oqyude/nixos
1
0
Fork 0
mirror of https://github.com/oqyude/nixos.git synced 2026-10-07 20:47:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

dop fix

Browse Source
This commit is contained in:
oqyude
2026-09-17 02:03:25 +03:00
parent 5f1496e980
commit c87ba277c4
3 changed files with 56 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/server/nginx.nix
+47 -21
View File
@@ -12,17 +12,19 @@
# so all existing services behave exactly as before.
#
# Routing:
# x.zeroq.su → 127.0.0.1:2049 (3x-ui controller panel; TLS is
# terminated inside the container by the mounted LE
# cert, exactly like pubray1.zeroq.su on the VDS)
# immich/git/... → 127.0.0.1:8443 (nginx's own http {} listener:
# TLS termination + proxyPass unchanged)
# x.zeroq.su → 127.0.0.1:8443 (nginx's own https listener:
# TLS terminated by nginx, then path-routed:
# "/" → panel web server 2049, "/subs/…" etc →
# panel subscription server 2096, so subscription
# links can be plain https://x.zeroq.su/subs/<uuid>)
# immich/git/... → 127.0.0.1:8443 (nginx's own http {} listener)
# default → 127.0.0.1:15380 (Xray REALITY; podman DNATs
# host:15380 → container:443 so Xray sees its real
# configured port 443)
#
# ssl_preread reads SNI from the ClientHello; every SNI matching a known
# vhost goes to the internal web listener, x.zeroq.su goes to the panel,
# vhost goes to the internal web listener, x.zeroq.su goes to the panel
# (via the web listener so nginx can split /subs/ off the panel paths),
# and anything else (REALITY fronting domains, direct-IP) goes to Xray.
let
server = "192.168.1.20";
@@ -127,22 +129,19 @@ let
];
# Goes inside the auto-generated `stream {}` block (services.nginx.streamConfig).
# x.zeroq.su → 3x-ui panel; known vhosts → nginx's own https listener;
# everything else (any SNI a REALITY client uses, e.g.
# media.mediavitrina.ru, or direct-IP) → Xray.
# x.zeroq.su → nginx's own https listener (8443), where nginx path-routes
# /subs/... → panel subscription server 2096 and / → panel web 2049;
# known vhosts → web listener; everything else (any SNI a REALITY client
# uses, e.g. media.mediavitrina.ru, or direct-IP) → Xray.
streamConfig = ''
ssl_preread on;
map $ssl_preread_server_name $sni_backend {
default xray;
${panelDomain} panel;
${panelDomain} web;
${"\n" + lib.concatMapStringsSep "\n" (d: " ${d} web;") (extraWebDomains ++ (map (s: s.domain) sites))}
}
upstream panel {
server 127.0.0.1:2049;
}
upstream web {
server 127.0.0.1:8443;
}
@@ -216,14 +215,41 @@ in
extraConfig = bigUploads;
};
"x.zeroq.su" = {
# ACME only — no https listener here: 443 is owned by the stream
# block, which routes the x.zeroq.su SNI to the panel inside the
# container (127.0.0.1:2049). 3x-ui terminates TLS itself using
# the cert this vhost renews (mounted at /root/cert/), and serves
# /subs/, /subsjs/, /clash/ straight from the panel, like the VDS.
# Don't add forceSSL: it would generate an HTTPS server block that
# conflicts with the stream listener.
# Panel domain. TLS is terminated HERE by nginx (stream routes this
# SNI to the web listener), and paths are split:
# /subs/, /subsjs/, /clash/, /sub/ → panel subscription server
# (127.0.0.1:2096, TLS inside the container) so links like
# https://x.zeroq.su/subs/<uuid> work without :2096;
# everything else → panel web server
# (127.0.0.1:2049, TLS inside the container).
# The panel serves both on TLS with the mounted LE cert.
enableACME = true;
forceSSL = true;
listen = webListen;
locations = {
"/subs/" = {
proxyPass = "https://127.0.0.1:2096";
proxyWebsockets = true;
extraConfig = "proxy_ssl_verify off;";
};
"/subsjs/" = {
proxyPass = "https://127.0.0.1:2096";
extraConfig = "proxy_ssl_verify off;";
};
"/clash/" = {
proxyPass = "https://127.0.0.1:2096";
extraConfig = "proxy_ssl_verify off;";
};
"/sub/" = {
proxyPass = "https://127.0.0.1:2096";
extraConfig = "proxy_ssl_verify off;";
};
"/" = {
proxyPass = "https://127.0.0.1:2049";
proxyWebsockets = true;
extraConfig = "proxy_ssl_verify off;";
};
};
};
"zeroq.su" = {
forceSSL = true;