mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-07 20:47:14 +03:00
big refactoring
This commit is contained in:
+115
-80
@@ -7,7 +7,11 @@
|
||||
}:
|
||||
let
|
||||
panel = "${xlib.dirs.services-nodes-folder}/${xlib.device.hostname}/3x-ui";
|
||||
certDomain = xlib.services."3x-ui".certDomain or null;
|
||||
# Domain whose Let's Encrypt cert (at /var/lib/acme/<domain>/) gets mounted
|
||||
# read-only into the 3x-ui container so the panel can terminate TLS itself.
|
||||
# Null when 3x-ui serves plain HTTP and TLS is terminated by an upstream
|
||||
# nginx.
|
||||
certDomain = config.host."3x-ui".certDomain;
|
||||
certMounts =
|
||||
if certDomain == null then
|
||||
[ ]
|
||||
@@ -28,94 +32,125 @@ let
|
||||
];
|
||||
# VDS-only: nginx stream forwards host:443 → 127.0.0.1:15380 →
|
||||
# container:443, so Xray sees its REALITY inbound on port 443.
|
||||
realityPorts = lib.optional xlib.services."3x-ui".reality443Forwarding "127.0.0.1:15380:443/tcp";
|
||||
realityPorts = lib.optional config.host."3x-ui".reality443Forwarding "127.0.0.1:15380:443/tcp";
|
||||
in
|
||||
{
|
||||
virtualisation = {
|
||||
podman = {
|
||||
enable = true;
|
||||
autoPrune = {
|
||||
options.host."3x-ui" = {
|
||||
# Domain whose LE cert should be mounted into the 3x-ui container at
|
||||
# /root/cert/fullchain.pem and key.pem. Set null if 3x-ui serves plain
|
||||
# HTTP and TLS is terminated by an upstream nginx.
|
||||
certDomain = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
example = "pubray1.zeroq.su";
|
||||
description = ''
|
||||
Domain whose LE cert should be mounted into the 3x-ui
|
||||
container at /root/cert/fullchain.pem and key.pem.
|
||||
'';
|
||||
};
|
||||
# Publish host:15380 → container:443. Only nodes that host an Xray
|
||||
# REALITY inbound on container:443 need this (so nginx stream can
|
||||
# forward TLS to Xray via 127.0.0.1:15380 while Xray itself sees
|
||||
# incoming connections on its configured port 443). Set false on nodes
|
||||
# that only run the 3x-ui panel.
|
||||
reality443Forwarding = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
When true, publish host:15380 → container:443 so Xray
|
||||
inside the container can serve REALITY on its real
|
||||
configured port 443 (nginx stream forwards 443 → 15380).
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
virtualisation = {
|
||||
podman = {
|
||||
enable = true;
|
||||
flags = [ "--all" ];
|
||||
};
|
||||
dockerCompat = true;
|
||||
};
|
||||
oci-containers = {
|
||||
backend = "podman";
|
||||
containers."3xui_app" = {
|
||||
image = "ghcr.io/mhsanaei/3x-ui:latest";
|
||||
environment = {
|
||||
"XRAY_VMESS_AEAD_FORCED" = "false";
|
||||
"XUI_ENABLE_FAIL2BAN" = "true";
|
||||
"TZ" = "Europe/Moscow";
|
||||
autoPrune = {
|
||||
enable = true;
|
||||
flags = [ "--all" ];
|
||||
};
|
||||
volumes = [
|
||||
"${panel}/cert/:/root/cert:rw"
|
||||
"${panel}/db/:/etc/x-ui:rw"
|
||||
]
|
||||
++ certMounts;
|
||||
log-driver = "journald";
|
||||
# Adding a new inbound through the 3x-ui panel on a port outside
|
||||
# the 14380-15379 range requires extending basePorts and rebuilding.
|
||||
ports = basePorts ++ realityPorts;
|
||||
dockerCompat = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
"podman-3xui_app" = {
|
||||
serviceConfig.Restart = lib.mkOverride 90 "always";
|
||||
partOf = [ "podman-compose-3x-ui-root.target" ];
|
||||
wantedBy = [ "podman-compose-3x-ui-root.target" ];
|
||||
};
|
||||
"podman-update-3xui_app" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
TimeoutSec = 300;
|
||||
oci-containers = {
|
||||
backend = "podman";
|
||||
containers."3xui_app" = {
|
||||
image = "ghcr.io/mhsanaei/3x-ui:latest";
|
||||
environment = {
|
||||
"XRAY_VMESS_AEAD_FORCED" = "false";
|
||||
"XUI_ENABLE_FAIL2BAN" = "true";
|
||||
"TZ" = "Europe/Moscow";
|
||||
};
|
||||
volumes = [
|
||||
"${panel}/cert/:/root/cert:rw"
|
||||
"${panel}/db/:/etc/x-ui:rw"
|
||||
]
|
||||
++ certMounts;
|
||||
log-driver = "journald";
