Max: Add sway fan control steps.

config/Dpi.nix

@@ -1,49 +1,77 @@
 {
 	config,
-	inputs,
 	lib,
-	pkgsMaster,
+	pkgs,
 	...
 }: let
-	cfg = config.module.dpi;
+	cfg = config.module.dpi.bypass;
+
+	whitelist = lib.optionalString (
+		(builtins.length cfg.whitelist) != 0
+	) "--hostlist ${pkgs.writeText "zapret-whitelist" (lib.concatStringsSep "\n" cfg.whitelist)}";
+
+	blacklist = lib.optionalString (
+		(builtins.length cfg.blacklist) != 0
+	) "--hostlist-exclude ${pkgs.writeText "zapret-blacklist" (lib.concatStringsSep "\n" cfg.blacklist)}";
+
+	params = lib.concatStringsSep " " cfg.params;
+
+	qnum = toString cfg.qnum;
 in {
 	disabledModules = [ "services/networking/zapret.nix" ];
-	imports = [ "${inputs.nixpkgsMaster}/nixos/modules/services/networking/zapret.nix" ];
+	# imports = [ "${inputs.nixpkgsMaster}/nixos/modules/services/networking/zapret.nix" ];
 
-	config = lib.mkIf cfg.bypass.enable {
+	config = lib.mkIf cfg.enable (lib.mkMerge [
-		services.zapret = {
+		{
-			inherit (cfg.bypass) params;
+			systemd.services.zapret = {
-			enable  = true;
+				description = "DPI bypass service";
-			package = pkgsMaster.zapret;
+				wantedBy = [ "multi-user.target" ];
-			httpMode    = "full";
+				after = [ "network.target" ];
-			httpSupport = true;
+				serviceConfig = {
-			udpSupport  = true;
+					ExecStart = "${cfg.package}/bin/nfqws --pidfile=/run/nfqws.pid ${params} ${whitelist} ${blacklist} --qnum=${qnum}";
-			udpPorts = [
+					Type = "simple";
-				"50000:50099"
+					PIDFile = "/run/nfqws.pid";
-			];
+					Restart = "always";
-			whitelist = [
+					RuntimeMaxSec = "1h"; # This service loves to crash silently or cause network slowdowns. It also restarts instantly. Restarting it at least hourly provided the best experience.
-				"youtube.com"
+
-				"googlevideo.com"
+					# Hardening.
-				"ytimg.com"
+					DevicePolicy = "closed";
-				"youtu.be"
+					KeyringMode = "private";
-				"rutracker.org"
+					PrivateTmp = true;
-				"rutracker.cc"
+					PrivateMounts = true;
-				"rutrk.org"
+					ProtectHome = true;
-				"t-ru.org"
+					ProtectHostname = true;
-				"medium.com"
+					ProtectKernelModules = true;
-				"dis.gd"
+					ProtectKernelTunables = true;
-				"discord.co"
+					ProtectSystem = "strict";
-				"discord.com"
+					ProtectProc = "invisible";
-				"discord.dev"
+					RemoveIPC = true;
-				"discord.gg"
+					RestrictNamespaces = true;
-				"discord.gift"
+					RestrictRealtime = true;
-				"discord.media"
+					RestrictSUIDSGID = true;
-				"discord.new"
+					SystemCallArchitectures = "native";
-				"discordapp.com"
-				"discordapp.net"
-				"discordcdn.com"
-				"discordstatus.com"
-			];
 				};
 			};
 		}
+		# Route system traffic via service for specified ports.
+		(lib.mkIf cfg.configureFirewall {
+			networking.firewall.extraCommands =
+				let
+					httpParams = lib.optionalString (
+						cfg.httpMode == "first"
+					) "-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6";
+
+					udpPorts = lib.concatStringsSep "," cfg.udpPorts;
+				in
+					''
+					iptables -t mangle -I POSTROUTING -p tcp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${qnum} --queue-bypass
+					''
+				+ lib.optionalString (cfg.httpSupport) ''
+					iptables -t mangle -I POSTROUTING -p tcp --dport 80 ${httpParams} -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${qnum} --queue-bypass
+				''
+				+ lib.optionalString (cfg.udpSupport) ''
+					iptables -t mangle -A POSTROUTING -p udp -m multiport --dports ${udpPorts} -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${qnum} --queue-bypass
+				'';
+		})
+	]);
+}

home/file/sway/module/Mod.nix

@@ -2,5 +2,6 @@
 	text = ''
 		# Meta key. Use Mod1 for Alt.
 		set $mod Mod4
+		set $sysmod print
 	'';
 }

