1{
 2  den.aspects.services.caddy.reality = {
 3    nixos = {
 4      host,
 5      config,
 6      ...
 7    }: let
 8      xrayCfg = host.settings.services.xray;
 9    in {
10      boot.kernel.sysctl = {
11        "net.ipv4.tcp_congestion_control" = "bbr";
12      };
13
14      vaultix.secrets.reality-site.file = xrayCfg.realitySiteFileAged;
15
16      vaultix.templates.caddy-reality = {
17        content = ''
18          :${toString config.services.caddy.httpsPort} {
19            @reality tls sni ${config.vaultix.placeholder.reality-site}
20            route @reality {
21              proxy {
22                upstream 127.0.0.1:${toString xrayCfg.port}
23              }
24            }
25            route {
26              proxy {
27                upstream 127.0.0.1:${toString config.services.caddy.httpsPort}
28              }
29            }
30          }
31        '';
32        owner = config.services.caddy.user;
33        group = config.services.caddy.group;
34        mode = "0400";
35      };
36
37      services.caddy.globalConfig = ''
38        default_bind 127.0.0.1
39        layer4 {
40          :${toString config.services.caddy.httpPort} {
41            route {
42              proxy {
43                upstream 127.0.0.1:${toString config.services.caddy.httpPort}
44              }
45            }
46          }
47          import ${config.vaultix.templates.caddy-reality.path}
48        }
49      '';
50    };
51  };
52}