nyancat/flake
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nixos/clash: minor adjustments

Browse source
This commit is contained in:
Guanran Wang 2023-12-23 16:47:14 +08:00
parent 5aa1ac83a6
commit 937c6bd39a
Signed by: nyancat
SSH key fingerprint: SHA256:8oWGKciPALWut/6WA27oFKofX+6Wtc0gQnsefXLQx/8
1 changed files with 15 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
nixos/modules/services/clash.nix
View file

@ -7,7 +7,7 @@
cfg = config.services.clash; cfg = config.services.clash;
in { in {
options.services.clash = { options.services.clash = {
enable = lib.mkEnableOption "Whether to enable Clash."; enable = lib.mkEnableOption "Whether to enable Clash, A rule-based proxy in Go";
package = lib.mkPackageOption pkgs "clash" {}; package = lib.mkPackageOption pkgs "clash" {};
}; };
@ -20,27 +20,27 @@ in {
}; };
### systemd service ### systemd service
# https://en.clash.wiki/introduction/service.html#systemd
# https://wiki.metacubex.one/startup/service/#systemd
systemd.services."clash" = { systemd.services."clash" = {
description = "Clash Daemon"; description = "Clash daemon, A rule-based proxy in Go.";
after = ["network-online.target"]; after = ["network-online.target"];
wantedBy = ["multi-user.target"]; wantedBy = ["multi-user.target"];
serviceConfig = { serviceConfig = {
Type = "simple"; # TODO: DynamicUser
WorkingDirectory = "/etc/clash"; # DynamicUser = true;
# LoadCredential = "credentials:${config.sops.secrets."clash-config".path}";
# https://man.archlinux.org/man/systemd.exec.5
ConfigurationDirectory = "clash";
User = [config.users.users."clash".name]; User = [config.users.users."clash".name];
Group = [config.users.groups."clash".name]; Group = [config.users.groups."clash".name];
ExecStart = "${lib.getExe cfg.package} -d /etc/clash"; ExecStart = "${lib.getExe cfg.package} -d /etc/clash";
Restart = "on-failure";
CapabilityBoundingSet = [ # Capability, inherited from Clash wiki
"CAP_NET_ADMIN" # https://man.archlinux.org/man/core/man-pages/capabilities.7.en
"CAP_NET_BIND_SERVICE" CapabilityBoundingSet = ["CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE" "CAP_NET_RAW"];
"CAP_NET_RAW" AmbientCapabilities = ["CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE" "CAP_NET_RAW"];
];
AmbientCapabilities = [
"CAP_NET_ADMIN"
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW"
];
}; };
}; };
}; };