From b10ee9a456ee10347e5e160458afb6578476e8e2 Mon Sep 17 00:00:00 2001 From: Mel Date: Fri, 1 May 2026 19:27:32 +0200 Subject: Add Tunnel egress Xray fallback to re-enable all web & Nginx functionality Signed-off-by: Mel --- modules/tunnel/egress.nix | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) (limited to 'modules/tunnel') diff --git a/modules/tunnel/egress.nix b/modules/tunnel/egress.nix index 4334f80..55946ce 100644 --- a/modules/tunnel/egress.nix +++ b/modules/tunnel/egress.nix @@ -7,12 +7,11 @@ }: let - inherit (lib) findFirst mkForce; + inherit (lib) findFirst; # this is the https port, we use it to try to trick dpi into thinking # we are just serving normal encrypted web traffic, nothing interesting! :) - # this does mean that our egress servers are unable to support normal www - # services which we put on machines by default, which is okay. + # requests which fail vless authentication are forwarded to nginx via fallbacks. port = 443; # supposedly the current gold-standard protocol for circumventing dpi! @@ -23,6 +22,9 @@ let inboundTag = "vless-in"; outboundTag = "direct-out"; + # xray falls back to nginx on this port for non-vless requests. + nginxPort = 8443; + definition = import ./definition.nix; inherit (definition) paths mask; @@ -44,6 +46,9 @@ let } ]; decryption = "none"; + fallbacks = [ + { dest = "127.0.0.1:${toString nginxPort}"; xver = 1; } + ]; }; streamSettings = { @@ -131,7 +136,16 @@ in settingsFile = "/run/xray-configuration/xray.json"; }; - # nginx can not run on an egress node because xray has to run on port 443. - services.nginx.enable = mkForce false; - systemd.services.nginx.enable = mkForce false; + services.nginx = { + defaultListen = [ + { addr = "127.0.0.1"; port = nginxPort; ssl = true; proxyProtocol = true; } + ]; + + # xray sends proxy protocol v1 to nginx, allowing us to + # extract the real client ip from the proxy protocol header. + commonHttpConfig = '' + set_real_ip_from 127.0.0.1; + real_ip_header proxy_protocol; + ''; + }; } -- cgit 1.4.1