asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

xray: start sing-box on demand only

Browse source 
dpi-tunnel is now the default full tunnel. Keep the sing-box TUN for
manual use (systemctl start sing-box) instead of starting it at boot.

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-08 05:08:45 +04:00
commit 6942303ef4
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -10,7 +10,7 @@ Flake-based NixOS configuration for a ThinkPad P14s Gen 6 (AMD), tracking `nixos
- **Secrets**: [sops-nix](https://github.com/Mic92/sops-nix) with age — xray config, WireGuard, SSH keys, private routes/hosts; encrypted files stay out of the repo (only `.example` structure files are tracked), decrypted to `/run/secrets` at activation - **Secrets**: [sops-nix](https://github.com/Mic92/sops-nix) with age — xray config, WireGuard, SSH keys, private routes/hosts; encrypted files stay out of the repo (only `.example` structure files are tracked), decrypted to `/run/secrets` at activation
- **Desktop**: GNOME on Wayland, AMD GPU - **Desktop**: GNOME on Wayland, AMD GPU
- **Local LLMs**: Ollama with ROCm (gfx1151) + Lemonade for XDNA2 NPU serving via [nix-amd-ai](https://github.com/noamsto/nix-amd-ai) - **Local LLMs**: Ollama with ROCm (gfx1151) + Lemonade for XDNA2 NPU serving via [nix-amd-ai](https://github.com/noamsto/nix-amd-ai)
- **Networking**: Xray VLESS+Reality with sing-box TUN, WireGuard, WWAN modem - **Networking**: dpi-tunnel (Xray VLESS+Reality+PQ, full tunnel on `tun1`), Xray+sing-box TUN (on demand), WireGuard, WWAN modem
- **Gaming**: Steam with gamescope, declarative Flatpaks via [nix-flatpak](https://github.com/gmodena/nix-flatpak) - **Gaming**: Steam with gamescope, declarative Flatpaks via [nix-flatpak](https://github.com/gmodena/nix-flatpak)
- **Litecoin Core (MWEB)**: vendored package build, revived after removal from nixpkgs - **Litecoin Core (MWEB)**: vendored package build, revived after removal from nixpkgs
- **Power**: AMD P-State tuning, zram swap ahead of disk swap - **Power**: AMD P-State tuning, zram swap ahead of disk swap

3
modules/xray.nix
View file

@ -128,6 +128,9 @@
CapabilityBoundingSet = [ "CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE" ]; CapabilityBoundingSet = [ "CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE" ];
}; };
# Off by default: start on demand with `systemctl start sing-box`
systemd.services.sing-box.wantedBy = lib.mkForce [ ];
# Firefox dev edition # Firefox dev edition
programs.firefox = { programs.firefox = {
enable = true; enable = true;