sin0: add ip-checker

This commit is contained in:
Guanran Wang 2024-10-19 12:54:55 +08:00
parent 73ad793310
commit 60d435c2af
Signed by: nyancat
GPG key ID: 91F97D9ED12639CF
3 changed files with 55 additions and 0 deletions

View file

@ -5,6 +5,7 @@
./ports.nix
./services/telegram-bot/danbooru_img_bot.nix
./services/ip-checker.nix
./services/redlib.nix
../../../nixos/profiles/sing-box-server

View file

@ -1,5 +1,6 @@
{
lib.ports = {
redlib = 8010;
ip-checker = 8020;
};
}

View file

@ -0,0 +1,53 @@
{
lib,
pkgs,
inputs,
config,
...
}:
let
port = config.lib.ports.ip-checker;
in
{
systemd.services."ip-checker" = {
wantedBy = [ "multi-user.target" ];
environment.IP_CHECKER_LISTEN = "127.0.0.1:${toString port}";
serviceConfig = {
ExecStart = lib.getExe inputs.ip-checker.packages.${pkgs.stdenv.hostPlatform.system}.default;
WorkingDirectory = inputs.ip-checker;
CapabilityBoundingSet = "";
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallErrorNumber = "EPERM";
SystemCallFilter = "@system-service";
UMask = "0077";
};
};
services.caddy.settings.apps.http.servers.srv0.routes = lib.singleton {
match = lib.singleton { host = [ "ip.ny4.dev" ]; };
handle = lib.singleton {
handler = "reverse_proxy";
upstreams = lib.singleton { dial = "127.0.0.1:${toString port}"; };
};
};
}