modules/network: enable dae on mainland machines

machines/calcite/network.nix

@@ -31,12 +31,12 @@ in
   };
   # services.tailscale.useRoutingFeatures = "both";
 
-  services.dae.enable = true;
+  # services.dae.enable = true;
-  services.dae.configFile = "/var/lib/dae/config.dae";
+  # services.dae.configFile = "/var/lib/dae/config.dae";
-  systemd.services.dae.after = lib.mkIf (config.networking.networkmanager.enable) [
+  # systemd.services.dae.after = lib.mkIf (config.networking.networkmanager.enable) [
-    "NetworkManager-wait-online.service"
+  #   "NetworkManager-wait-online.service"
-  ];
+  # ];
-
+  #
   # Open ports in the firewall.
   networking.firewall.enable = true;
   networking.firewall.allowedTCPPorts = [ 3389 ];

machines/secrets.yaml

@@ -1,6 +1,8 @@
 prometheus:
     metrics_username: ENC[AES256_GCM,data:/CQfOA==,iv:BjhB+uLfjmYHdgpc/+tDJXJ8C1EK9kngQWbo4NleOmE=,tag:JCdqyqGLRh09T25vmufiZw==,type:str]
     metrics_password: ENC[AES256_GCM,data:q/xMPuNtlcUFewMdVu6w2Q==,iv:xLohdb5tdxevYFckZoacjSJp2rZ53QKLxK6u3mc3mDw=,tag:B4LrObH1DsnnD5CcuOPOyg==,type:str]
+dae:
+    sub: ENC[AES256_GCM,data:kruAGgIBwiN508hwczGeVmh6Jr4Mg9BNEWSBNfYnBCCOrkSM1I5GRuG8EZqTq1+Ib+TRN8cgaqCEk2mpZ+7po1FjW1K8M0EBj9QvQCs7a+QVSmP6qS14WY1B,iv:iMhxWb0IR+3jOP2+7GmQTe0Ia1yhycji4hcTTMK57GI=,tag:V/nZgi7AWHU2Kp5WGhaGAw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -88,8 +90,8 @@ sops:
             am04NVRtU2N6SThYZWdXVE5RZ1B2aE0KVcHvB5k2Gcu/St0P8WPFzlCtuZthZTKo
             hwVc0lC6Xxt25hriaUFinwnyvcjxrLCx0Nq7f9Zn16nJcza5kev1nQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-30T06:31:42Z"
+    lastmodified: "2025-04-10T03:53:49Z"
-    mac: ENC[AES256_GCM,data:xh8x9IrQ01ZzdcCTIfBrifIGduMYVmSSP52BkTyr/bx7AgQAz2WeA7LFrccxIayCGHrQKfMQDLUKJ/EBamG/6p8AX6QqZBTfqFD688ZhmRfxgpj7fYR9jPYnhb/9XHI9R2jTaJWwrorXvu3pa+Gy/hWB3Kb+WZc3fslmIuKuLH0=,iv:GDrHSFZxPbpACdusVDPHXEjeEusYfk53N/KGHtdvrYo=,tag:ap38sCSTZVDQ0ZazXM3vlg==,type:str]
+    mac: ENC[AES256_GCM,data:ioiGVfCWOn8Hc5EpCtcDTF4YoKtsMAchBlRM0C00WQbM9Ss3571Oly4jtymshDVbDFbH+y0gYcEXn8Fs5XYjd0rIa6mbaISLvPlG+P34SqHcVsh6eDU15z0vTAncbOHrok+/xAmg64WtiBxteMaWPsTVngCrmPYS247eCav+Jpo=,iv:K7PiHNn2IS0pGUh1F75TjliHMk8l6PaHmDshSPPA4BE=,tag:Jd/lHdeWUDQa5AwSwFCeSw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.4

modules/nixos/common-settings/mainland.nix

@@ -16,10 +16,16 @@ let
   cfg = config.inMainland;
 in
 {
-  options.inMainland = mkOption {
+  options = {
+    inMainland = mkOption {
       type = types.bool;
       default = config.time.timeZone == "Asia/Shanghai";
     };
+    commonSettings.network.enableProxy = mkOption {
+      type = types.bool;
+      default = config.inMainland;
+    };
+  };
 
   config = mkIf cfg {
     nix.settings.extra-substituters = [
@@ -31,9 +37,136 @@ in
       "ntp.ntsc.ac.cn"
     ];
 
