mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-07 20:47:14 +03:00
236 lines
9.3 KiB
Nix
236 lines
9.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
xlib,
|
|
...
|
|
}:
|
|
let
|
|
panel = "${xlib.dirs.services-nodes-folder}/${xlib.device.hostname}/3x-ui";
|
|
# Domain whose Let's Encrypt cert (at /var/lib/acme/<domain>/) gets mounted
|
|
# read-only into the 3x-ui container so the panel can terminate TLS itself.
|
|
# Null when 3x-ui serves plain HTTP and TLS is terminated by an upstream
|
|
# nginx.
|
|
certDomain = config.host."3x-ui".certDomain;
|
|
certMounts =
|
|
if certDomain == null then
|
|
[ ]
|
|
else
|
|
# LE cert mounted read-only so 3x-ui can terminate TLS itself.
|
|
# The 3x-ui settings table must point webCertFile / webKeyFile at
|
|
# /root/cert/fullchain.pem and /root/cert/key.pem.
|
|
map (f: "/var/lib/acme/${certDomain}/${f}:/root/cert/${f}:ro") [
|
|
"fullchain.pem"
|
|
"key.pem"
|
|
];
|
|
basePorts = [
|
|
# 3x-ui panel + subscription endpoint on the loopback only.
|
|
"127.0.0.1:2049:2049/tcp"
|
|
"127.0.0.1:2096:2096/tcp"
|
|
# xray's Reality inbound on the loopback only — nginx stream (in
|
|
# modules/server/nginx.nix) listens on the public 8443 and forwards
|
|
# here. Going nginx-stream → podman → xray keeps Reality's TLS
|
|
# ClientHello intact end-to-end; exposing 8443 directly via podman
|
|
# port-forward mangles it and clients see the fallback cert.
|
|
"127.0.0.1:15380:8443/tcp"
|
|
];
|
|
# VDS-only: nginx stream forwards host:443 → 127.0.0.1:15380 →
|
|
# container:443, so Xray sees its REALITY inbound on port 443.
|
|
realityPorts = lib.optional config.host."3x-ui".reality443Forwarding "127.0.0.1:15380:443/tcp";
|
|
# Workaround for a 3x-ui panel bug (both 3.8.5 and 3.9.0 reproduce it): when
|
|
# generating bin/config.json from the inbounds DB rows, the panel drops the
|
|
# inner `realitySettings.settings.{publicKey,fingerprint,serverName,spiderX,
|
|
# mldsa65Verify}` block — without which the xray Reality server cannot
|
|
# complete the auth handshake with any client. The DB has the data; only
|
|
# the generated config.json is missing it. This script reads DB inside the
|
|
# running container and re-applies the missing fields to bin/config.json,
|
|
# then SIGHUPs xray so clients can connect. Runs every 30s; safe to
|
|
# overlap with the panel's own config writes (it's idempotent and only
|
|
# touches missing/different fields).
|
|
# REAL ROOT-CAUSE FIX for the 3x-ui config-gen bug.
|
|
#
|
|
# In `internal/web/service/xray.go` the panel's `GetXrayConfig()`
|
|
# function does this on every config regeneration (xray restart, inbound
|
|
# update, restartXrayService API call):
|
|
#
|
|
# realitySettings, ok2 := stream["realitySettings"].(map[string]any)
|
|
# if ok2 { delete(realitySettings, "settings") }
|
|
#
|
|
# i.e. it explicitly drops the *nested* `realitySettings.settings` block
|
|
# before serialising to bin/config.json. The panel's inbound DB row
|
|
# stores these fields under `stream_settings.realitySettings.settings`,
|
|
# so every regeneration wipes publicKey/fingerprint/serverName/spiderX/
|
|
# mldsa65Verify from the live xray config, breaking Reality-auth for
|
|
# every inbound.
|
|
#
|
|
# The proper fix is to move these fields from the nested `settings` block
|
|
# to the *top level* of `realitySettings` directly in the DB. Panel's
|
|
# delete() targets the nested block only; top-level fields pass through
|
|
# untouched, and Panel passes them through to bin/config.json correctly.
|
|
#
|
|
# The migration is idempotent (no-op once fields are top-level) and is
|
|
# re-applied on every container start so that any new inbound created
|
|
# via the panel UI gets migrated automatically.
|
|
migrateScript = pkgs.writeScript "migrate-3xui-reality.py" ''
|
|
#!/usr/bin/env python3
|
|
"""Move Reality fields from nested settings to top-level realitySettings in DB.
|
|
|
|
Idempotent. Re-applied on every container start so newly-added inbounds
|
|
are auto-migrated."""
|
|
import json, sqlite3, sys
|
|
FIELDS = ("publicKey", "fingerprint", "serverName", "spiderX", "mldsa65Verify")
|
|
try:
|
|
conn = sqlite3.connect("/etc/x-ui/x-ui.db")
|
|
rows = conn.execute(
|
|
"SELECT id, stream_settings FROM inbounds "
|
|
"WHERE stream_settings IS NOT NULL AND protocol='vless'"
|
|
).fetchall()
|
|
migrated = 0
|
|
for rid, ss_json in rows:
|
|
ss = json.loads(ss_json)
|
|
rs = ss.get("realitySettings")
|
|
if not rs:
|
|
continue
|
|
inner = rs.get("settings", {})
|
|
if not inner:
|
|
continue
|
|
changed = False
|
|
for k in FIELDS:
|
|
v = inner.get(k)
|
|
if v and not rs.get(k):
|
|
rs[k] = v
|
|
changed = True
|
|
if changed:
|
|
conn.execute(
|
|
"UPDATE inbounds SET stream_settings=? WHERE id=?",
|
|
(json.dumps(ss), rid),
|
|
)
|
|
migrated += 1
|
|
conn.commit()
|
|
conn.close()
|
|
print(f"migrated={migrated}")
|
|
except Exception as e:
|
|
print(f"ERROR: {e}", file=sys.stderr)
|
|
sys.exit(1)
|
|
'';
