Yt : Proxy via z.

config/Setting.nix

@@ -122,5 +122,18 @@
 				};
 			};
 		};
+
+		# Zapret params.
+		zapret = mkOption {
+			default = {};
+			type = types.submodule {
+				options = {
+					params = mkOption {
+						default = "--dpi-desync=disorder --dpi-desync-ttl=1 --dpi-desync-split-pos=3";
+						type    = types.str;
+					};
+				};
+			};
+		};
 	};
 }

container/Vpn.nix

@@ -60,6 +60,11 @@ in {
 			};
 
 			config = { ... }: container.mkContainerConfig cfg {
+				boot.kernel.sysctl = {
+					"net.ipv4.conf.all.src_valid_mark" = 1;
+					"net.ipv4.ip_forward" = 1;
+				};
+
 				environment.systemPackages = with pkgs; [ wireguard-tools ];
 				networking.useNetworkd = true;
 				systemd.network = {

container/Yt.nix

@@ -46,6 +46,52 @@ in {
 						https_only           = true;
 					};
 				};
+
+				systemd = {
+					timers = {
+						zapret = {
+							timerConfig = {
+								OnBootSec = 5;
+								Unit      = "zapret.service";
+							};
+							wantedBy = [ "timers.target" ];
+						};
+						routes = {
+							timerConfig = {
+								OnBootSec = 5;
+								Unit      = "routes.service";
+							};
+							wantedBy = [ "timers.target" ];
+						};
+					};
+
+					services = {
+						zapret = {
+							description = "FRKN";
+							wantedBy = [ ];
+							requires = [ "network.target" ];
+							path = with pkgs; [ zapret ];
+							serviceConfig = {
+								ExecStart  = "${pkgs.zapret}/bin/nfqws --pidfile=/run/nfqws.pid ${config.setting.zapret.params} --qnum=200";
+								Type       = "simple";
+								PIDFile    = "/run/nfqws.pid";
+								ExecReload = "/bin/kill -HUP $MAINPID";
+								Restart    = "always";
+								RestartSec = "5s";
+							};
+						};
+						routes = {
+							description = "FRKN routes";
+							wantedBy = [ ];
+							requires = [ "network.target" ];
+							path = with pkgs; [ iptables ];
+							serviceConfig = {
+								ExecStart = "${pkgs.iptables}/bin/iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass";
+								Type = "oneshot";
+							};
+						};
+					};
+				};
 			};
 		};
 	};

container/Zapret.nix

@@ -47,9 +47,18 @@ in {
 			];
 
 			config = { ... }: container.mkContainerConfig cfg {
+				boot.kernel.sysctl = {
+					"net.ipv4.conf.all.src_valid_mark" = 1;
+					"net.ipv4.ip_forward" = 1;
+				};
+
 				environment.systemPackages = with pkgs; [ iptables ];
 
 				networking = {
+					nameservers = [
+						"10.1.0.6"
+						"1.1.1.1"
+					];
 					firewall = {
 						extraCommands = ''
 							iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
@@ -133,7 +142,7 @@ in {
 							requires = [ "network.target" ];
 							path = with pkgs; [ zapret ];
 							serviceConfig = {
-								ExecStart  = "${pkgs.zapret}/bin/nfqws --pidfile=/run/nfqws.pid --dpi-desync=disorder --dpi-desync-ttl=1 --dpi-desync-split-pos=3 --qnum=200";
+								ExecStart  = "${pkgs.zapret}/bin/nfqws --pidfile=/run/nfqws.pid ${config.setting.zapret.params} --qnum=200";
 								Type       = "simple";
 								PIDFile    = "/run/nfqws.pid";
 								ExecReload = "/bin/kill -HUP $MAINPID";

container/proxy/host/Camera.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				return 301 rtsp://${address}:${toString port}/live/main;
 			}

container/proxy/host/Change.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 
 				proxy_pass http://''$${name}$request_uri;

container/proxy/host/Cloud.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Download.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Fsight.nix