home/file/sway/module/System.nix

@@ -1,24 +1,23 @@
 { ... }: let
 	brstep = 5;
-	mod    = "print";
 in {
 	text = ''
-		bindsym ${mod} input * xkb_switch_layout 0
+		bindsym $sysmod input * xkb_switch_layout 0
-		bindsym --to-code ${mod}+a exec 'swayscript network'
+		bindsym --to-code $sysmod+a exec 'swayscript network'
-		bindsym --to-code ${mod}+c exec 'systemctl reboot -i'
+		bindsym --to-code $sysmod+c exec 'systemctl reboot -i'
-		bindsym --to-code ${mod}+d exec 'swayscript dnd'
+		bindsym --to-code $sysmod+d exec 'swayscript dnd'
-		bindsym --to-code ${mod}+g exec 'swayscript gaming'
+		bindsym --to-code $sysmod+g exec 'swayscript gaming'
-		bindsym --to-code ${mod}+l exec 'powerlimit toggle'
+		bindsym --to-code $sysmod+l exec 'powerlimit toggle'
-		bindsym --to-code ${mod}+m exec 'swayscript monitor'
+		bindsym --to-code $sysmod+m exec 'swayscript monitor'
-		bindsym --to-code ${mod}+p exec 'powersave toggle'
+		bindsym --to-code $sysmod+p exec 'powersave toggle'
-		bindsym --to-code ${mod}+r exec 'swayscript reload'
+		bindsym --to-code $sysmod+r exec 'swayscript reload'
-		bindsym --to-code ${mod}+v exec 'swayscript vpn'
+		bindsym --to-code $sysmod+v exec 'swayscript vpn'
-		bindsym --to-code ${mod}+x exec 'systemctl poweroff -i'
+		bindsym --to-code $sysmod+x exec 'systemctl poweroff -i'
-		bindsym --to-code ${mod}+z exec 'systemctl suspend -i'
+		bindsym --to-code $sysmod+z exec 'systemctl suspend -i'
 
-		bindsym --to-code ${mod}+w    exec light -A ${toString brstep}
+		bindsym --to-code $sysmod+w   exec light -A ${toString brstep}
 		bindsym XF86MonBrightnessUp   exec light -A ${toString brstep}
-		bindsym --to-code ${mod}+s    exec light -U ${toString brstep}
+		bindsym --to-code $sysmod+s   exec light -U ${toString brstep}
 		bindsym XF86MonBrightnessDown exec light -U ${toString brstep}
 	'';
 }

host/x86_64-linux/home/default.nix

@@ -27,10 +27,21 @@
 				"--dpi-desync-ttl=1"
 				"--dpi-desync-autottl=2"
 
-				"--dpi-desync-ttl6=1"
+				# "--dpi-desync-ttl6=1"
-				"--dpi-desync-autottl6=2"
+				# "--dpi-desync-autottl6=2"
 
-				"--dpi-desync-any-protocol"
+				# "--dpi-desync-any-protocol"
+			];
+			whitelist = [
+				"youtube.com"
+				"googlevideo.com"
+				"ytimg.com"
+				"youtu.be"
+				"rutracker.org"
+				"rutracker.cc"
+				"rutrk.org"
+				"t-ru.org"
+				"medium.com"
 			];
 		};
 		amd = {

host/x86_64-linux/max/default.nix

@@ -1,5 +1,9 @@
 # SEE: https://github.com/Sabrina-Fox/WM2-Help
-{ ... }: {
+{
+	__findFile,
+	pkgs,
+	...
+}: {
 	home.nixos.enable = true;
 	user = {
 		root     = true;
@@ -20,8 +24,20 @@
 		display = {
 			primary = "eDP-1";
 		};
-		sway.extraConfig = [
+		sway.extraConfig = let
+			# wm2fc = "${pkgs.callPackage <package/wm2fc> {}}/bin/wm2fc";
+		in [
 			"output eDP-1 scale 1.75"
+			"bindsym $sysmod+0 exec /run/wrappers/bin/wm2fc 0"
+			"bindsym $sysmod+9 exec /run/wrappers/bin/wm2fc a"
+			"bindsym $sysmod+1 exec /run/wrappers/bin/wm2fc 23"
+			"bindsym $sysmod+2 exec /run/wrappers/bin/wm2fc 46"
+			"bindsym $sysmod+3 exec /run/wrappers/bin/wm2fc 69"
+			"bindsym $sysmod+4 exec /run/wrappers/bin/wm2fc 92"
+			"bindsym $sysmod+5 exec /run/wrappers/bin/wm2fc 115"
+			"bindsym $sysmod+6 exec /run/wrappers/bin/wm2fc 138"
+			"bindsym $sysmod+7 exec /run/wrappers/bin/wm2fc 161"
+			"bindsym $sysmod+8 exec /run/wrappers/bin/wm2fc 184"
 		];
 		hwmon = {
 			file = "temp1_input";

option/Dpi.nix

@@ -1,12 +1,49 @@
 {
 	lib,
+	pkgsMaster,
 	...
 }: {
 	options.module.dpi.bypass = {
-		enable = lib.mkEnableOption "the DPI bypass.";
+		enable = lib.mkEnableOption "the Zapret DPI bypass service.";
+		package = lib.mkPackageOption pkgsMaster "zapret" { };
 		params = lib.mkOption {
 			default = [ ];
 			type = with lib.types; listOf str;
 		};
+		whitelist = lib.mkOption {
+			default = [ ];
+			type = with lib.types; listOf str;
+		};
+		blacklist = lib.mkOption {
+			default = [ ];
+			type = with lib.types; listOf str;
+		};
+		qnum = lib.mkOption {
+			default = 200;
+			type = lib.types.int;
+		};
+		configureFirewall = lib.mkOption {
+			default = true;
+			type = lib.types.bool;
+		};
+		httpSupport = lib.mkOption {
+			default = true;
+			type = lib.types.bool;
+		};
+		httpMode = lib.mkOption {
+			default = "first";
+			type = lib.types.enum [
+				"first"
+				"full"
+			];
+		};
+		udpSupport = lib.mkOption {
+			default = false;
+			type = lib.types.bool;
+		};
+		udpPorts = lib.mkOption {
+			default = [ ];
+			type = with lib.types; listOf str;
+		};
 	};
 }