-    services.dae = {
+    sops = mkIf config.commonSettings.network.enableProxy {
+      secrets = {
+        "dae/sub" = {
+          sopsFile = ../../../machines/secrets.yaml;
+        };
+      };
+      templates."dae/sub.dae".content = ''
+        subscription {
+          my_sub: '${config.sops.placeholder."dae/sub"}'
+        }
+      '';
+    };
+
+    systemd.services.dae.serviceConfig.LoadCredential = mkIf config.commonSettings.network.enableProxy [
+      "sub.dae:${config.sops.templates."dae/sub.dae".path}"
+    ];
+
+    services.dae = mkIf config.commonSettings.network.enableProxy {
       enable = mkDefault true;
-      configFile = mkDefault "/var/lib/dae/config.dae";
+      config = ''
+        include {
+          ./sub.dae
+        }
+        global {
+          tproxy_port: 12345
+          tproxy_port_protect: true
+          so_mark_from_dae: 0
+          log_level: info
+          disable_waiting_network: false
+
+          ##### Interface and kernel options.
+          # lan_interface: docker0
+          wan_interface: auto
+
+          auto_config_kernel_parameter: true
+
+          ##### Node connectivity check.
+          tcp_check_url: 'http://cp.cloudflare.com,1.1.1.1,2606:4700:4700::1111'
+          tcp_check_http_method: HEAD
+
+          udp_check_dns: 'dns.quad9.net:53,9.9.9.9,2620:fe::fe'
+
+          check_interval: 30s
+
+          # Group will switch node only when new_latency <= old_latency - tolerance.
+          check_tolerance: 100ms 
+
+          ##### Connecting options.
+
+          
+          dial_mode: ${if config.commonSettings.network.localdns.enable then "domain+" else "domain"}
+          allow_insecure: false
+          sniffing_timeout: 100ms
+          tls_implementation: tls
+          # utls_imitate: firefox_auto
+
+          mptcp: true
+        }
+
+        # See https://github.com/daeuniverse/dae/blob/main/docs/en/configuration/dns.md for full examples.
+        dns {
+          ipversion_prefer: 4
+
+          upstream {
+        	    globaldns: 'tls://dns.quad9.net'
+        	    cndns: 'h3://dns.alidns.com:443'
+        	    tsdns: 'udp://100.100.100.100'
+        	    localdns: 'udp://127.0.0.1:53' 
+          }
+
+          routing {
+            request {
+              ${
+                if config.commonSettings.network.localdns.enable then
+                  ''
+                    fallback: localdns
+                  ''
+                else
+                  ''
+                    qname(suffix:ts.net) -> tsdns
+                    qname(geosite:cn) -> cndns
+                    fallback: globaldns
+                  ''
+              }
+            }
+          }
+        }
+
+        # Node group (outbound).
+        group {
+          default_group {
+            filter: name(regex: '^(hk)[0-9]+') [add_latency: -30ms]
+            filter: name(regex: '^(la)[0-9]+') [add_latency: -140ms]
+            filter: name(regex: '^(fra)[0-9]+') [add_latency: -150ms]
+            policy: min_moving_avg
+          }
+        }
+
+        # See https://github.com/daeuniverse/dae/blob/main/docs/en/configuration/routing.md for full examples.
+        routing {
+          # pname(kresd) && dport(53) && l4proto(udp)-> must_direct
+          # Disable h3 because it usually consumes too much cpu/mem resources.
+          l4proto(udp) && dport(443) -> block
+
+          pname(blackbox_exporter) -> direct
+          pname(tailscaled) -> direct
+
+          dip(224.0.0.0/3, 'ff00::/8') -> direct
+          dip(geoip:private) -> direct
+
+          # Direct traffic to dns server
+          dip(1.12.12.12) -> direct
+          dip(223.5.5.5) -> direct
+          dip(223.6.6.6) -> direct
+
+          # === Force Proxy ===
+          domain(geosite:linkedin) -> default_group
+
+          # === Custom direct rules ===
+          domain(geosite:cn) -> direct
+
+          domain(suffix:ipify.org) -> direct
+          domain(geosite:steam@cn) -> direct
+
+          dip(geoip:cn) -> direct
+
+          fallback: default_group
+        }
+      '';
+
     };
   };
 }

note.md

@@ -8,3 +8,4 @@ Demonstrate disk usage by nix-store path.
 - [x] synapse jmalloc
 - [ ] backup all directories under /var/lib/forgejo
 - [ ] collect caddy access logs with promtail (waiting for caddy v2.9.0 release after which log file mode can be set)
+- [ ] update "https" to "https-file" with dae 1.0.0