@@ -1,84 +0,0 @@
-{ util, config, container, ... }: let
-	domain  = config.container.domain;
-	address = "10.1.0.29";
-in {
-	"fmp-cloud.${domain}" = container.mkServer {
-		extraConfig = util.trimTabs ''
-			listen 443 ssl;
-			set $fmpnextcloud ${address}:80;
-
-			location ~ ^/(settings/admin|settings/users|settings/apps|api) {
-				allow ${config.container.localAccess};
-				allow ${config.container.module.vpn.address};
-				deny all;
-				proxy_pass http://$fmpnextcloud$request_uri;
-			}
-
-			location / {
-				proxy_pass http://$fmpnextcloud$request_uri;
-			}
-
-			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
-			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
-			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
-		'';
-	};
-
-	"fmp-git.${domain}" = container.mkServer {
-		extraConfig = util.trimTabs ''
-			listen 443 ssl;
-			set $fmpgitea ${address}:3000;
-
-			location ~ ^/(admin|api) {
-				allow ${config.container.localAccess};
-				allow ${config.container.module.vpn.address};
-				deny all;
-				proxy_pass http://$fmpgitea$request_uri;
-			}
-
-			location / {
-				proxy_pass http://$fmpgitea$request_uri;
-			}
-
-			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
-			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
-			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
-		'';
-	};
-
-	"fmp-dev.${domain}" = container.mkServer {
-		extraConfig = util.trimTabs ''
-			listen 443 ssl;
-			set $fmpdev ${config.container.host}:8079;
-
-			location / {
-				proxy_pass http://$fmpdev$request_uri;
-				add_header Referrer-Policy 'origin';
-			}
-
-			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
-			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
-			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
-		'';
-	};
-
-	"fmp-master.${domain}" = container.mkServer {
-		extraConfig = util.trimTabs ''
-			listen 443 ssl;
-			set $fmpmaster ${config.container.host}:8081;
-
-			location / {
-				proxy_pass http://$fmpmaster$request_uri;
-				add_header Referrer-Policy 'origin';
-			}
-
-			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
-			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
-			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
-		'';
-	};
-}

container/proxy/host/Git.nix

@@ -10,6 +10,7 @@ in {
 			location ~ ^/(admin|api|user) {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
@@ -18,6 +19,7 @@ in {
 				# allow ${config.container.localAccess};
 				# allow ${config.container.module.status.address};
 				# allow ${config.container.module.vpn.address};
+				# allow ${config.container.module.zapret.address};
 				# deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Hdd.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Home.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Iot.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 
 				# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

container/proxy/host/Mail.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Office.nix

@@ -11,6 +11,7 @@ in {
 				# allow ${config.container.localAccess};
 				# allow ${config.container.module.status.address};
 				# allow ${config.container.module.vpn.address};
+				# allow ${config.container.module.zapret.address};
 				# deny all;
 				add_header X-Forwarded-Proto https;
 				proxy_pass http://''$${name}$request_uri;

container/proxy/host/Paper.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Pass.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Print.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 
 				proxy_pass http://''$${name}$request_uri;

container/proxy/host/Printer.nix

@@ -13,6 +13,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Read.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Router.nix

@@ -13,6 +13,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Search.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Status.nix

@@ -10,6 +10,7 @@ in {
 			location ~ ^/(dashboard|settings) {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
@@ -17,6 +18,7 @@ in {
 			location / {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Stock.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Watch.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}

container/proxy/host/Yt.nix

@@ -11,6 +11,7 @@ in {
 				allow ${config.container.localAccess};
 				allow ${config.container.module.status.address};
 				allow ${config.container.module.vpn.address};
+				allow ${config.container.module.zapret.address};
 				deny all;
 
 				proxy_pass http://''$${name}$request_uri;

home/program/bash/module/Zapret.nix

@@ -1,9 +1,9 @@
-{ ... }: {
+{ config, ... }: {
 	text = ''
 		# FRKN.
 		function zapret() {
 			iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
-			nfqws --pidfile=/run/nfqws.pid --dpi-desync=disorder --dpi-desync-ttl=1 --dpi-desync-split-pos=3 --qnum=200
+			nfqws --pidfile=/run/nfqws.pid ${config.setting.zapret.params}  --qnum=200
 		}
 	'';
 }