oqyude/nixos
1
0
Fork 0
mirror of https://github.com/oqyude/nixos.git synced 2026-10-07 20:47:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

refactoring

Browse Source
This commit is contained in:
oqyude
2026-08-29 04:05:38 +03:00
parent 7f5ea81f37
commit e1d276097d
3 changed files with 203 additions and 455 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/vds/nginx.nix
+50 -70
View File
@@ -4,92 +4,72 @@
pkgs,
...
}:
# VDS nginx differs from server's in one key way: port 443 is owned
# by an nginx stream block that does SNI-based TCP routing, not by
# http { server {} } blocks. This lets a single host (pubray1.zeroq.su)
# serve both the 3x-ui panel and an Xray REALITY inbound over TLS,
# sharing the same port.
#
# Routing:
# pubray1.zeroq.su → 127.0.0.1:2049 (3x-ui panel; LE cert mounted
# into the container terminates TLS)
# pubrayx1.zeroq.su → 127.0.0.1:15380 (Xray REALITY; Xray sees its
# real configured port 443 via DNAT)
# default → 127.0.0.1:15380 (REALITY fallback for any
# other SNI / IP-direct)
#
# ssl_preread reads SNI from the ClientHello and forwards the rest of
# the TLS stream as-is, so Xray sees a real port-443 connection even
# though podman DNATs it via host:15380.
let
server = "100.64.0.0";
# TCP-level SNI routing on 443:
# pubray1.zeroq.su → 3x-ui panel (TLS passthrough to 127.0.0.1:2049,
# 3x-ui terminates TLS using the cert mounted
# from /var/lib/acme/pubray1.zeroq.su/)
# pubrayx1.zeroq.su → Xray REALITY (TLS passthrough to 127.0.0.1:15380,
# which podman DNATs to container:443)
# default → Xray (any other SNI / IP-direct hits the REALITY
# fallback, which is what we want)
# nginx stream does not inspect TLS — the SNI is read from the ClientHello
# via ssl_preread, then the entire TCP stream (including the rest of the
# TLS handshake) is forwarded as-is to the chosen upstream. So Xray sees
# the client connect on its real configured port (443) even though the
# host-side port from podman's perspective is 15380.
# Goes inside the auto-generated `stream {}` block (services.nginx.streamConfig).
# pubray1.zeroq.su → 3x-ui panel; everything else (including any SNI
# a REALITY client uses, e.g. media.mediavitrina.ru) → Xray.
streamConfig = ''
stream {
ssl_preread on;
ssl_preread on;
# pubray1.zeroq.su SNI → 3x-ui panel (TLS terminated inside the
# container using the LE cert mounted from /var/lib/acme/).
# Everything else (including any sni the REALITY client uses,
# e.g. media.mediavitrina.ru) → Xray. So a single domain
# pubray1.zeroq.su serves both panel and Xray — the SNI in the
# TLS ClientHello disambiguates.
map $ssl_preread_server_name $sni_backend {
default xray;
pubray1.zeroq.su panel;
}
map $ssl_preread_server_name $sni_backend {
default xray;
pubray1.zeroq.su panel;
}
upstream panel {
server 127.0.0.1:2049;
}
upstream panel {
server 127.0.0.1:2049;
}
upstream xray {
server 127.0.0.1:15380;
}
upstream xray {
server 127.0.0.1:15380;
}
server {
listen 443;
proxy_pass $sni_backend;
proxy_timeout 600s;
proxy_connect_timeout 5s;
}
server {
listen 443;
proxy_pass $sni_backend;
proxy_timeout 600s;
proxy_connect_timeout 5s;
}
'';
in
{
users.users.nginx.extraGroups = [ "acme" ];
services = {
nginx = {
enable = true;
# No virtualHosts.<name>.locations for /, /subs/, /subsjs/, /clash/
# anymore — port 443 is now owned by the stream block, and the
# 3x-ui panel serves those paths itself once TLS is forwarded to it.
# Recommended HTTP options retained (still apply to the port-80
# ACME server block).
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = {
# ACME only — nginx owns no HTTP server on 443 anymore. The
# cert at /var/lib/acme/pubray1.zeroq.su/ is consumed by the
# 3x-ui container (mounted into /root/cert/) so it can do its
# own TLS termination on 2049. Don't add forceSSL here: that
# would generate an HTTPS server block on 443 that conflicts
# with the stream listener above.
"pubray1.zeroq.su" = {
enableACME = true;
};
};
# Top-level nginx.conf snippet — `stream {}` lives outside `http {}`,
# so it can't go through virtualHosts / appendHttpConfig. The NixOS
# nginx module exposes appendConfig for this.
appendConfig = streamConfig;
};
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
# ACME only — 443 is owned by the stream block, not by http { server {} }.
# Don't add forceSSL: it would generate an HTTPS server block that
# conflicts with the stream listener.
virtualHosts."pubray1.zeroq.su".enableACME = true;
# Lands inside the auto-generated `stream {}` block.
streamConfig = streamConfig;
};
security.acme = {
acceptTerms = true;
defaults = {
email = "oqyude@gmail.com";
};
defaults.email = "oqyude@gmail.com";
};
networking.firewall.allowedTCPPorts = [
80
443
];
}
}