oqyude/nixos
1
0
Fork 0
mirror of https://github.com/oqyude/nixos.git synced 2026-10-07 20:47:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

vds: SNI-route TLS on 443 to Xray (15380→443) and 3x-ui panel (2049)

Browse Source 
nginx stream + ssl_preread reads the ClientHello SNI and forwards the
raw TCP stream (no TLS termination) to either:
  - 3x-ui panel on 127.0.0.1:2049 (SNI=pubray1.zeroq.su)
  - Xray on 127.0.0.1:15380 (SNI=pubrayx1.zeroq.su or default)

podman maps host:15380 → container:443 so Xray inside sees the client
on port 443 (matching its REALITY config) even though the host-side
port from podman's perspective is 15380. Host:2049 still maps to
container:2049 — 3x-ui now terminates TLS itself using the Let's
Encrypt cert mounted from /var/lib/acme/pubray1.zeroq.su/.

x-ui.db: webCertFile, webKeyFile and webDomain set so the panel
answers HTTPS on 2049. nginx no longer owns a server block on 443 —
only an ACME-only vhost for cert renewal.

REALITY inbound on container:443 still needs to be created via the
panel UI (the xrayTemplateConfig doesn't have it yet). The host-side
and routing plumbing is ready for it.
This commit is contained in:
oqyude
2026-08-28 00:36:54 +03:00
parent 0c2b45ea6f
commit 26e53e96bd
2 changed files with 69 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/vds/nginx.nix
+55 -20
View File
@@ -6,40 +6,75 @@
}:
let
server = "100.64.0.0";
# TCP-level SNI routing on 443:
# pubray1.zeroq.su → 3x-ui panel (TLS passthrough to 127.0.0.1:2049,
# 3x-ui terminates TLS using the cert mounted
# from /var/lib/acme/pubray1.zeroq.su/)
# pubrayx1.zeroq.su → Xray REALITY (TLS passthrough to 127.0.0.1:15380,
# which podman DNATs to container:443)
# default → Xray (any other SNI / IP-direct hits the REALITY
# fallback, which is what we want)
# nginx stream does not inspect TLS — the SNI is read from the ClientHello
# via ssl_preread, then the entire TCP stream (including the rest of the
# TLS handshake) is forwarded as-is to the chosen upstream. So Xray sees
# the client connect on its real configured port (443) even though the
# host-side port from podman's perspective is 15380.
streamConfig = ''
stream {
ssl_preread on;
map $ssl_preread_server_name $sni_backend {
default xray;
pubray1.zeroq.su panel;
pubrayx1.zeroq.su xray;
}
upstream panel {
server 127.0.0.1:2049;
}
upstream xray {
server 127.0.0.1:15380;
}
server {
listen 443;
proxy_pass $sni_backend;
proxy_timeout 600s;
proxy_connect_timeout 5s;
}
}
'';
in
{
users.users.nginx.extraGroups = [ "acme" ];
services = {
nginx = {
enable = true;
# No virtualHosts.<name>.locations for /, /subs/, /subsjs/, /clash/
# anymore — port 443 is now owned by the stream block, and the
# 3x-ui panel serves those paths itself once TLS is forwarded to it.
# Recommended HTTP options retained (still apply to the port-80
# ACME server block).
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = {
# ACME only — nginx owns no HTTP server on 443 anymore. The
# cert at /var/lib/acme/pubray1.zeroq.su/ is consumed by the
# 3x-ui container (mounted into /root/cert/) so it can do its
# own TLS termination on 2049. Don't add forceSSL here: that
# would generate an HTTPS server block on 443 that conflicts
# with the stream listener above.
"pubray1.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://localhost:2049";
proxyWebsockets = true;
};
"/subs/" = {
proxyPass = "http://localhost:2096";
proxyWebsockets = true;
};
"/subsjs/" = {
proxyPass = "http://localhost:2096";
proxyWebsockets = true;
};
"/clash/" = {
proxyPass = "http://localhost:2096";
proxyWebsockets = true;
};
};
};
};
# Top-level nginx.conf snippet — `stream {}` lives outside `http {}`,
# so it can't go through virtualHosts / appendHttpConfig. The NixOS
# nginx module exposes appendConfig for this.
appendConfig = streamConfig;
};
};
security.acme = {
@@ -52,4 +87,4 @@ in
80
443
];
}
}