Compare commits
2 commits
c6c556ea84
...
e9d48ee21d
| Author | SHA1 | Date | |
|---|---|---|---|
 Dmitry Voronin
|
e9d48ee21d
|
||
|
Dmitry Voronin
|
5d347afb6c
|
104
config/Dpi.nix
104
config/Dpi.nix
|
|
@ -1,49 +1,77 @@
|
|||
{
|
||||
config,
|
||||
inputs,
|
||||
lib,
|
||||
pkgsMaster,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
cfg = config.module.dpi;
|
||||
cfg = config.module.dpi.bypass;
|
||||
|
||||
whitelist = lib.optionalString (
|
||||
(builtins.length cfg.whitelist) != 0
|
||||
) "--hostlist ${pkgs.writeText "zapret-whitelist" (lib.concatStringsSep "\n" cfg.whitelist)}";
|
||||
|
||||
blacklist = lib.optionalString (
|
||||
(builtins.length cfg.blacklist) != 0
|
||||
) "--hostlist-exclude ${pkgs.writeText "zapret-blacklist" (lib.concatStringsSep "\n" cfg.blacklist)}";
|
||||
|
||||
params = lib.concatStringsSep " " cfg.params;
|
||||
|
||||
qnum = toString cfg.qnum;
|
||||
in {
|
||||
disabledModules = [ "services/networking/zapret.nix" ];
|
||||
imports = [ "${inputs.nixpkgsMaster}/nixos/modules/services/networking/zapret.nix" ];
|
||||
# imports = [ "${inputs.nixpkgsMaster}/nixos/modules/services/networking/zapret.nix" ];
|
||||
|
||||
config = lib.mkIf cfg.bypass.enable {
|
||||
services.zapret = {
|
||||
inherit (cfg.bypass) params;
|
||||
enable = true;
|
||||
package = pkgsMaster.zapret;
|
||||
httpMode = "full";
|
||||
httpSupport = true;
|
||||
udpSupport = true;
|
||||
udpPorts = [
|
||||
"50000:50099"
|
||||
];
|
||||
whitelist = [
|
||||
"youtube.com"
|
||||
"googlevideo.com"
|
||||
"ytimg.com"
|
||||
"youtu.be"
|
||||
"rutracker.org"
|
||||
"rutracker.cc"
|
||||
"rutrk.org"
|
||||
"t-ru.org"
|
||||
"medium.com"
|
||||
"dis.gd"
|
||||
"discord.co"
|
||||
"discord.com"
|
||||
"discord.dev"
|
||||
"discord.gg"
|
||||
"discord.gift"
|
||||
"discord.media"
|
||||
"discord.new"
|
||||
"discordapp.com"
|
||||
"discordapp.net"
|
||||
"discordcdn.com"
|
||||
"discordstatus.com"
|
||||
];
|
||||
config = lib.mkIf cfg.enable (lib.mkMerge [
|
||||
{
|
||||
systemd.services.zapret = {
|
||||
description = "DPI bypass service";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = "${cfg.package}/bin/nfqws --pidfile=/run/nfqws.pid ${params} ${whitelist} ${blacklist} --qnum=${qnum}";
|
||||
Type = "simple";
|
||||
PIDFile = "/run/nfqws.pid";
|
||||
Restart = "always";
|
||||
RuntimeMaxSec = "1h"; # This service loves to crash silently or cause network slowdowns. It also restarts instantly. Restarting it at least hourly provided the best experience.
|
||||
|
||||
# Hardening.
|
||||
DevicePolicy = "closed";
|
||||
KeyringMode = "private";
|
||||
PrivateTmp = true;
|
||||
PrivateMounts = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectProc = "invisible";
|
||||
RemoveIPC = true;
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
};
|
||||
};
