Commit 84401b5
Changed files (10)
modules
hosts
kevin
tribios
services
modules/hosts/kevin/networking.nix
@@ -13,6 +13,7 @@
den.aspects.kevin = {
includes = [
den.aspects.services.proxy.mihomo
+ den.aspects.services.proxy.mihomo.tun
];
nixos = {
modules/hosts/tribios/networking.nix
@@ -17,6 +17,7 @@
den.aspects.tribios = {
includes = [
den.aspects.services.proxy.mihomo
+ den.aspects.services.proxy.mihomo.tun
];
nixos = {
modules/services/proxy/mihomo/default.nix
@@ -20,6 +20,24 @@
default = [];
};
};
+ ports = {
+ controller = lib.mkOption {
+ type = lib.types.port;
+ default = 7900;
+ };
+ dns = lib.mkOption {
+ type = lib.types.port;
+ default = 1053;
+ };
+ mixed = lib.mkOption {
+ type = lib.types.port;
+ default = 7890;
+ };
+ tproxy = lib.mkOption {
+ type = lib.types.port;
+ default = 7894;
+ };
+ };
};
includes = with den.aspects.services.proxy.mihomo; [
@@ -28,7 +46,6 @@
proxy-groups
rules
sniffer
- tun
];
cache = {
@@ -53,13 +70,15 @@
services.mihomo = {
enable = true;
webui = pkgs.metacubexd;
- processesInfo = true;
+ processesInfo = lib.mkDefault true;
config = {
- mixed-port = 7890;
+ mixed-port = cfg.ports.mixed;
mode = "rule";
ipv6 = false;
- find-process-mode = "strict";
+ find-process-mode = lib.mkDefault "strict";
+ allow-lan = lib.mkDefault true;
+ bind-address = lib.mkDefault "*";
log-level = "warning";
interface-name = cfg.interfaces.wan;
unified-delay = true;
@@ -73,7 +92,7 @@
if cfg.tailscaleWebControl
then host.address.ipv4.tailscale
else "127.0.0.1"
- }:7900";
+ }:${toString cfg.ports.controller}";
external-controller-cors = {
allow-origins = ["*"];
allow-private-network = true;
modules/services/proxy/mihomo/dns.nix
@@ -1,16 +1,49 @@
{
den.aspects.services.proxy.mihomo.dns = {
- nixos = {
+ nixos = {host, ...}: let
+ cfg = host.settings.services.proxy.mihomo;
+ in {
services.mihomo = {
config = {
+ hosts = {
+ "dns.alidns.com" = ["223.5.5.5" "223.6.6.6" "2400:3200::1" "2400:3200:baba::1"];
+ "doh.pub" = ["1.12.12.12" "1.12.12.21" "120.53.53.53"];
+ "dns.google" = ["8.8.8.8" "8.8.4.4" "2001:4860:4860::8888" "2001:4860:4860::8844"];
+ "cloudflare-dns.com" = ["1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001"];
+ };
dns = {
enable = true;
- listen = ":1053";
+ listen = ":${toString cfg.ports.dns}";
prefer-h3 = false;
ipv6 = false;
enhanced-mode = "redir-host";
- force-dns-mapping = true;
respect-rules = true;
+ nameserver = [
+ "https://dns.google/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ "https://cloudflare-dns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ ];
+ proxy-server-nameserver = [
+ "https://dns.alidns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ "https://doh.pub/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ ];
+ direct-nameserver = [
+ "https://dns.alidns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ "https://doh.pub/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ ];
+ nameserver-policy = {
+ # Tailscale
+ "+.net.trin.one" = "100.100.100.100";
+ ".ts.net" = "100.100.100.100";
+
+ "geosite:cn,private" = [
