From dfd022660cde3d774d189d026dc11c757d11413e Mon Sep 17 00:00:00 2001
From: Guanran Wang <guanran928@outlook.com>
Date: Thu, 21 Dec 2023 11:59:19 +0800
Subject: [PATCH] nixos/clash: init

---
 nixos/modules/default.nix                     |  3 ++
 nixos/modules/services/clash.nix              | 47 +++++++++++++++++
 nixos/modules/services/default.nix            |  5 ++
 nixos/profiles/opt-in/impermanence.nix        |  2 +-
 .../profiles/opt-in/clash-meta-client.nix     | 50 ++++---------------
 5 files changed, 66 insertions(+), 41 deletions(-)
 create mode 100644 nixos/modules/services/clash.nix
 create mode 100755 nixos/modules/services/default.nix

diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix
index e7097fa..9dd373f 100644
--- a/nixos/modules/default.nix
+++ b/nixos/modules/default.nix
@@ -2,5 +2,8 @@
   imports = [
     # utils that is used internally
     ./myFlake
+
+    # nixpkgs styled options
+    ./services
   ];
 }
diff --git a/nixos/modules/services/clash.nix b/nixos/modules/services/clash.nix
new file mode 100644
index 0000000..2cc12d4
--- /dev/null
+++ b/nixos/modules/services/clash.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
+  cfg = config.services.clash;
+in {
+  options.services.clash = {
+    enable = lib.mkEnableOption "Whether to enable Clash.";
+    package = lib.mkPackageOption pkgs "clash" {};
+  };
+
+  config = lib.mkIf cfg.enable {
+    ### User running clash
+    users.groups."clash" = {};
+    users.users."clash" = {
+      isSystemUser = true;
+      group = config.users.groups."clash".name;
+    };
+
+    ### systemd service
+    systemd.services."clash" = {
+      description = "Clash Daemon";
+      after = ["network-online.target"];
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        Type = "simple";
+        WorkingDirectory = "/etc/clash";
+        User = [config.users.users."clash".name];
+        Group = [config.users.groups."clash".name];
+        ExecStart = "${lib.getExe cfg.package} -d /etc/clash";
+        Restart = "on-failure";
+        CapabilityBoundingSet = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_NET_RAW"
+        ];
+        AmbientCapabilities = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_NET_RAW"
+        ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/default.nix b/nixos/modules/services/default.nix
new file mode 100755
index 0000000..ac1fa35
--- /dev/null
+++ b/nixos/modules/services/default.nix
@@ -0,0 +1,5 @@
+{...}: {
+  imports = [
+    ./clash.nix
+  ];
+}
diff --git a/nixos/profiles/opt-in/impermanence.nix b/nixos/profiles/opt-in/impermanence.nix
index db88611..e3c55c0 100644
--- a/nixos/profiles/opt-in/impermanence.nix
+++ b/nixos/profiles/opt-in/impermanence.nix
@@ -9,7 +9,7 @@
       "/var/log"
       "/var/lib"
 
-      "/etc/clash-meta" # clash-meta
+      "/etc/clash" # clash
       "/etc/secureboot" # sbctl, lanzaboote
     ];
     files = [
diff --git a/users/guanranwang/nixos/profiles/opt-in/clash-meta-client.nix b/users/guanranwang/nixos/profiles/opt-in/clash-meta-client.nix
index ac4fd4e..6b18301 100644
--- a/users/guanranwang/nixos/profiles/opt-in/clash-meta-client.nix
+++ b/users/guanranwang/nixos/profiles/opt-in/clash-meta-client.nix
@@ -2,54 +2,24 @@
   pkgs,
   config,
   inputs,
-  lib,
   ...
 }: {
+  services.clash = {
+    enable = true;
+    package = pkgs.clash-meta;
+  };
+
   ### sops-nix
   sops.secrets."clash-config" = {
-    owner = config.users.users."clash-meta".name;
-    group = config.users.groups."clash-meta".name;
-    restartUnits = ["clash-meta.service"];
-    path = "/etc/clash-meta/config.yaml";
+    owner = config.users.users."clash".name;
+    group = config.users.groups."clash".name;
+    restartUnits = ["clash.service"];
+    path = "/etc/clash/config.yaml";
   };
 
   ### System proxy settings
   networking.proxy.default = "http://127.0.0.1:7890/";
 
-  ### User running proxy service
-  users.groups."clash-meta" = {};
-  users.users."clash-meta" = {
-    isSystemUser = true;
-    group = config.users.groups."clash-meta".name;
-  };
-
-  ### Proxy service
-  systemd.services."clash-meta" = {
-    description = "Clash.Meta Client";
-    after = ["network-online.target"];
-
-    wantedBy = ["multi-user.target"];
-
-    serviceConfig = {
-      Type = "simple";
-      WorkingDirectory = "/etc/clash-meta";
-      User = [config.users.users."clash-meta".name];
-      Group = [config.users.groups."clash-meta".name];
-      ExecStart = "${lib.getExe pkgs.clash-meta} -d /etc/clash-meta";
-      Restart = "on-failure";
-      CapabilityBoundingSet = [
-        "CAP_NET_ADMIN"
-        "CAP_NET_BIND_SERVICE"
-        "CAP_NET_RAW"
-      ];
-      AmbientCapabilities = [
-        "CAP_NET_ADMIN"
-        "CAP_NET_BIND_SERVICE"
-        "CAP_NET_RAW"
-      ];
-    };
-  };
-
   ### Local Clash WebUI
   # You can also use the following website, just in case:
   # - metacubexd:
@@ -60,5 +30,5 @@
   #   - https://yacd.haishan.me
   # - clash-dashboard (buggy):
   #   - https://clash.razord.top
-  environment.etc."clash-meta/metacubexd".source = inputs.self.packages.${pkgs.system}.metacubexd;
+  environment.etc."clash/metacubexd".source = inputs.self.packages.${pkgs.system}.metacubexd;
 }