flake/users/guanranwang/nixos/profiles/use-cases/hysteria2-server.nix
2023-11-22 10:19:11 +08:00

60 lines
1.4 KiB
Nix

{
pkgs,
config,
...
}: let
etcDirectory = "hysteria";
port = 43956;
in {
imports = [
../../../../../../nixos/flake-modules/sops-nix.nix
];
### Firewall
networking.firewall = {
allowedTCPPorts = [port 80 443];
allowedUDPPorts = [port 80 443];
};
#### sops-nix
sops.secrets."hysteria-config" = {
owner = config.users.users."hysteria".name;
group = config.users.groups."hysteria".name;
restartUnits = ["hysteria-server.service"];
path = "/etc/${etcDirectory}/config.yaml";
};
### User running proxy service
users.groups."hysteria" = {};
users.users."hysteria" = {
isSystemUser = true;
group = config.users.groups."hysteria".name;
};
### Proxy service
systemd.services."hysteria-server" = {
description = "Hysteria Server";
after = ["network.target"];
wantedBy = ["multi-user.target"];
serviceConfig = {
Type = "simple";
WorkingDirectory = "/etc/${etcDirectory}";
User = [config.users.users."hysteria".name];
Group = [config.users.groups."hysteria".name];
ExecStart = "${pkgs.hysteria}/bin/hysteria server --config /etc/${etcDirectory}/config.yaml";
Restart = "on-failure";
CapabilityBoundingSet = [
"CAP_NET_ADMIN"
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW"
];
AmbientCapabilities = [
"CAP_NET_ADMIN"
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW"
];
};
};
}