flake/nixos/modules/services/clash.nix

105 lines
3.3 KiB
Nix
Raw Normal View History

2023-12-21 03:59:19 +00:00
{
lib,
config,
pkgs,
...
}: let
cfg = config.services.clash;
in {
options.services.clash = {
2023-12-31 12:22:48 +00:00
enable = lib.mkEnableOption "Whether to enable Clash, A rule-based proxy in Go.";
2023-12-21 03:59:19 +00:00
package = lib.mkPackageOption pkgs "clash" {};
2023-12-31 12:22:48 +00:00
configFile = lib.mkOption {
2023-12-25 02:58:41 +00:00
default = null;
type = lib.types.nullOr lib.types.path;
2023-12-31 12:22:48 +00:00
description = "Configuration file to use.";
2023-12-25 02:58:41 +00:00
};
2023-12-31 12:22:48 +00:00
webui = lib.mkOption {
2023-12-25 02:58:41 +00:00
default = null;
type = lib.types.nullOr lib.types.path;
2023-12-31 12:22:48 +00:00
description = ''
Local web interface to use.
You can also use the following website, just in case:
- metacubexd:
- http://d.metacubex.one
- https://metacubex.github.io/metacubexd
- https://metacubexd.pages.dev
- yacd:
- https://yacd.haishan.me
- clash-dashboard (buggy):
- https://clash.razord.top
'';
2023-12-25 02:58:41 +00:00
};
extraOpts = lib.mkOption {
default = null;
type = lib.types.nullOr lib.types.string;
2023-12-31 12:22:48 +00:00
description = "Extra command line options to use.";
2023-12-25 02:58:41 +00:00
};
2023-12-21 03:59:19 +00:00
};
config = lib.mkIf cfg.enable {
### User running clash
users.groups."clash" = {};
users.users."clash" = {
isSystemUser = true;
group = config.users.groups."clash".name;
};
### systemd service
2023-12-23 08:47:14 +00:00
# https://en.clash.wiki/introduction/service.html#systemd
# https://wiki.metacubex.one/startup/service/#systemd
2023-12-21 03:59:19 +00:00
systemd.services."clash" = {
2023-12-23 08:47:14 +00:00
description = "Clash daemon, A rule-based proxy in Go.";
2023-12-21 03:59:19 +00:00
after = ["network-online.target"];
wantedBy = ["multi-user.target"];
serviceConfig = {
2023-12-23 08:47:14 +00:00
# TODO: DynamicUser
# DynamicUser = true;
User = config.users.users."clash".name;
Group = config.users.groups."clash".name;
2023-12-23 08:47:14 +00:00
# https://man.archlinux.org/man/systemd.exec.5
ConfigurationDirectory = "clash";
LoadCredential = "configuration:${cfg.configFile}";
2023-12-25 02:58:41 +00:00
ExecStart = builtins.replaceStrings ["\n"] [" "] ''
${lib.getExe cfg.package}
-d /etc/clash
${lib.optionalString (cfg.configFile != null) "-f \${CREDENTIALS_DIRECTORY}/configuration"}
2023-12-31 12:22:48 +00:00
${lib.optionalString (cfg.webui != null) "-ext-ui ${cfg.webui}"}
2023-12-25 02:58:41 +00:00
${lib.optionalString (cfg.extraOpts != null) cfg.extraOpts}
'';
2023-12-23 08:47:14 +00:00
# Capability, inherited from Clash wiki
# https://man.archlinux.org/man/core/man-pages/capabilities.7.en
CapabilityBoundingSet = ["CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE" "CAP_NET_RAW"];
AmbientCapabilities = ["CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE" "CAP_NET_RAW"];
2023-12-25 06:13:46 +00:00
# Hardening, experimental since I have no idea what am I doing
NoNewPrivileges = true;
MemoryDenyWriteExecute = true;
LockPersonality = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
ProtectSystem = "strict";
ProtectProc = "noaccess";
ProtectHome = true;
ProtectClock = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
ProtectKernelModules = true;
ProtectHostname = true;
ProtectKernelTunables = true;
PrivateDevices = true;
#PrivateNetwork = true;
PrivateTmp = true;
PrivateUsers = true;
PrivateMounts = true;
2023-12-21 03:59:19 +00:00
};
};
};
}