xray and nginx improvements

.gitignore

@@ -0,0 +1 @@
+flake.lock

secret.nix

@@ -10,6 +10,7 @@ let
 		privateKey = mkOption { type = types.str; default = ""; };
 		shortId = mkOption { type = types.str; default = ""; };
 		spiderX = mkOption { type = types.str; default = "/"; };
+		sni = mkOption { type = types.str; default = "/"; };
 	};
 	affine-config =  with lib; {
 		env = {
@@ -25,6 +26,7 @@ in {
 		secret = {
 			artemisia = {
 				marzban = marzban-config;
+				yggdrasil.PrivateKey = mkOption { type = str; default = ""; };
 			};
 			mio = {
 				marzban = marzban-config;
@@ -38,8 +40,10 @@ in {
 			common = {
 				yggdrasil = {
 					reine = mkOption { type = str; default = ""; };
+					artemisia = mkOption { type = str; default = ""; };
+					password = mkOption { type = str; default = ""; };
 				};
 			};
 		};
 	};
-}
+}

servers/artemisia/main.nix

@@ -9,7 +9,9 @@
 	networking.hostName = "artemisia";
 	system.stateVersion = "25.05";
 
-	services.yggdrasil.persistentKeys = true;
+	services.yggdrasil.settings.PrivateKey = secret.yggdrasil.PrivateKey;
+	services.yggdrasil.persistentKeys = false;
+	
 	marzban = {
 		env = {
 			UVICORN_HOST = "artemisia.project-a.space";
@@ -27,6 +29,7 @@
 			privateKey = secret.marzban.privateKey;
 			shortId = secret.marzban.shortId;
 			spiderX = secret.marzban.spiderX;
+			sni = secret.marzban.sni;
 		};
 	};
 

servers/artemisia/nginx.nix

@@ -39,9 +39,9 @@
 				listen [::0]:443;
 				proxy_pass $name;
 				ssl_preread on;
-				proxy_connect_timeout 1s;
+				proxy_connect_timeout 30s;
 				proxy_timeout 1h;
-				proxy_buffer_size 16k;
+				proxy_buffer_size 64k;
 			}
 		'';
 	};

servers/common/xray.nix

@@ -1,4 +1,4 @@
-{ server-domain, port, dest, privateKey, shortId, spiderX }:
+{ server-domain, port, dest, privateKey, shortId, spiderX, sni }:
 
 {
 	log.loglevel = "warning";
@@ -34,7 +34,7 @@
 					dest = dest;
 					xver = 0;
 					serverNames = [
-						server-domain
+						sni
 					];
 					privateKey = privateKey;
 					SpiderX = spiderX;

servers/common/yggdrasil.nix

@@ -5,8 +5,7 @@
 		enable = true;
 		settings = {
 			Peers = [
-				"tls://kuber.project-a.space:666"
-				"tls://arti.project-a.space:666"
+				"tls://artemisia.project-a.space:666"
 				"tls://reine.project-a.space:666"
 			];
 			Listen = [

servers/mio/main.nix

@@ -42,6 +42,7 @@
 			privateKey = secret.marzban.privateKey;
 			shortId = secret.marzban.shortId;
 			spiderX = secret.marzban.spiderX;
+			sni = secret.marzban.sni;
 		};
 	};
 

servers/mio/nginx.nix

@@ -28,9 +28,9 @@
 				listen [::0]:443;
 				proxy_pass $name;
 				ssl_preread on;
-				proxy_connect_timeout 1s;
+				proxy_connect_timeout 30s;
 				proxy_timeout 1h;
-				proxy_buffer_size 16k;
+				proxy_buffer_size 64k;
 			}
 		'';
 	};

servers/reine/main.nix

@@ -11,5 +11,14 @@
 	services.yggdrasil.settings.PrivateKey = secret.yggdrasil.PrivateKey;
 	services.yggdrasil.persistentKeys = false;
 	hardware.amdgpu.opencl.enable = true;
+	hardware.graphics.extraPackages = with pkgs; [ rocmPackages.clr.icd ];
+	systemd.tmpfiles.rules = [
+		"L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}"
+    ];
+	hardware.graphics.enable = true;
+	hardware.graphics.enable32Bit = true;
+	hardware.amdgpu.overdrive.enable = true;
+	hardware.amdgpu.overdrive.ppfeaturemask = "0xffffffff";
+	environment.systemPackages = with pkgs; [ clinfo mesa.opencl ];
 	system.stateVersion = "25.05";
 }

servers/vanessa/main.nix

@@ -24,6 +24,7 @@
 			privateKey = secret.marzban.privateKey;
 			shortId = secret.marzban.shortId;
 			spiderX = secret.marzban.spiderX;
+			sni = secret.marzban.sni;
 		};
 	};
 

servers/vanessa/nginx.nix

@@ -15,10 +15,6 @@
 				default                marzban;
 			}
 
-			upstream git {
-				server 127.0.0.1:444;
-			}
-
 			upstream marzban {
 				server 127.0.0.1:1080;
 			}
@@ -28,7 +24,7 @@
 				listen [::0]:443;
 				proxy_pass $name;
 				ssl_preread on;
-				proxy_connect_timeout 1s;
+				proxy_connect_timeout 30s;
 				proxy_timeout 1h;
 				proxy_buffer_size 16k;
 			}