1 files changed, 20 insertions, 6 deletions
diff --git a/modules/tunnel/egress.nix b/modules/tunnel/egress.nix
index 4334f80..55946ce 100644
--- a/modules/tunnel/egress.nix
+++ b/modules/tunnel/egress.nix
@@ -7,12 +7,11 @@
 }:
 
 let
-  inherit (lib) findFirst mkForce;
+  inherit (lib) findFirst;
 
   # this is the https port, we use it to try to trick dpi into thinking
   # we are just serving normal encrypted web traffic, nothing interesting! :)
-  # this does mean that our egress servers are unable to support normal www
-  # services which we put on machines by default, which is okay.
+  # requests which fail vless authentication are forwarded to nginx via fallbacks.
   port = 443;
 
   # supposedly the current gold-standard protocol for circumventing dpi!
@@ -23,6 +22,9 @@ let
   inboundTag = "vless-in";
   outboundTag = "direct-out";
 
+  # xray falls back to nginx on this port for non-vless requests.
+  nginxPort = 8443;
+
   definition = import ./definition.nix;
   inherit (definition) paths mask;
 
@@ -44,6 +46,9 @@ let
             }
           ];
           decryption = "none";
+          fallbacks = [
+            { dest = "127.0.0.1:${toString nginxPort}"; xver = 1; }
+          ];
         };
 
         streamSettings = {
@@ -131,7 +136,16 @@ in
     settingsFile = "/run/xray-configuration/xray.json";
   };
 
-  # nginx can not run on an egress node because xray has to run on port 443.
-  services.nginx.enable = mkForce false;
-  systemd.services.nginx.enable = mkForce false;
+  services.nginx = {
+    defaultListen = [
+      { addr = "127.0.0.1"; port = nginxPort; ssl = true; proxyProtocol = true; }
+    ];
+
+    # xray sends proxy protocol v1 to nginx, allowing us to
+    # extract the real client ip from the proxy protocol header.
+    commonHttpConfig = ''
+      set_real_ip_from 127.0.0.1;
+      real_ip_header proxy_protocol;
+    '';
+  };
 }