mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-07 20:47:14 +03:00
oqyude
7f5ea81f37
The 3x-ui container config was hardcoded for vds: it mounted the LE
cert for pubray1.zeroq.su and published host:15380→container:443 for
Xray REALITY. The server imports the same module but for x.zeroq.su
(no REALITY inbound, no cert needed by 3x-ui itself yet).
Add two options so each device picks what it needs:
- xlib.services.3x-ui.certDomain: domain whose LE cert is mounted
at /root/cert/{fullchain,key}.pem. null means no cert mount.
- xlib.services.3x-ui.reality443Forwarding: when true, also publish
host:15380→container:443 for nginx stream SNI-routed REALITY.
vds sets both. Server sets only certDomain (kept harmless; nginx
still terminates TLS for x.zeroq.su, so the mounted cert is unused
until/unless 3x-ui is reconfigured to terminate TLS itself).
58 lines
1.3 KiB
Nix
58 lines
1.3 KiB
Nix
{
|
|
lib,
|
|
xlib,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
../containers/3x-ui.nix
|
|
../pkgs/beets.nix
|
|
./acme.nix
|
|
./bentopdf.nix
|
|
./calibre-web.nix
|
|
./chrony.nix
|
|
./coredns.nix
|
|
./gitea.nix
|
|
./glances.nix
|
|
./homebox.nix
|
|
./immich.nix
|
|
# ./minecraft.nix
|
|
./miniflux.nix
|
|
./navidrome.nix
|
|
./nextcloud.nix
|
|
./nginx.nix
|
|
./nix-serve.nix
|
|
./onlyoffice.nix
|
|
./postgresql.nix
|
|
./power.nix
|
|
./samba.nix
|
|
./syncthing.nix
|
|
./systemd.nix
|
|
./uptime-kuma.nix
|
|
# ../containers/remnawave.nix
|
|
# ./coturn.nix
|
|
# ./mealie.nix
|
|
# ./memos.nix
|
|
# ./n8n.nix
|
|
# ./netdata.nix
|
|
# ./nfs.nix
|
|
# ./open-webui.nix
|
|
# ./rsync.nix
|
|
# ./step-ca.nix
|
|
# ./stirling-pdf.nix
|
|
# ./transmission.nix
|
|
# ./trilium.nix
|
|
# ./zerotier.nix
|
|
];
|
|
# Server's 3x-ui is the controller panel at x.zeroq.su (nginx HTTP
|
|
# terminates TLS upstream, no SNI-routing on 443 needed here because
|
|
# there are other vhosts on the same port). Cert is still mounted in
|
|
# case 3x-ui is later reconfigured to terminate TLS itself (e.g. for
|
|
# direct node-API access); nginx doesn't have to use it.
|
|
xlib.services."3x-ui".certDomain = "x.zeroq.su";
|
|
systemd.tmpfiles.rules = [
|
|
(xlib.helpers.mkTmpfile "d" "/mnt" "0755" "root" "root")
|
|
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
|
|
];
|
|
}
|