diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..301d47e --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +flake.lock diff --git a/secret.nix b/secret.nix index 7d03f6f..2c0a5d2 100644 --- a/secret.nix +++ b/secret.nix @@ -10,6 +10,7 @@ let privateKey = mkOption { type = types.str; default = ""; }; shortId = mkOption { type = types.str; default = ""; }; spiderX = mkOption { type = types.str; default = "/"; }; + sni = mkOption { type = types.str; default = "/"; }; }; affine-config = with lib; { env = { @@ -25,6 +26,7 @@ in { secret = { artemisia = { marzban = marzban-config; + yggdrasil.PrivateKey = mkOption { type = str; default = ""; }; }; mio = { marzban = marzban-config; @@ -38,8 +40,10 @@ in { common = { yggdrasil = { reine = mkOption { type = str; default = ""; }; + artemisia = mkOption { type = str; default = ""; }; + password = mkOption { type = str; default = ""; }; }; }; }; }; -} +} \ No newline at end of file diff --git a/servers/artemisia/main.nix b/servers/artemisia/main.nix index ed7ea97..7f8aa8d 100644 --- a/servers/artemisia/main.nix +++ b/servers/artemisia/main.nix @@ -9,7 +9,9 @@ networking.hostName = "artemisia"; system.stateVersion = "25.05"; - services.yggdrasil.persistentKeys = true; + services.yggdrasil.settings.PrivateKey = secret.yggdrasil.PrivateKey; + services.yggdrasil.persistentKeys = false; + marzban = { env = { UVICORN_HOST = "artemisia.project-a.space"; @@ -27,6 +29,7 @@ privateKey = secret.marzban.privateKey; shortId = secret.marzban.shortId; spiderX = secret.marzban.spiderX; + sni = secret.marzban.sni; }; }; diff --git a/servers/artemisia/nginx.nix b/servers/artemisia/nginx.nix index cacd924..54b652c 100644 --- a/servers/artemisia/nginx.nix +++ b/servers/artemisia/nginx.nix @@ -39,9 +39,9 @@ listen [::0]:443; proxy_pass $name; ssl_preread on; - proxy_connect_timeout 1s; + proxy_connect_timeout 30s; proxy_timeout 1h; - proxy_buffer_size 16k; + proxy_buffer_size 64k; } ''; }; diff --git a/servers/common/xray.nix b/servers/common/xray.nix index 999cf5f..f3940fc 100644 --- a/servers/common/xray.nix +++ b/servers/common/xray.nix @@ -1,4 +1,4 @@ -{ server-domain, port, dest, privateKey, shortId, spiderX }: +{ server-domain, port, dest, privateKey, shortId, spiderX, sni }: { log.loglevel = "warning"; @@ -34,7 +34,7 @@ dest = dest; xver = 0; serverNames = [ - server-domain + sni ]; privateKey = privateKey; SpiderX = spiderX; diff --git a/servers/common/yggdrasil.nix b/servers/common/yggdrasil.nix index f16f76a..d7d1fe9 100644 --- a/servers/common/yggdrasil.nix +++ b/servers/common/yggdrasil.nix @@ -5,8 +5,7 @@ enable = true; settings = { Peers = [ - "tls://kuber.project-a.space:666" - "tls://arti.project-a.space:666" + "tls://artemisia.project-a.space:666" "tls://reine.project-a.space:666" ]; Listen = [ diff --git a/servers/mio/main.nix b/servers/mio/main.nix index 34c4659..684b0d7 100644 --- a/servers/mio/main.nix +++ b/servers/mio/main.nix @@ -42,6 +42,7 @@ privateKey = secret.marzban.privateKey; shortId = secret.marzban.shortId; spiderX = secret.marzban.spiderX; + sni = secret.marzban.sni; }; }; diff --git a/servers/mio/nginx.nix b/servers/mio/nginx.nix index 2b272dd..1ca9108 100644 --- a/servers/mio/nginx.nix +++ b/servers/mio/nginx.nix @@ -28,9 +28,9 @@ listen [::0]:443; proxy_pass $name; ssl_preread on; - proxy_connect_timeout 1s; + proxy_connect_timeout 30s; proxy_timeout 1h; - proxy_buffer_size 16k; + proxy_buffer_size 64k; } ''; }; diff --git a/servers/reine/main.nix b/servers/reine/main.nix index 5b7be0c..51c9b47 100644 --- a/servers/reine/main.nix +++ b/servers/reine/main.nix @@ -11,5 +11,14 @@ services.yggdrasil.settings.PrivateKey = secret.yggdrasil.PrivateKey; services.yggdrasil.persistentKeys = false; hardware.amdgpu.opencl.enable = true; + hardware.graphics.extraPackages = with pkgs; [ rocmPackages.clr.icd ]; + systemd.tmpfiles.rules = [ + "L+ /opt/rocm/hip - - - - ${pkgs.rocmPackages.clr}" + ]; + hardware.graphics.enable = true; + hardware.graphics.enable32Bit = true; + hardware.amdgpu.overdrive.enable = true; + hardware.amdgpu.overdrive.ppfeaturemask = "0xffffffff"; + environment.systemPackages = with pkgs; [ clinfo mesa.opencl ]; system.stateVersion = "25.05"; } diff --git a/servers/vanessa/main.nix b/servers/vanessa/main.nix index a5d9334..b1ed2dc 100644 --- a/servers/vanessa/main.nix +++ b/servers/vanessa/main.nix @@ -24,6 +24,7 @@ privateKey = secret.marzban.privateKey; shortId = secret.marzban.shortId; spiderX = secret.marzban.spiderX; + sni = secret.marzban.sni; }; }; diff --git a/servers/vanessa/nginx.nix b/servers/vanessa/nginx.nix index 2b272dd..7a29989 100644 --- a/servers/vanessa/nginx.nix +++ b/servers/vanessa/nginx.nix @@ -15,10 +15,6 @@ default marzban; } - upstream git { - server 127.0.0.1:444; - } - upstream marzban { server 127.0.0.1:1080; } @@ -28,7 +24,7 @@ listen [::0]:443; proxy_pass $name; ssl_preread on; - proxy_connect_timeout 1s; + proxy_connect_timeout 30s; proxy_timeout 1h; proxy_buffer_size 16k; }