|
|
in
|
|
{
|
|
# `host."3x-ui"` options are declared in modules/options.nix: they are set
|
|
# by modules/server and modules/vds, so this module cannot be the only place
|
|
# that knows they exist.
|
|
config = {
|
|
virtualisation = {
|
|
podman = {
|
|
enable = true;
|
|
autoPrune = {
|
|
enable = true;
|
|
flags = [ "--all" ];
|
|
};
|
|
dockerCompat = true;
|
|
};
|
|
oci-containers = {
|
|
backend = "podman";
|
|
containers."3xui_app" = {
|
|
# Pinned to v3.8.5 — the last release before the panel added the
|
|
# nested `realitySettings.settings` block for new post-quantum
|
|
# fields that its own GetXrayConfig then strips on every regenerate.
|
|
# Both 3.8.5 and 3.9.0 reproduce the bug; we work around it with
|
|
# migrate-3xui-reality.service, which moves the affected fields
|
|
# to the top level of `realitySettings` in the DB so they survive
|
|
# the panel's delete() of the nested block. The migration runs
|
|
# once on every container start, idempotently.
|
|
image = "ghcr.io/mhsanaei/3x-ui:v3.8.5";
|
|
environment = {
|
|
"XRAY_VMESS_AEAD_FORCED" = "false";
|
|
"XUI_ENABLE_FAIL2BAN" = "true";
|
|
"TZ" = "Europe/Moscow";
|
|
};
|
|
volumes = [
|
|
"${panel}/cert/:/root/cert:rw"
|
|
"${panel}/db/:/etc/x-ui:rw"
|
|
]
|
|
++ certMounts;
|
|
log-driver = "journald";
|
|
# Adding a new inbound through the 3x-ui panel on a port outside
|
|
# the 14380-15379 range requires extending basePorts and rebuilding.
|
|
ports = basePorts ++ realityPorts;
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd = {
|
|
services = {
|
|
"podman-3xui_app" = {
|
|
serviceConfig.Restart = lib.mkOverride 90 "always";
|
|
partOf = [ "podman-compose-3x-ui-root.target" ];
|
|
wantedBy = [ "podman-compose-3x-ui-root.target" ];
|
|
};
|
|
"podman-update-3xui_app" = {
|
|
path = [ pkgs.podman ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
TimeoutSec = 300;
|
|
};
|
|
script = ''
|
|
podman pull ghcr.io/mhsanaei/3x-ui:v3.8.5
|
|
systemctl restart podman-3xui_app.service
|
|
'';
|
|
};
|
|
# Real fix for the panel config-gen bug: run the DB migration once
|
|
# after each container start so any new inbounds (created via panel UI
|
|
# or API) have their Reality public fields moved to top-level on the
|
|
# next launch. The migration is idempotent — a no-op once fields are
|
|
# top-level — so it's safe to run on every container start.
|
|
"migrate-3xui-reality" = {
|
|
path = [ pkgs.podman ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
${pkgs.podman}/bin/podman exec -i 3xui_app python3 ${migrateScript} || true
|
|
'';
|
|
after = [ "podman-3xui_app.service" ];
|
|
wantedBy = [ "podman-compose-3x-ui-root.target" ];
|
|
};
|
|
};
|
|
# Starts/stops together with all 3x-ui compose resources.
|
|
targets."podman-compose-3x-ui-root" = {
|
|
unitConfig.Description = "Root target generated by compose2nix.";
|
|
wantedBy = [ "multi-user.target" ];
|
|
};
|
|
# timers."podman-update-3xui_app" = {
|
|
# wantedBy = [ "timers.target" ];
|
|
# timerConfig = {
|
|
# OnCalendar = "weekly";
|
|
# Persistent = true;
|
|
# };
|
|
# };
|
|
tmpfiles.rules = [
|
|
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
|
|
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-nodes-folder "0755" "root" "root")
|
|
(xlib.helpers.mkTmpfile "d" "${xlib.dirs.services-nodes-folder}/${xlib.device.hostname}" "0755"
|
|
"root"
|
|
"root"
|
|
)
|
|
(xlib.helpers.mkTmpfile "d" panel "0755" "root" "root")
|
|
(xlib.helpers.mkTmpfile "d" "${panel}/db" "0755" "root" "root")
|
|
(xlib.helpers.mkTmpfile "d" "${panel}/cert" "0755" "root" "root")
|
|
# Relabel panel dir for SELinux so containers can access it.
|
|
(xlib.helpers.mkTmpfile "Z" panel "0755" "root" "root")
|
|
];
|
|
};
|
|
|
|
# Enable container name DNS for all Podman networks.
|
|
networking.firewall = {
|
|
interfaces =
|
|
let
|
|
matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
|
|
in
|
|
{
|
|
"${matchAll}".allowedUDPPorts = [ 53 ];
|
|
};
|
|
};
|
|
};
|
|
}
|