 6314) (port: {
|
|
tag = "sg" + toString (port - 6310);
|
|
type = "tuic";
|
|
listen = "::";
|
|
listen_port = port;
|
|
congestion_control = "bbr";
|
|
users = [
|
|
{ name = "proxy";
|
|
uuid = uuid;
|
|
password = password;
|
|
}
|
|
];
|
|
tls = singTls;
|
|
});
|
|
outbounds = [
|
|
{
|
|
type = "wireguard";
|
|
tag = "wg-out";
|
|
private_key = {
|
|
_secret = config.sops.secrets.wg_private_key.path;
|
|
};
|
|
local_address = [
|
|
"172.16.0.2/32"
|
|
{ _secret = config.sops.secrets.wg_ipv6_local_addr.path; }
|
|
];
|
|
peers = [
|
|
{ public_key= "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
|
|
allowed_ips = [ "0.0.0.0/0" "::/0" ];
|
|
server = "162.159.192.1";
|
|
server_port = 500;
|
|
}
|
|
];
|
|
}
|
|
{
|
|
type = "direct";
|
|
tag = "direct";
|
|
}
|
|
{
|
|
type = "dns";
|
|
tag = "dns-out";
|
|
}
|
|
];
|
|
route = {
|
|
rules = [
|
|
{
|
|
outbound = "dns-out";
|
|
protocol = "dns";
|
|
}
|
|
{
|
|
geoip = "cn";
|
|
geosite = "cn";
|
|
outbound = "direct";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
}
|