mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-07 20:47:14 +03:00
oqyude
26e53e96bd
nginx stream + ssl_preread reads the ClientHello SNI and forwards the raw TCP stream (no TLS termination) to either: - 3x-ui panel on 127.0.0.1:2049 (SNI=pubray1.zeroq.su) - Xray on 127.0.0.1:15380 (SNI=pubrayx1.zeroq.su or default) podman maps host:15380 → container:443 so Xray inside sees the client on port 443 (matching its REALITY config) even though the host-side port from podman's perspective is 15380. Host:2049 still maps to container:2049 — 3x-ui now terminates TLS itself using the Let's Encrypt cert mounted from /var/lib/acme/pubray1.zeroq.su/. x-ui.db: webCertFile, webKeyFile and webDomain set so the panel answers HTTPS on 2049. nginx no longer owns a server block on 443 — only an ACME-only vhost for cert renewal. REALITY inbound on container:443 still needs to be created via the panel UI (the xrayTemplateConfig doesn't have it yet). The host-side and routing plumbing is ready for it.
90 lines
2.9 KiB
Nix
90 lines
2.9 KiB
Nix
{
|
|
config,
|
|
inputs,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
server = "100.64.0.0";
|
|
# TCP-level SNI routing on 443:
|
|
# pubray1.zeroq.su → 3x-ui panel (TLS passthrough to 127.0.0.1:2049,
|
|
# 3x-ui terminates TLS using the cert mounted
|
|
# from /var/lib/acme/pubray1.zeroq.su/)
|
|
# pubrayx1.zeroq.su → Xray REALITY (TLS passthrough to 127.0.0.1:15380,
|
|
# which podman DNATs to container:443)
|
|
# default → Xray (any other SNI / IP-direct hits the REALITY
|
|
# fallback, which is what we want)
|
|
# nginx stream does not inspect TLS — the SNI is read from the ClientHello
|
|
# via ssl_preread, then the entire TCP stream (including the rest of the
|
|
# TLS handshake) is forwarded as-is to the chosen upstream. So Xray sees
|
|
# the client connect on its real configured port (443) even though the
|
|
# host-side port from podman's perspective is 15380.
|
|
streamConfig = ''
|
|
stream {
|
|
ssl_preread on;
|
|
|
|
map $ssl_preread_server_name $sni_backend {
|
|
default xray;
|
|
pubray1.zeroq.su panel;
|
|
pubrayx1.zeroq.su xray;
|
|
}
|
|
|
|
upstream panel {
|
|
server 127.0.0.1:2049;
|
|
}
|
|
|
|
upstream xray {
|
|
server 127.0.0.1:15380;
|
|
}
|
|
|
|
server {
|
|
listen 443;
|
|
proxy_pass $sni_backend;
|
|
proxy_timeout 600s;
|
|
proxy_connect_timeout 5s;
|
|
}
|
|
}
|
|
'';
|
|
in
|
|
{
|
|
users.users.nginx.extraGroups = [ "acme" ];
|
|
services = {
|
|
nginx = {
|
|
enable = true;
|
|
# No virtualHosts.<name>.locations for /, /subs/, /subsjs/, /clash/
|
|
# anymore — port 443 is now owned by the stream block, and the
|
|
# 3x-ui panel serves those paths itself once TLS is forwarded to it.
|
|
# Recommended HTTP options retained (still apply to the port-80
|
|
# ACME server block).
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
virtualHosts = {
|
|
# ACME only — nginx owns no HTTP server on 443 anymore. The
|
|
# cert at /var/lib/acme/pubray1.zeroq.su/ is consumed by the
|
|
# 3x-ui container (mounted into /root/cert/) so it can do its
|
|
# own TLS termination on 2049. Don't add forceSSL here: that
|
|
# would generate an HTTPS server block on 443 that conflicts
|
|
# with the stream listener above.
|
|
"pubray1.zeroq.su" = {
|
|
enableACME = true;
|
|
};
|
|
};
|
|
# Top-level nginx.conf snippet — `stream {}` lives outside `http {}`,
|
|
# so it can't go through virtualHosts / appendHttpConfig. The NixOS
|
|
# nginx module exposes appendConfig for this.
|
|
appendConfig = streamConfig;
|
|
};
|
|
};
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults = {
|
|
email = "oqyude@gmail.com";
|
|
};
|
|
};
|
|
networking.firewall.allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
} |