|
||||
# Adding a new inbound through the 3x-ui panel on a port outside
|
||||
# the 14380-15379 range requires extending basePorts and rebuilding.
|
||||
ports = basePorts ++ realityPorts;
|
||||
};
|
||||
script = ''
|
||||
podman pull ghcr.io/mhsanaei/3x-ui:latest
|
||||
systemctl restart podman-3xui_app.service
|
||||
'';
|
||||
};
|
||||
};
|
||||
# Starts/stops together with all 3x-ui compose resources.
|
||||
targets."podman-compose-3x-ui-root" = {
|
||||
unitConfig.Description = "Root target generated by compose2nix.";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
# timers."podman-update-3xui_app" = {
|
||||
# wantedBy = [ "timers.target" ];
|
||||
# timerConfig = {
|
||||
# OnCalendar = "weekly";
|
||||
# Persistent = true;
|
||||
# };
|
||||
# };
|
||||
tmpfiles.rules = [
|
||||
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
|
||||
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-nodes-folder "0755" "root" "root")
|
||||
(xlib.helpers.mkTmpfile "d" "${xlib.dirs.services-nodes-folder}/${xlib.device.hostname}" "0755"
|
||||
"root"
|
||||
"root"
|
||||
)
|
||||
(xlib.helpers.mkTmpfile "d" panel "0755" "root" "root")
|
||||
(xlib.helpers.mkTmpfile "d" "${panel}/db" "0755" "root" "root")
|
||||
(xlib.helpers.mkTmpfile "d" "${panel}/cert" "0755" "root" "root")
|
||||
# Relabel panel dir for SELinux so containers can access it.
|
||||
(xlib.helpers.mkTmpfile "Z" panel "0755" "root" "root")
|
||||
];
|
||||
};
|
||||
|
||||
# Enable container name DNS for all Podman networks.
|
||||
networking.firewall = {
|
||||
interfaces =
|
||||
let
|
||||
matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
|
||||
in
|
||||
{
|
||||
"${matchAll}".allowedUDPPorts = [ 53 ];
|
||||
systemd = {
|
||||
services = {
|
||||
"podman-3xui_app" = {
|
||||
serviceConfig.Restart = lib.mkOverride 90 "always";
|
||||
partOf = [ "podman-compose-3x-ui-root.target" ];
|
||||
wantedBy = [ "podman-compose-3x-ui-root.target" ];
|
||||
};
|
||||
"podman-update-3xui_app" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
TimeoutSec = 300;
|
||||
};
|
||||
script = ''
|
||||
podman pull ghcr.io/mhsanaei/3x-ui:latest
|
||||
systemctl restart podman-3xui_app.service
|
||||
'';
|
||||
};
|
||||
};
|
||||
# Starts/stops together with all 3x-ui compose resources.
|
||||
targets."podman-compose-3x-ui-root" = {
|
||||
unitConfig.Description = "Root target generated by compose2nix.";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
# timers."podman-update-3xui_app" = {
|
||||
# wantedBy = [ "timers.target" ];
|
||||
# timerConfig = {
|
||||
# OnCalendar = "weekly";
|
||||
# Persistent = true;
|
||||
# };
|
||||
# };
|
||||
tmpfiles.rules = [
|
||||
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
|
||||
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-nodes-folder "0755" "root" "root")
|
||||
(xlib.helpers.mkTmpfile "d" "${xlib.dirs.services-nodes-folder}/${xlib.device.hostname}" "0755"
|
||||
"root"
|
||||
"root"
|
||||
)
|
||||
(xlib.helpers.mkTmpfile "d" panel "0755" "root" "root")
|
||||
(xlib.helpers.mkTmpfile "d" "${panel}/db" "0755" "root" "root")
|
||||
(xlib.helpers.mkTmpfile "d" "${panel}/cert" "0755" "root" "root")
|
||||
# Relabel panel dir for SELinux so containers can access it.
|
||||
(xlib.helpers.mkTmpfile "Z" panel "0755" "root" "root")
|
||||
];
|
||||
};
|
||||
|
||||
# Enable container name DNS for all Podman networks.
|
||||
networking.firewall = {
|
||||
interfaces =
|
||||
let
|
||||
matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
|
||||
in
|
||||
{
|
||||
"${matchAll}".allowedUDPPorts = [ 53 ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user