+ "https://dns.alidns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ "https://doh.pub/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ ];
+ "geosite:geolocation-!cn" = [
+ "https://dns.google/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ "https://cloudflare-dns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
+ ];
+ };
fake-ip-range = "198.18.0.1/16";
fake-ip-filter-mode = "blacklist";
fake-ip-filter = [
@@ -35,29 +68,6 @@
"*.nip.io"
"gate.trin.one"
];
- nameserver = [
- "https://8.8.8.8/dns-query"
- "https://1.1.1.1/dns-query"
- ];
- nameserver-policy = {
- # Tailscale
- "+.net.trin.one" = "100.100.100.100";
- ".ts.net" = "100.100.100.100";
- "*" = "100.100.100.100"; # MagicDNS for machine name
-
- "geosite:cn,private" = [
- "https://223.5.5.5/dns-query"
- "https://119.29.29.29/dns-query"
- ];
- };
- proxy-server-nameserver = [
- "https://223.5.5.5/dns-query"
- "https://119.29.29.29/dns-query"
- ];
- direct-nameserver = [
- "https://223.5.5.5/dns-query"
- "https://223.6.6.6/dns-query"
- ];
};
};
};
modules/services/proxy/mihomo/proxies.nix
@@ -9,7 +9,7 @@
interval = 86400;
health-check = {
enable = true;
- url = "http://cp.cloudflare.com";
+ url = "https://cp.cloudflare.com";
interval = 300;
};
};
modules/services/proxy/mihomo/proxy-groups.nix
@@ -20,14 +20,14 @@
select = {
type = "select";
- url = "http://connectivitycheck.platform.hicloud.com/generate_204";
+ url = "https://connectivitycheck.platform.hicloud.com/generate_204";
disable-udp = false;
hidden = false;
include-all = true;
};
urlTest = {
type = "url-test";
- url = "http://connectivitycheck.platform.hicloud.com/generate_204";
+ url = "https://connectivitycheck.platform.hicloud.com/generate_204";
interval = 300;
tolerance = 50;
disable-udp = false;
modules/services/proxy/mihomo/rules.nix
@@ -1,6 +1,55 @@
{
+ den,
+ lib,
+ ...
+}: {
den.aspects.services.proxy.mihomo.rules = {
nixos = {
+ host,
+ config,
+ ...
+ }: let
+ allHosts = builtins.concatMap builtins.attrValues (builtins.attrValues den.hosts);
+ otherHosts = builtins.filter (h: h.name != host.name) allHosts;
+
+ hostsWithIpv4ClearText = builtins.filter (h: h.address.ipv4.clearText != null) otherHosts;
+ hostsWithIpv4Secret = builtins.filter (h: h.address.ipv4.secret.name != null && h.address.ipv4.secret.file != null) otherHosts;
+ hostsWithIpv6ClearText = builtins.filter (h: h.address.ipv6.clearText != null) otherHosts;
+ hostsWithIpv6Secret = builtins.filter (h: h.address.ipv6.secret.name != null && h.address.ipv6.secret.file != null) otherHosts;
+
+ mkMihomoIpRule = ip: "IP-CIDR,${ip}/32";
+
+ clearTextIps =
+ (map (h: mkMihomoIpRule h.address.ipv4.clearText) hostsWithIpv4ClearText)
+ ++ (map (h: mkMihomoIpRule h.address.ipv6.clearText) hostsWithIpv6ClearText);
+
+ secretIps =
+ (map (h: {_secret = config.vaultix.templates."mihomo-rules-${h.address.ipv4.secret.name}".path;}) hostsWithIpv4Secret)
+ ++ (map (h: {_secret = config.vaultix.templates."mihomo-rules-${h.address.ipv6.secret.name}".path;}) hostsWithIpv6Secret);
+
+ allHostIps = clearTextIps ++ secretIps;
+ in {
+ vaultix = {
+ secrets = lib.mkMerge (
