flake/nixos/profiles/common/opt-in/_hysteria2-server.nix
2024-01-17 19:53:00 +08:00

55 lines
1.3 KiB
Nix

{
pkgs,
config,
...
}: let
port = 43956;
in {
### Firewall
networking.firewall = {
allowedTCPPorts = [port 80 443];
allowedUDPPorts = [port 80 443];
};
#### sops-nix
sops.secrets."hysteria-config" = {
owner = config.users.users."hysteria".name;
group = config.users.groups."hysteria".name;
restartUnits = ["hysteria-server.service"];
path = "/etc/hysteria/config.yaml";
};
### User running proxy service
users.groups."hysteria" = {};
users.users."hysteria" = {
isSystemUser = true;
group = config.users.groups."hysteria".name;
};
### Proxy service
systemd.services."hysteria-server" = {
description = "Hysteria Server";
after = ["network.target"];
wantedBy = ["multi-user.target"];
serviceConfig = {
Type = "simple";
WorkingDirectory = "/etc/hysteria";
User = [config.users.users."hysteria".name];
Group = [config.users.groups."hysteria".name];
ExecStart = "${pkgs.hysteria}/bin/hysteria server --config /etc/hysteria/config.yaml";
Restart = "on-failure";
CapabilityBoundingSet = [
"CAP_NET_ADMIN"
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW"
];
AmbientCapabilities = [
"CAP_NET_ADMIN"
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW"
];
};
};
}