diff --git a/nixos/modules/services/clash.nix b/nixos/modules/services/clash.nix
index 799c419..94669af 100644
--- a/nixos/modules/services/clash.nix
+++ b/nixos/modules/services/clash.nix
@@ -9,6 +9,20 @@ in {
   options.services.clash = {
     enable = lib.mkEnableOption "Whether to enable Clash, A rule-based proxy in Go";
     package = lib.mkPackageOption pkgs "clash" {};
+
+    # TODO
+    webui = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.path;
+    };
+    configFile = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.path;
+    };
+    extraOpts = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.string;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -35,7 +49,13 @@ in {
         ConfigurationDirectory = "clash";
         User = [config.users.users."clash".name];
         Group = [config.users.groups."clash".name];
-        ExecStart = "${lib.getExe cfg.package} -d /etc/clash";
+        ExecStart = builtins.replaceStrings ["\n"] [" "] ''
+          ${lib.getExe cfg.package}
+          -d /etc/clash
+          ${lib.optionalString (cfg.webui != null) "-ext-ui ${cfg.webui}"}
+          ${lib.optionalString (cfg.configFile != null) "-f ${cfg.configFile}"}
+          ${lib.optionalString (cfg.extraOpts != null) cfg.extraOpts}
+        '';
 
         # Capability, inherited from Clash wiki
         # https://man.archlinux.org/man/core/man-pages/capabilities.7.en
diff --git a/users/guanranwang/nixos/profiles/opt-in/clash-meta-client.nix b/users/guanranwang/nixos/profiles/opt-in/clash-meta-client.nix
index 6b18301..4ca7929 100644
--- a/users/guanranwang/nixos/profiles/opt-in/clash-meta-client.nix
+++ b/users/guanranwang/nixos/profiles/opt-in/clash-meta-client.nix
@@ -7,6 +7,8 @@
   services.clash = {
     enable = true;
     package = pkgs.clash-meta;
+    configFile = config.sops.secrets."clash-config".path;
+    webui = inputs.self.packages.${pkgs.system}.metacubexd;
   };
 
   ### sops-nix
@@ -14,7 +16,6 @@
     owner = config.users.users."clash".name;
     group = config.users.groups."clash".name;
     restartUnits = ["clash.service"];
-    path = "/etc/clash/config.yaml";
   };
 
   ### System proxy settings
@@ -30,5 +31,4 @@
   #   - https://yacd.haishan.me
   # - clash-dashboard (buggy):
   #   - https://clash.razord.top
-  environment.etc."clash/metacubexd".source = inputs.self.packages.${pkgs.system}.metacubexd;
 }