Add selfhosted services

2026-06-30 04:26:40 +03:00
parent f212c874b5
commit 13e407847f
78 changed files with 2346 additions and 690 deletions
@@ -0,0 +1,58 @@
+{ pkgs }:
+let
+  configFiles = {
+    config = ''
+      FWTYPE=iptables
+
+      SET_MAXELEM=522288
+
+      IPSET_OPT="hashsize 262144 maxelem $SET_MAXELEM"
+
+      IP2NET_OPT4="--prefix-length=22-30 --v4-threshold=3/4"
+      IP2NET_OPT6="--prefix-length=56-64 --v6-threshold=5"
+
+      AUTOHOSTLIST_INCOMING_MAXSEQ=4096
+      AUTOHOSTLIST_RETRANS_MAXSEQ=32768
+      AUTOHOSTLIST_RETRANS_RESET=1
+      AUTOHOSTLIST_RETRANS_THRESHOLD=3
+      AUTOHOSTLIST_FAIL_THRESHOLD=3
+      AUTOHOSTLIST_FAIL_TIME=60
+      AUTOHOSTLIST_UDP_IN=1
+      AUTOHOSTLIST_UDP_OUT=4
+      AUTOHOSTLIST_DEBUGLOG=0
+
+      MDIG_THREADS=30
+
+      GZIP_LISTS=1
+
+      DESYNC_MARK=0x40000000
+      DESYNC_MARK_POSTNAT=0x20000000
+
+      NFQWS2_ENABLE=1
+      NFQWS2_PORTS_TCP=80,443
+      NFQWS2_PORTS_UDP=443
+      NFQWS2_TCP_PKT_OUT=20
+      NFQWS2_TCP_PKT_IN=10
+      NFQWS2_UDP_PKT_OUT=5
+      NFQWS2_UDP_PKT_IN=3
+      NFQWS2_OPT="
+      --filter-tcp=80 --filter-l7=http --payload http_req --lua-desync=tcpseg:pos=0,midsld:ip_id=rnd:repeats=1 --new
+      --filter-tcp=443 --filter-l7=tls --payload=tls_client_hello --hostlist-domains=x.com --lua-desync=hostfakesplit:nofake1:midhost=midsld:ip_ttl=6:repeats=1 --new
+      --filter-tcp=443 --filter-l7=tls --payload=tls_client_hello --lua-desync=tcpseg:pos=0,midsld:ip_id=rnd:repeats=1 --new
+      --filter-udp=443 --filter-l7=quic --payload=quic_initial --lua-desync=tcpseg:pos=0,midsld:ip_id=rnd:repeats=1
+      "
+
+      MODE_FILTER=none
+
+      FLOWOFFLOAD=donttouch
+
+      INIT_APPLY_FW=1
+
+      DISABLE_IPV6=1
+
+      FILTER_TTL_EXPIRED_ICMP=1
+    '';
+  };
+
+in
+pkgs.lib.mapAttrs (name: content: pkgs.writeText name content) configFiles
@@ -0,0 +1,67 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+let
+  common = config.selfhosted.common;
+  cfg = config.selfhosted.zapret2;
+in
+{
+  options.selfhosted.zapret2 = {
+    name = mkOption {
+      type = types.str;
+    };
+    socksPort = mkOption {
+      type = types.port;
+    };
+    ssPort = mkOption {
+      type = types.port;
+    };
+  };
+
+  config =
+    let
+      socksPort = "${toString cfg.socksPort}";
+      ssPort = "${toString cfg.ssPort}";
+      configFiles = import ./config.nix { inherit pkgs; };
+    in
+    {
+      virtualisation.oci-containers.containers.${cfg.name} = {
+        image = "vernette/ss-zapret2:latest";
+        volumes = [
+          "${configFiles.config}:/opt/zapret2/config"
+        ];
+        environment = {
+          SOCKS_PORT = socksPort;
+          SS_PORT = ssPort;
+          SS_PASSWORD = "test";
+          SS_ENCRYPT_METHOD = "chacha20-ietf-poly1305";
+          SS_TIMEOUT = "300";
+        };
+        ports = [
+          "127.0.0.1:${socksPort}:${socksPort}"
+          "127.0.0.1:${ssPort}:${ssPort}"
+        ];
+        extraOptions = [
+          "--cap-add=NET_ADMIN"
+          "--network=host"
+        ];
+      };
+
+      systemd.services."${common.backend}-${cfg.name}" = {
+        serviceConfig = {
+          Restart = lib.mkOverride 90 "always";
+        };
+        postStart = ''
+            mv /opt/zapret2/lua.dist /opt/zapret2/lua || true
+        '';
+        after = [ "${common.backend}-network-${common.network.name}.service" ];
+        requires = [ "${common.backend}-network-${common.network.name}.service" ];
+        partOf = [ "${common.backend}-${common.rootTarget.name}.target" ];
+        wantedBy = [ "${common.backend}-${common.rootTarget.name}.target" ];
+      };
+    };
+}