|
||||
}
|
||||
# Route system traffic via service for specified ports.
|
||||
(lib.mkIf cfg.configureFirewall {
|
||||
networking.firewall.extraCommands =
|
||||
let
|
||||
httpParams = lib.optionalString (
|
||||
cfg.httpMode == "first"
|
||||
) "-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6";
|
||||
|
||||
udpPorts = lib.concatStringsSep "," cfg.udpPorts;
|
||||
in
|
||||
''
|
||||
iptables -t mangle -I POSTROUTING -p tcp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${qnum} --queue-bypass
|
||||
''
|
||||
+ lib.optionalString (cfg.httpSupport) ''
|
||||
iptables -t mangle -I POSTROUTING -p tcp --dport 80 ${httpParams} -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${qnum} --queue-bypass
|
||||
''
|
||||
+ lib.optionalString (cfg.udpSupport) ''
|
||||
iptables -t mangle -A POSTROUTING -p udp -m multiport --dports ${udpPorts} -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${qnum} --queue-bypass
|
||||
'';
|
||||
})
|
||||
]);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,5 +2,6 @@
|
|||
text = ''
|
||||
# Meta key. Use Mod1 for Alt.
|
||||
set $mod Mod4
|
||||
set $sysmod print
|
||||
'';
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,24 +1,23 @@
|
|||
{ ... }: let
|
||||
brstep = 5;
|
||||
mod = "print";
|
||||
in {
|
||||
text = ''
|
||||
bindsym ${mod} input * xkb_switch_layout 0
|
||||
bindsym --to-code ${mod}+a exec 'swayscript network'
|
||||
bindsym --to-code ${mod}+c exec 'systemctl reboot -i'
|
||||
bindsym --to-code ${mod}+d exec 'swayscript dnd'
|
||||
bindsym --to-code ${mod}+g exec 'swayscript gaming'
|
||||
bindsym --to-code ${mod}+l exec 'powerlimit toggle'
|
||||
bindsym --to-code ${mod}+m exec 'swayscript monitor'
|
||||
bindsym --to-code ${mod}+p exec 'powersave toggle'
|
||||
bindsym --to-code ${mod}+r exec 'swayscript reload'
|
||||
bindsym --to-code ${mod}+v exec 'swayscript vpn'
|
||||
bindsym --to-code ${mod}+x exec 'systemctl poweroff -i'
|
||||
bindsym --to-code ${mod}+z exec 'systemctl suspend -i'
|
||||
bindsym $sysmod input * xkb_switch_layout 0
|
||||
bindsym --to-code $sysmod+a exec 'swayscript network'
|
||||
bindsym --to-code $sysmod+c exec 'systemctl reboot -i'
|
||||
bindsym --to-code $sysmod+d exec 'swayscript dnd'
|
||||
bindsym --to-code $sysmod+g exec 'swayscript gaming'
|
||||
bindsym --to-code $sysmod+l exec 'powerlimit toggle'
|
||||
bindsym --to-code $sysmod+m exec 'swayscript monitor'
|
||||
bindsym --to-code $sysmod+p exec 'powersave toggle'
|
||||
bindsym --to-code $sysmod+r exec 'swayscript reload'
|
||||
bindsym --to-code $sysmod+v exec 'swayscript vpn'
|
||||
bindsym --to-code $sysmod+x exec 'systemctl poweroff -i'
|
||||
bindsym --to-code $sysmod+z exec 'systemctl suspend -i'
|
||||
|
||||
bindsym --to-code ${mod}+w exec light -A ${toString brstep}
|
||||
bindsym --to-code $sysmod+w exec light -A ${toString brstep}
|
||||
bindsym XF86MonBrightnessUp exec light -A ${toString brstep}
|
||||
bindsym --to-code ${mod}+s exec light -U ${toString brstep}
|
||||
bindsym --to-code $sysmod+s exec light -U ${toString brstep}
|
||||
