feat(nixos): netherlands xray

nixos/module/hectic/hardware/geo-hosting.nix

@@ -0,0 +1,102 @@
+{ 
+  inputs,
+  flake,
+  self,
+}:
+{ 
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.hectic.hardware.geo-hosting;
+in {
+  options.hectic.hardware.geo-hosting = {
+    enable = lib.mkEnableOption "Enable geo-hosting hardware configurations";
+    ipv4Gateway = lib.mkOption {
+      type        = lib.types.strMatching "^([0-9]{1,3}\\.){3}[0-9]{1,3}$";
+      example     = "188.243.124.1";
+      description = ''
+        
+      '';
+    };
+    ipv4 = lib.mkOption {
+      type        = lib.types.strMatching "^([0-9]{1,3}\\.){3}[0-9]{1,3}$";
+      example     = "188.243.124.246";
+      description = ''
+        
+      '';
+    };
+    device = lib.mkOption {
+      type = lib.types.str;
+      default = "/dev/vda";
+      example = "/dev/disk/by-uuid/f184a16b-6eca-41cb-b48a-ff37cdce1d79";
+      description = ''
+        boot device uuid 
+        if it is null then will use "/dev/vda" 
+        /dev/sva - default geo hosting device
+        !! But can changes on reboot if server have volumes
+        !! So use IDs
+      '';
+    };
+    networkMatchConfigName = lib.mkOption {
+      type = lib.types.strMatching "^(enp1s0|ens3)$";
+      example = "ens3";
+      description = ''
+        type of network conection
+
+        you can use `networkctl list` on server to know it
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.loader.systemd-boot.enable = false;
+    boot.loader.efi.canTouchEfiVariables = false;
+    
+    boot.loader.grub = {
+      enable = true;
+      device = cfg.device;
+      efiSupport = false;
+      forceInstall = true;
+    };
+
+    disko.devices.disk.vda = {
+      device = cfg.device;
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          ESP = {
+            size = "512M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+              mountOptions = [ "umask=0077" ];
+            };
+          };
+          root = {
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          };
+        };
+      };
+    };
+
+
+    networking.useDHCP = false;
+    networking.interfaces.${cfg.networkMatchConfigName} = {
+      ipv4.addresses = [
+        { address = cfg.ipv4; prefixLength = 24; }
+      ];
+    };
+    networking.defaultGateway = cfg.ipv4Gateway;
+    networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
+  };
+}

nixos/system/xray/xray.nix

@@ -11,54 +11,72 @@
 }: let
   xrayPort = 10086;
 in {
+  # TODO:
+  # white list
+  # torent
+  # rate limit
+  # ping - game and speak
+ 
   imports = [
     self.nixosModules.hectic
+    inputs.sops-nix.nixosModules.sops
   ];
 
   services.xray = {
     enable  = true;
-    settings = {
-      "inbounds" = [
-        {
-          "port" = xrayPort;
-          "protocol" = "vmess";
-          "settings" = {
-            "clients" = [
-              {
-                "id" = "04ad600a-0e94-4ba6-af93-74e03fd3f58d";
-              }
-            ];
-          };
-        }
-      ];
-      "log" = {
-        "loglevel" = "warning";
-      };
-      "outbounds" = [
-        {
-          "protocol" = "freedom";
-        }
-      ];
-    };
+    settingsFile = config.sops.secrets."config".path;
   };
 
   users.users.root.openssh.authorizedKeys.keys = [
-    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPPChQvpyOrPjRjp8pS5Yw+oJVmywDzefzZCXh1d44EY''
-    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP3HjFoJNGHqHoEw9XLzh766QWknfaN07GGi8lsC2Tv''
+    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOn1KflaIX1RU9YS/qLb0GInmndYxx2vTLZC9OA+eXZl''
   ];
 
+  boot.loader.grub.device =  "/dev/vda";
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+  ] ++ (if pkgs.system != "aarch64-linux" then [ "vmw_pvscsi" ] else []);
+  boot.initrd.kernelModules = ["nvme"];
+
+  disko.devices = {
+    disk.vda = {
+      device = lib.mkDefault "/dev/vda";
+      content = {
+        type = "table";
+        format = "msdos";
+        partitions = [
+          {
+            name = "root";
+            part-type = "primary";
+            fs-type = "ext4";
+            bootable = true;
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          }
+        ];
+      };
+    };
+  };
+
  
   hectic = {
     archetype.base.enable = true;
     archetype.dev.enable  = true;
-    hardware.hetzner-cloud = {
-      enable                 = true;
-      networkMatchConfigName = "enp1s0";
-      ipv4                   = "77.42.45.173";
-      ipv6                   = "2a01:4f9:c013:7230";
-    };
   };
 
+  sops = {
+    gnupg.sshKeyPaths        = [ ];
+    age.sshKeyPaths          = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    defaultSopsFile          = ../../../sus/bfs.xray.yaml;
+
+    secrets."config"         = {};
+  };
+
+
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [