modules/sing-box.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

{
  config,
  inputs,
  lib,
  ...
}:
with lib;
let
  cfg = config.nixfiles.modules.sing-box;
in
{
  options.nixfiles.modules.sing-box = {
    enable = mkEnableOption "";
  };

  config = mkIf cfg.enable {
    assertions = [
      {
        assertion = cfg.enable -> !config.nixfiles.modules.nginx.enable;
        message = "VLESS requires binding to 443";
      }
    ];

    secrets = {
      sing-box-shadowsocks-password.file = "${inputs.self}/secrets/sing-box-shadowsocks-password";
      sing-box-shadowsocks-users.file = "${inputs.self}/secrets/sing-box-shadowsocks-users";
      sing-box-vless-tls.file = "${inputs.self}/secrets/sing-box-vless-tls";
      sing-box-vless-users.file = "${inputs.self}/secrets/sing-box-vless-users";
    };

    services.sing-box = {
      enable = true;
      settings = {
        log = {
          level = "warn";
          timestamp = false;
        };
        inbounds = [
          {
            tag = "shadowsocks";
            type = "shadowsocks";
            listen = "::";
            listen_port = 21515;
            method = "2022-blake3-aes-128-gcm";
            password = {
              _secret = config.secrets.sing-box-shadowsocks-password.path;
              quote = true;
            };
            users = {
              _secret = config.secrets.sing-box-shadowsocks-users.path;
              quote = false;
            };
            multiplex.enabled = true;
          }
          {
            tag = "vless";
            type = "vless";
            listen = "::";
            listen_port = 443;
            users = {
              _secret = config.secrets.sing-box-vless-users.path;
              quote = false;
            };
            tls = {
              _secret = config.secrets.sing-box-vless-tls.path;
              quote = false;
            };
          }
        ];
        outbounds = [
          {
            type = "direct";
          }
        ];
      };
    };

    networking.firewall.allowedTCPPorts = map (
      a: a.listen_port
    ) config.services.sing-box.settings.inbounds;
  };
}