Sergei Poljanski
ffb7554594
DPI on some uplinks throttles WireGuard. Tunnel everything through Xray VLESS + REALITY with post-quantum VLESS Encryption on tun1. Routes in the main table that are more specific than the default (LAN, wg* prefixes) keep priority; prefixes listed in the routes secret are forced through the tunnel. The client's own uplink is fwmarked so it never loops back into tun1. UDP sessions on the tun device stay pinned to a dead mux link after suspend or Wi-Fi loss, so restart the client on resume and whenever NetworkManager brings up a new uplink. Stopping the unit removes all the rules and routes. Secrets come from secrets/dpi-tunnel.yaml through sops. Only the .example skeleton is tracked. Assisted-by: Claude:opus-5-5
38 lines
1.2 KiB
Nix
38 lines
1.2 KiB
Nix
# NixOS Configuration
|
|
# Main entry point - imports modular configuration files
|
|
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
./modules/boot.nix
|
|
./modules/networking.nix
|
|
./modules/locale.nix
|
|
./modules/desktop.nix
|
|
./modules/users.nix
|
|
./modules/packages.nix
|
|
./modules/shell.nix
|
|
./modules/programs.nix
|
|
./modules/wireguard.nix
|
|
./modules/security.nix
|
|
./modules/sops.nix
|
|
./modules/power.nix
|
|
./modules/xray.nix
|
|
./modules/dpi-tunnel.nix
|
|
./modules/ollama.nix
|
|
./modules/lemonade.nix
|
|
./modules/gaming.nix
|
|
./modules/litecoin.nix
|
|
./modules/xfce-x11-test.nix
|
|
# ./modules/hostel-wifi.nix # disabled 2026-05-08 — re-enable when needed
|
|
];
|
|
|
|
# This value determines the NixOS release from which the default
|
|
# settings for stateful data, like file locations and database versions
|
|
# on your system were taken. It's perfectly fine and recommended to leave
|
|
# this value at the release version of the first install of this system.
|
|
# Before changing this value read the documentation for this option
|
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
|
|
system.stateVersion = "25.11";
|
|
}
|