70 lines
No EOL
2.2 KiB
Nix
70 lines
No EOL
2.2 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
desu.secrets.arumi-singbox-pk.owner = "xray";
|
|
desu.secrets.arumi-singbox-sid.owner = "xray";
|
|
desu.secrets.arumi-singbox-users.owner = "xray";
|
|
|
|
users.users.xray = {
|
|
isNormalUser = true;
|
|
uid = 1102;
|
|
};
|
|
|
|
services.xray = {
|
|
enable = true;
|
|
settingsFile = "/etc/xray/config.json";
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /etc/xray 0700 1102 1102 -"
|
|
];
|
|
systemd.services.xray.serviceConfig = {
|
|
DynamicUser = lib.mkForce false;
|
|
User = "xray";
|
|
};
|
|
systemd.services.xray.preStart = let
|
|
file = "/etc/xray/config.json";
|
|
template = pkgs.writeText "config.json" (builtins.toJSON {
|
|
log = { level = "info"; timestamp = true; };
|
|
inbounds = [
|
|
{
|
|
port = 443;
|
|
protocol = "vless";
|
|
settings = {
|
|
decryption = "none";
|
|
clients = []; # populated later in the preStart script
|
|
};
|
|
streamSettings = {
|
|
network = "tcp";
|
|
security = "reality";
|
|
realitySettings = {
|
|
alpn = [ "h2" ];
|
|
target = "updates.cdn-apple.com:443";
|
|
serverNames = [ "updates.cdn-apple.com" ];
|
|
privateKey = ""; # populated later in the preStart script
|
|
shortIds = []; # populated later in the preStart script
|
|
};
|
|
};
|
|
sniffing = {
|
|
enabled = true;
|
|
destOverride = [ "tls" "http" "quic" ];
|
|
routeOnly = true;
|
|
};
|
|
}
|
|
];
|
|
outbounds = [
|
|
{ protocol = "freedom"; tag = "direct"; }
|
|
];
|
|
});
|
|
in ''
|
|
users=$(${pkgs.yaml2json}/bin/yaml2json < ${config.desu.secrets.arumi-singbox-users.path})
|
|
pk=$(cat ${config.desu.secrets.arumi-singbox-pk.path})
|
|
sid=$(cat ${config.desu.secrets.arumi-singbox-sid.path})
|
|
${pkgs.jq}/bin/jq --arg users "$users" --arg pk "$pk" --arg sid "$sid" \
|
|
'.inbounds[0].settings.clients = ($users | fromjson | map({ "id": ., "flow": "xtls-rprx-vision" }))
|
|
| .inbounds[0].streamSettings.realitySettings.privateKey = $pk
|
|
| .inbounds[0].streamSettings.realitySettings.shortIds = [$sid]' ${template} > ${file}
|
|
'';
|
|
|
|
networking.firewall.allowedTCPPorts = [ 443 ];
|
|
} |