1{lib, ...}: {
  2  den.aspects.services.xray = {
  3    settings.host = {
  4      realitySiteFileAged = lib.mkOption {
  5        type = lib.types.path;
  6      };
  7      port = lib.mkOption {
  8        type = lib.types.port;
  9        default = 7890;
 10      };
 11      uuidFileAged = lib.mkOption {
 12        type = lib.types.path;
 13      };
 14      privateKeyFileAged = lib.mkOption {
 15        type = lib.types.path;
 16      };
 17      pubKeyFileAged = lib.mkOption {
 18        type = lib.types.path;
 19      };
 20    };
 21
 22    nixos = {
 23      host,
 24      config,
 25      ...
 26    }: let
 27      cfg = host.settings.services.xray;
 28    in {
 29      imports = [./_module.nix];
 30
 31      vaultix.secrets = {
 32        xray-uuid.file = cfg.uuidFileAged;
 33        xray-private-key.file = cfg.privateKeyFileAged;
 34        xray-reality-site.file = cfg.realitySiteFileAged;
 35      };
 36
 37      vaultix.templates.xray-reality-target = {
 38        content = "${config.vaultix.placeholder.xray-reality-site}:443";
 39        owner = "root";
 40        group = "root";
 41        mode = "0400";
 42      };
 43
 44      services.xray = {
 45        enable = true;
 46        settings = {
 47          log.loglevel = "warning";
 48          routing = {
 49            rules = [
 50              {
 51                type = "field";
 52                protocol = ["bittorrent"];
 53                outboundTag = "block";
 54              }
 55              {
 56                type = "field";
 57                ip = ["geoip:private"];
 58                outboundTag = "block";
 59              }
 60            ];
 61          };
 62          inbounds = [
 63            {
 64              listen = "127.0.0.1";
 65              port = cfg.port;
 66              protocol = "vless";
 67              sniffing = {
 68                enabled = true;
 69                destOverride = ["http" "tls" "quic"];
 70              };
 71              settings = {
 72                clients = [
 73                  {
 74                    id = {
 75                      _secret = config.vaultix.secrets.xray-uuid.path;
 76                    };
 77                    flow = "xtls-rprx-vision";
 78                  }
 79                ];
 80                decryption = "none";
 81              };
 82              streamSettings = {
 83                network = "raw";
 84                security = "reality";
 85                realitySettings = {
 86                  target = {
 87                    _secret = config.vaultix.templates.xray-reality-target.path;
 88                  };
 89                  serverNames = [
 90                    {
 91                      _secret = config.vaultix.secrets.xray-reality-site.path;
 92                    }
 93                  ];
 94                  privateKey = {
 95                    _secret = config.vaultix.secrets.xray-private-key.path;
 96                  };
 97                  shortIds = [""];
 98                };
 99              };
100            }
101          ];
102          outbounds = [
103            {
104              tag = "direct";
105              protocol = "freedom";
106            }
107            {
108              tag = "block";
109              protocol = "blackhole";
110            }
111          ];
112        };
113      };
114    };
115  };
116}