nixos/dae: add more config options
This commit is contained in:
oluceps
parent
d0decc53e9
commit
173ff5d2dd
|
|
@ -1,41 +1,151 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.dae;
|
||||
assets = cfg.assets;
|
||||
genAssetsDrv = paths: pkgs.symlinkJoin {
|
||||
name = "dae-assets";
|
||||
inherit paths;
|
||||
};
|
||||
in
|
||||
{
|
||||
meta.maintainers = with lib.maintainers; [ pokon548 ];
|
||||
meta.maintainers = with lib.maintainers; [ pokon548 oluceps ];
|
||||
|
||||
options = {
|
||||
services.dae = {
|
||||
enable = lib.options.mkEnableOption (lib.mdDoc "the dae service");
|
||||
package = lib.mkPackageOptionMD pkgs "dae" { };
|
||||
services.dae = with lib;{
|
||||
enable = mkEnableOption
|
||||
(mdDoc "A Linux high-performance transparent proxy solution based on eBPF");
|
||||
|
||||
package = mkPackageOptionMD pkgs "dae" { };
|
||||
|
||||
assets = mkOption {
|
||||
type = with types;(listOf path);
|
||||
default = with pkgs; [ v2ray-geoip v2ray-domain-list-community ];
|
||||
defaultText = literalExpression "with pkgs; [ v2ray-geoip v2ray-domain-list-community ]";
|
||||
description = mdDoc ''
|
||||
Assets required to run dae.
|
||||
'';
|
||||
};
|
||||
|
||||
assetsPath = mkOption {
|
||||
type = types.str;
|
||||
default = "${genAssetsDrv assets}/share/v2ray";
|
||||
defaultText = literalExpression ''
|
||||
(symlinkJoin {
|
||||
name = "dae-assets";
|
||||
paths = assets;
|
||||
})/share/v2ray
|
||||
'';
|
||||
description = mdDoc ''
|
||||
The path which contains geolocation database.
|
||||
This option will override `assets`.
|
||||
'';
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = with types; submodule {
|
||||
options = {
|
||||
enable = mkEnableOption "enable";
|
||||
port = mkOption {
|
||||
type = types.int;
|
||||
description = ''
|
||||
Port to be opened. Consist with field `tproxy_port` in config file.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
default = {
|
||||
enable = true;
|
||||
port = 12345;
|
||||
};
|
||||
defaultText = literalExpression ''
|
||||
{
|
||||
enable = true;
|
||||
port = 12345;
|
||||
}
|
||||
'';
|
||||
description = mdDoc ''
|
||||
Open the firewall port.
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
config = mkOption {
|
||||
type = types.str;
|
||||
default = ''
|
||||
global{}
|
||||
routing{}
|
||||
'';
|
||||
description = mdDoc ''
|
||||
Config text for dae.
|
||||
'';
|
||||
};
|
||||
|
||||
disableTxChecksumIpGeneric =
|
||||
mkEnableOption (mdDoc "See https://github.com/daeuniverse/dae/issues/43");
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf config.services.dae.enable {
|
||||
networking.firewall.allowedTCPPorts = [ 12345 ];
|
||||
networking.firewall.allowedUDPPorts = [ 12345 ];
|
||||
config = lib.mkIf cfg.enable
|
||||
|
||||
systemd.services.dae = {
|
||||
unitConfig = {
|
||||
Description = "dae Service";
|
||||
Documentation = "https://github.com/daeuniverse/dae";
|
||||
After = [ "network-online.target" "systemd-sysctl.service" ];
|
||||
Wants = [ "network-online.target" ];
|
||||
{
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
systemd.packages = [ cfg.package ];
|
||||
|
||||
environment.etc."dae/config.dae" = {
|
||||
mode = "0400";
|
||||
source = pkgs.writeText "config.dae" cfg.config;
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
User = "root";
|
||||
ExecStartPre = "${lib.getExe cfg.package} validate -c /etc/dae/config.dae";
|
||||
ExecStart = "${lib.getExe cfg.package} run --disable-timestamp -c /etc/dae/config.dae";
|
||||
ExecReload = "${lib.getExe cfg.package} reload $MAINPID";
|
||||
LimitNPROC = 512;
|
||||
LimitNOFILE = 1048576;
|
||||
Restart = "on-abnormal";
|
||||
Type = "notify";
|
||||
networking = lib.mkIf cfg.openFirewall.enable {
|
||||
firewall =
|
||||
let portToOpen = cfg.openFirewall.port;
|
||||
in
|
||||
{
|
||||
allowedTCPPorts = [ portToOpen ];
|
||||
allowedUDPPorts = [ portToOpen ];
|
||||
};
|
||||
};
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
systemd.services.dae =
|
||||
let
|
||||
daeBin = lib.getExe cfg.package;
|
||||
TxChecksumIpGenericWorkaround = with lib;(getExe pkgs.writeShellApplication {
|
||||
name = "disable-tx-checksum-ip-generic";
|
||||
text = with pkgs; ''
|
||||
iface=$(${iproute2}/bin/ip route | ${lib.getExe gawk} '/default/ {print $5}')
|
||||
${lib.getExe ethtool} -K "$iface" tx-checksum-ip-generic off
|
||||
'';
|
||||
});
|
||||
in
|
||||
{
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStartPre = [ "" "${daeBin} validate -c ${cfg.configFile}" ]
|
||||
++ (with lib; optional cfg.disableTxChecksumIpGeneric TxChecksumIpGenericWorkaround);
|
||||
ExecStart = [ "" "${daeBin} run --disable-timestamp -c ${cfg.configFile}" ];
|
||||
Environment = "DAE_LOCATION_ASSET=${cfg.assetsPath}";
|
||||
};
|
||||
};
|
||||
|
||||
assertions = [
|
||||
{
|
||||
assertion = lib.pathExists (toString (genAssetsDrv cfg.assets) + "/share/v2ray");
|
||||
message = ''
|
||||
Packages in `assets` has no preset paths included.
|
||||
Please set `assetsPath` instead.
|
||||
'';
|
||||
}
|
||||
|
||||
{
|
||||
assertion = !((config.services.dae.config != "global{}\nrouting{}\n")
|
||||
&& (config.services.dae.configFile != "/etc/dae/config.dae"));
|
||||
message = ''
|
||||
Option `config` and `configFile` could not be set
|
||||
at the same time.
|
||||
'';
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue