voronind/nix
0
0
Fork 0
Code Issues 41 Pull requests Packages Projects Releases Wiki Activity

Yt : Proxy via z.

Browse source
This commit is contained in:
Dmitry Voronin 2024-08-08 01:59:00 +03:00
parent bc4409e79e
commit ae4a88b443
Signed by: voronind
SSH key fingerprint: SHA256:3kBb4iV2ahufEBNq+vFbUe4QYfHt98DHQjN7QaptY9k
27 changed files with 99 additions and 87 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
config/Setting.nix
View file

@ -122,5 +122,18 @@
};
};
};
# Zapret params.
zapret = mkOption {
default = {};
type = types.submodule {
options = {
params = mkOption {
default = "--dpi-desync=disorder --dpi-desync-ttl=1 --dpi-desync-split-pos=3";
type = types.str;
};
};
};
};
};
}

5
container/Vpn.nix
View file

@ -60,6 +60,11 @@ in {
};
config = { ... }: container.mkContainerConfig cfg {
boot.kernel.sysctl = {
"net.ipv4.conf.all.src_valid_mark" = 1;
"net.ipv4.ip_forward" = 1;
};
environment.systemPackages = with pkgs; [ wireguard-tools ];
networking.useNetworkd = true;
systemd.network = {

46
container/Yt.nix
View file

@ -46,6 +46,52 @@ in {
https_only = true;
};
};
systemd = {
timers = {
zapret = {
timerConfig = {
OnBootSec = 5;
Unit = "zapret.service";
};
wantedBy = [ "timers.target" ];
};
routes = {
timerConfig = {
OnBootSec = 5;
Unit = "routes.service";
};
wantedBy = [ "timers.target" ];
};
};
services = {
zapret = {
description = "FRKN";
wantedBy = [ ];
requires = [ "network.target" ];
path = with pkgs; [ zapret ];
serviceConfig = {
ExecStart = "${pkgs.zapret}/bin/nfqws --pidfile=/run/nfqws.pid ${config.setting.zapret.params} --qnum=200";
Type = "simple";
PIDFile = "/run/nfqws.pid";
ExecReload = "/bin/kill -HUP $MAINPID";
Restart = "always";
RestartSec = "5s";
};
};
routes = {
description = "FRKN routes";
wantedBy = [ ];
requires = [ "network.target" ];
path = with pkgs; [ iptables ];
serviceConfig = {
ExecStart = "${pkgs.iptables}/bin/iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass";
Type = "oneshot";
};
};
};
};
};
};
};

11
container/Zapret.nix
View file

@ -47,9 +47,18 @@ in {
];
config = { ... }: container.mkContainerConfig cfg {
boot.kernel.sysctl = {
"net.ipv4.conf.all.src_valid_mark" = 1;
"net.ipv4.ip_forward" = 1;
};
environment.systemPackages = with pkgs; [ iptables ];
networking = {
nameservers = [
"10.1.0.6"
"1.1.1.1"
];
firewall = {
extraCommands = ''
iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
@ -133,7 +142,7 @@ in {
requires = [ "network.target" ];
path = with pkgs; [ zapret ];
serviceConfig = {
ExecStart = "${pkgs.zapret}/bin/nfqws --pidfile=/run/nfqws.pid --dpi-desync=disorder --dpi-desync-ttl=1 --dpi-desync-split-pos=3 --qnum=200";
ExecStart = "${pkgs.zapret}/bin/nfqws --pidfile=/run/nfqws.pid ${config.setting.zapret.params} --qnum=200";
Type = "simple";
PIDFile = "/run/nfqws.pid";
ExecReload = "/bin/kill -HUP $MAINPID";

1
container/proxy/host/Camera.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
return 301 rtsp://${address}:${toString port}/live/main;
}

1
container/proxy/host/Change.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;

1
container/proxy/host/Cloud.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Download.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

84
container/proxy/host/Fsight.nix
View file

@ -1,84 +0,0 @@
{ util, config, container, ... }: let
domain = config.container.domain;
address = "10.1.0.29";
in {
"fmp-cloud.${domain}" = container.mkServer {
extraConfig = util.trimTabs ''
listen 443 ssl;
set $fmpnextcloud ${address}:80;
location ~ ^/(settings/admin|settings/users|settings/apps|api) {
allow ${config.container.localAccess};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://$fmpnextcloud$request_uri;
}
location / {
proxy_pass http://$fmpnextcloud$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';
};
"fmp-git.${domain}" = container.mkServer {
extraConfig = util.trimTabs ''
listen 443 ssl;
set $fmpgitea ${address}:3000;
location ~ ^/(admin|api) {
allow ${config.container.localAccess};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://$fmpgitea$request_uri;
}
location / {
proxy_pass http://$fmpgitea$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';
};
"fmp-dev.${domain}" = container.mkServer {
extraConfig = util.trimTabs ''
listen 443 ssl;
set $fmpdev ${config.container.host}:8079;
location / {
proxy_pass http://$fmpdev$request_uri;
add_header Referrer-Policy 'origin';
}
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';
};
"fmp-master.${domain}" = container.mkServer {
extraConfig = util.trimTabs ''
listen 443 ssl;
set $fmpmaster ${config.container.host}:8081;
location / {
proxy_pass http://$fmpmaster$request_uri;
add_header Referrer-Policy 'origin';
}
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';
};
}

2
container/proxy/host/Git.nix
View file

@ -10,6 +10,7 @@ in {
location ~ ^/(admin|api|user) {
allow ${config.container.localAccess};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
@ -18,6 +19,7 @@ in {
# allow ${config.container.localAccess};
# allow ${config.container.module.status.address};
# allow ${config.container.module.vpn.address};
# allow ${config.container.module.zapret.address};
# deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Hdd.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Home.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Iot.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

1
container/proxy/host/Mail.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Office.nix
View file

@ -11,6 +11,7 @@ in {
# allow ${config.container.localAccess};
# allow ${config.container.module.status.address};
# allow ${config.container.module.vpn.address};
# allow ${config.container.module.zapret.address};
# deny all;
add_header X-Forwarded-Proto https;
proxy_pass http://''$${name}$request_uri;

1
container/proxy/host/Paper.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Pass.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Print.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;

1
container/proxy/host/Printer.nix
View file

@ -13,6 +13,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Read.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Router.nix
View file

@ -13,6 +13,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Search.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

2
container/proxy/host/Status.nix
View file

@ -10,6 +10,7 @@ in {
location ~ ^/(dashboard|settings) {
allow ${config.container.localAccess};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
@ -17,6 +18,7 @@ in {
location / {
allow ${config.container.localAccess};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Stock.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Watch.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}

1
container/proxy/host/Yt.nix
View file

@ -11,6 +11,7 @@ in {
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
allow ${config.container.module.zapret.address};
deny all;
proxy_pass http://''$${name}$request_uri;

4
home/program/bash/module/Zapret.nix
View file

@ -1,9 +1,9 @@
{ ... }: {
{ config, ... }: {
text = ''
# FRKN.
function zapret() {
iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
nfqws --pidfile=/run/nfqws.pid --dpi-desync=disorder --dpi-desync-ttl=1 --dpi-desync-split-pos=3 --qnum=200
nfqws --pidfile=/run/nfqws.pid ${config.setting.zapret.params} --qnum=200
}
'';
}