mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-07 20:47:14 +03:00
oqyude
7f5ea81f37
The 3x-ui container config was hardcoded for vds: it mounted the LE
cert for pubray1.zeroq.su and published host:15380→container:443 for
Xray REALITY. The server imports the same module but for x.zeroq.su
(no REALITY inbound, no cert needed by 3x-ui itself yet).
Add two options so each device picks what it needs:
- xlib.services.3x-ui.certDomain: domain whose LE cert is mounted
at /root/cert/{fullchain,key}.pem. null means no cert mount.
- xlib.services.3x-ui.reality443Forwarding: when true, also publish
host:15380→container:443 for nginx stream SNI-routed REALITY.
vds sets both. Server sets only certDomain (kept harmless; nginx
still terminates TLS for x.zeroq.su, so the mounted cert is unused
until/unless 3x-ui is reconfigured to terminate TLS itself).
27 lines
611 B
Nix
27 lines
611 B
Nix
{
|
|
lib,
|
|
xlib,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
../containers/3x-ui.nix
|
|
./nginx.nix
|
|
./samba.nix
|
|
./systemd.nix
|
|
# ./glances.nix
|
|
# ./netbird.nix
|
|
# ./xray.nix
|
|
];
|
|
# VDS hosts the public-facing Xray REALITY inbound on container:443,
|
|
# fronted by nginx stream on host:443 → host:15380 → container:443.
|
|
xlib.services."3x-ui" = {
|
|
certDomain = "pubray1.zeroq.su";
|
|
reality443Forwarding = true;
|
|
};
|
|
systemd.tmpfiles.rules = [
|
|
(xlib.helpers.mkTmpfile "d" "/mnt" "0755" "root" "root")
|
|
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
|
|
];
|
|
}
|