+ (map (h: {${h.address.ipv4.secret.name}.file = h.address.ipv4.secret.file;}) hostsWithIpv4Secret)
+ ++ (map (h: {${h.address.ipv6.secret.name}.file = h.address.ipv6.secret.file;}) hostsWithIpv6Secret)
+ );
+ templates =
+ lib.mergeAttrsList
+ ((map (h: let
+ name = h.address.ipv4.secret.name;
+ in {
+ "mihomo-rules-${name}".content = mkMihomoIpRule config.vaultix.placeholder.${name};
+ })
+ hostsWithIpv4Secret)
+ ++ (map (h: let
+ name = h.address.ipv6.secret.name;
+ in {
+ "mihomo-rules-${name}".content = mkMihomoIpRule config.vaultix.placeholder.${name};
+ })
+ hostsWithIpv6Secret));
+ };
+
services.mihomo = {
config = {
rules = [
@@ -13,6 +62,18 @@
"RULE-SET,tailscale_non_ip,DIRECT"
"RULE-SET,lan_non_ip,DIRECT"
+ # Game
+ "DOMAIN-SUFFIX,cm.steampowered.com,DIRECT"
+ "DOMAIN-SUFFIX,steamserver.net,DIRECT"
+ "GEOSITE,steam@cn,DIRECT"
+ "GEOSITE,category-game-platforms-download@cn,DIRECT"
+
+ # Should DIRECT sites
+ "DOMAIN-SUFFIX,codeberg.org,DIRECT" # For SSH
+ "DOMAIN-SUFFIX,kagi.com,DIRECT" # DIRECT is faster
+ "DOMAIN-SUFFIX,mxrouting.net,DIRECT" # For mail ports
+
+ # Common
"RULE-SET,cdn_domainset,SELECT"
"RULE-SET,cdn_non_ip,SELECT"
"RULE-SET,stream_non_ip,🇺🇸 - AUTO"
@@ -29,19 +90,9 @@
"RULE-SET,domestic_non_ip,DIRECT"
"RULE-SET,direct_non_ip,DIRECT"
- # Game
- "DOMAIN-SUFFIX,cm.steampowered.com,DIRECT"
- "DOMAIN-SUFFIX,steamserver.net,DIRECT"
- "GEOSITE,steam@cn,DIRECT"
- "GEOSITE,category-game-platforms-download@cn,DIRECT"
- "GEOSITE,category-games-cn,DIRECT"
-
- "DOMAIN-SUFFIX,codeberg.org,DIRECT"
- "DOMAIN-SUFFIX,kagi.com,DIRECT"
- "DOMAIN-SUFFIX,mxrouting.net,DIRECT"
-
# === IP ===
"RULE-SET,reject_ip,REJECT"
+ "RULE-SET,my_hosts,DIRECT"
"RULE-SET,telegram_ip,🇺🇸 - AUTO"
"RULE-SET,stream_ip,🇺🇸 - AUTO"
"RULE-SET,lan_ip,DIRECT"
@@ -73,6 +124,11 @@
proxy = "SELECT";
};
in {
+ my_hosts = {
+ type = "inline";
+ behavior = "classical";
+ payload = allHostIps;
+ };
tailscale_non_ip = {
type = "inline";
behavior = "classical";
@@ -82,6 +138,8 @@
"PROCESS-NAME,.tailscaled-wrapped"
"DOMAIN-SUFFIX,ts.net"
"DOMAIN-SUFFIX,net.trin.one"
+ "DOMAIN,controlplane.tailscale.com"
+ "DOMAIN,gate.trin.one"
];
};
reject_non_ip_no_drop =
modules/services/proxy/mihomo/tun.nix
@@ -24,7 +24,14 @@
strict-route = true;
mtu = 1500;
include-interface = ["lo"] ++ [cfg.interfaces.wan] ++ cfg.interfaces.lan;
- route-exclude-address = ["100.64.0.0/10" "fd7a:115c:a1e0::/48"]; # Tailscale
+ route-exclude-address = [
+ "192.168.0.0/16"
+ "10.0.0.0/8"
+ "172.16.0.0/12"
+ # Tailscale
+ "100.64.0.0/10"
+ "fd7a:115c:a1e0::/48"
+ ];
};
};
};
secrets/cache/kevin/83789c335fcee710e5c0b18a5aa7f4d7436a2e51386ba57115e0ea0791e53efd
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 WM7kiQ zhESK3nfv2P/PgkX4ZEouWZzwQhfpvI7syXcWBTpkBU
+UN1nAh5nsD/aKR0iomORhbWmy3iqZQphe3V2WV9diuw
+-> *-grease .Z*9%\| 7
+7tnXbq5GvfNYfXVkUybbypKZM+KZWGiOKgv2YIQ/3xlBQjeaTQ9BqA
+--- WafXcGQnpStKzB36i/3Eg1n93Ia7QmOnTJtYmltu2V8
+i�!V����biˈ�ٻ*�n��^�(� ��2U}���ά1;uޚ�
\ No newline at end of file
secrets/cache/tribios/933dc774c4b9926ee79cc113303524f3872b2da03f5572ffb2dc6e2d900102fe
Binary file