bindsym XF86MonBrightnessDown exec light -U ${toString brstep}
|
||||
'';
|
||||
}
|
||||
|
|
|
|||
|
|
@ -27,10 +27,21 @@
|
|||
"--dpi-desync-ttl=1"
|
||||
"--dpi-desync-autottl=2"
|
||||
|
||||
"--dpi-desync-ttl6=1"
|
||||
"--dpi-desync-autottl6=2"
|
||||
# "--dpi-desync-ttl6=1"
|
||||
# "--dpi-desync-autottl6=2"
|
||||
|
||||
"--dpi-desync-any-protocol"
|
||||
# "--dpi-desync-any-protocol"
|
||||
];
|
||||
whitelist = [
|
||||
"youtube.com"
|
||||
"googlevideo.com"
|
||||
"ytimg.com"
|
||||
"youtu.be"
|
||||
"rutracker.org"
|
||||
"rutracker.cc"
|
||||
"rutrk.org"
|
||||
"t-ru.org"
|
||||
"medium.com"
|
||||
];
|
||||
};
|
||||
amd = {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,9 @@
|
|||
# SEE: https://github.com/Sabrina-Fox/WM2-Help
|
||||
{ ... }: {
|
||||
{
|
||||
__findFile,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
home.nixos.enable = true;
|
||||
user = {
|
||||
root = true;
|
||||
|
|
@ -20,8 +24,20 @@
|
|||
display = {
|
||||
primary = "eDP-1";
|
||||
};
|
||||
sway.extraConfig = [
|
||||
sway.extraConfig = let
|
||||
# wm2fc = "${pkgs.callPackage <package/wm2fc> {}}/bin/wm2fc";
|
||||
in [
|
||||
"output eDP-1 scale 1.75"
|
||||
"bindsym $sysmod+0 exec /run/wrappers/bin/wm2fc 0"
|
||||
"bindsym $sysmod+9 exec /run/wrappers/bin/wm2fc a"
|
||||
"bindsym $sysmod+1 exec /run/wrappers/bin/wm2fc 23"
|
||||
"bindsym $sysmod+2 exec /run/wrappers/bin/wm2fc 46"
|
||||
"bindsym $sysmod+3 exec /run/wrappers/bin/wm2fc 69"
|
||||
"bindsym $sysmod+4 exec /run/wrappers/bin/wm2fc 92"
|
||||
"bindsym $sysmod+5 exec /run/wrappers/bin/wm2fc 115"
|
||||
"bindsym $sysmod+6 exec /run/wrappers/bin/wm2fc 138"
|
||||
"bindsym $sysmod+7 exec /run/wrappers/bin/wm2fc 161"
|
||||
"bindsym $sysmod+8 exec /run/wrappers/bin/wm2fc 184"
|
||||
];
|
||||
hwmon = {
|
||||
file = "temp1_input";
|
||||
|
|
|
|||
|
|
@ -1,12 +1,49 @@
|
|||
{
|
||||
lib,
|
||||
pkgsMaster,
|
||||
...
|
||||
}: {
|
||||
options.module.dpi.bypass = {
|
||||
enable = lib.mkEnableOption "the DPI bypass.";
|
||||
enable = lib.mkEnableOption "the Zapret DPI bypass service.";
|
||||
package = lib.mkPackageOption pkgsMaster "zapret" { };
|
||||
params = lib.mkOption {
|
||||
default = [ ];
|
||||
type = with lib.types; listOf str;
|
||||
};
|
||||
whitelist = lib.mkOption {
|
||||
default = [ ];
|
||||
type = with lib.types; listOf str;
|
||||
};
|
||||
blacklist = lib.mkOption {
|
||||
default = [ ];
|
||||
type = with lib.types; listOf str;
|
||||
};
|
||||
qnum = lib.mkOption {
|
||||
default = 200;
|
||||
type = lib.types.int;
|
||||
};
|
||||
configureFirewall = lib.mkOption {
|
||||
default = true;
|
||||
type = lib.types.bool;
|
||||
};
|
||||
httpSupport = lib.mkOption {
|
||||
default = true;
|
||||
type = lib.types.bool;
|
||||
};
|
||||
httpMode = lib.mkOption {
|
||||
default = "first";
|
||||
type = lib.types.enum [
|
||||
"first"
|
||||
"full"
|
||||
];
|
||||
};
|
||||
udpSupport = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
};
|
||||
udpPorts = lib.mkOption {
|
||||
default = [ ];
|
||||
type = with lib.types; listOf str;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue