137 lines
2.6 KiB
Nix
137 lines
2.6 KiB
Nix
{ config, pkgs, secret, ... }:
|
|
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
./nginx.nix
|
|
./forgejo.nix
|
|
];
|
|
networking.hostName = "artemisia";
|
|
system.stateVersion = "25.05";
|
|
|
|
services.yggdrasil.settings.PrivateKey = secret.yggdrasil.PrivateKey;
|
|
services.yggdrasil.persistentKeys = false;
|
|
|
|
marzban = {
|
|
env = {
|
|
UVICORN_HOST = "artemisia.project-a.space";
|
|
UVICORN_PORT = secret.marzban.port;
|
|
SUDO_USERNAME = secret.marzban.sudo-username;
|
|
SUDO_PASSWORD = secret.marzban.sudo-password;
|
|
DOCS = true;
|
|
};
|
|
cert = true;
|
|
domain = "artemisia.project-a.space";
|
|
xray = {
|
|
log.loglevel = "warning";
|
|
dns = {
|
|
servers = [ "1.1.1.1" ];
|
|
queryStrategy = "UseIPv4";
|
|
};
|
|
routing = {
|
|
rules = [
|
|
{
|
|
ip = [ "geoip:private" ];
|
|
outboundTag = "BLOCK";
|
|
type = "field";
|
|
}
|
|
{
|
|
user = ["sayhex"];
|
|
outboundTag = "proxy";
|
|
type = "field";
|
|
}
|
|
];
|
|
};
|
|
inbounds = [
|
|
{
|
|
tag = "VLESS TCP REALITY";
|
|
listen = "0.0.0.0";
|
|
port = secret.marzban.vless-port;
|
|
protocol = "vless";
|
|
settings = {
|
|
clients = [];
|
|
decryption = "none";
|
|
};
|
|
streamSettings = {
|
|
network = "tcp";
|
|
tcpSettings = {};
|
|
security = "reality";
|
|
realitySettings = {
|
|
show = false;
|
|
dest = secret.marzban.dest;
|
|
xver = 0;
|
|
serverNames = secret.marzban.sni;
|
|
privateKey = secret.marzban.privateKey;
|
|
shortIds = [
|
|
secret.marzban.shortId
|
|
];
|
|
};
|
|
};
|
|
sniffing = {
|
|
enabled = true;
|
|
destOverride = [ "http" "tls" "quic" ];
|
|
};
|
|
}
|
|
{
|
|
tag = "VMESS WS NOTLS";
|
|
listen = "0.0.0.0";
|
|
port = 8080;
|
|
protocol = "vmess";
|
|
settings = {
|
|
clients = [];
|
|
decryption = "none";
|
|
};
|
|
streamSettings = {
|
|
network = "ws";
|
|
wsSettings = {
|
|
path = "/";
|
|
};
|
|
security = "none";
|
|
};
|
|
sniffing = {
|
|
enabled = true;
|
|
destOverride = [
|
|
"http"
|
|
"tls"
|
|
"quic"
|
|
];
|
|
};
|
|
}
|
|
];
|
|
outbounds = [
|
|
{
|
|
protocol = "freedom";
|
|
tag = "DIRECT";
|
|
}
|
|
{
|
|
protocol = "blackhole";
|
|
tag = "BLOCK";
|
|
}
|
|
{
|
|
protocol = "shadowsocks";
|
|
tag = "proxy";
|
|
settings = {
|
|
servers = [
|
|
{
|
|
address = "62.60.177.69";
|
|
port = 8443;
|
|
method = "aes-256-gcm";
|
|
password = "sosal?";
|
|
}
|
|
];
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
temurin-jre-bin-24
|
|
];
|
|
|
|
programs = {
|
|
nix-ld.enable = true;
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ secret.marzban.port 4001 8080 ];
|
|
}
|