nixos/hysteria: init

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -110,6 +110,8 @@
 
 - [Collabora Online](https://www.collaboraonline.com/), a collaborative online office suite based on LibreOffice technology. Available as [services.collabora-online](options.html#opt-services.collabora-online.enable).
 
+- [Hysteria](https://hysteria.network/), a powerful, lightning fast and censorship resistant proxy. Available as [services.hysteria.enable](#opt-services.hysteria.enable).
+
 - [wg-access-server](https://github.com/freifunkMUC/wg-access-server/), an all-in-one WireGuard VPN solution with a web ui for connecting devices. Available at [services.wg-access-server](#opt-services.wg-access-server.enable).
 
 - [Pingvin Share](https://github.com/stonith404/pingvin-share), a self-hosted file sharing platform and an alternative for WeTransfer. Available as [services.pingvin-share](#opt-services.pingvin-share.enable).

nixos/modules/module-list.nix

@@ -1061,6 +1061,7 @@
   ./services/networking/htpdate.nix
   ./services/networking/https-dns-proxy.nix
   ./services/networking/hylafax/default.nix
+  ./services/networking/hysteria.nix
   ./services/networking/i2p.nix
   ./services/networking/i2pd.nix
   ./services/networking/icecream/daemon.nix

nixos/modules/services/networking/hysteria.nix

@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.hysteria;
+  settingsFormat = pkgs.formats.json { };
+in
+{
+  options.services.hysteria = {
+    enable = lib.mkEnableOption "Hysteria, a powerful, lightning fast and censorship resistant proxy";
+
+    package = lib.mkPackageOption pkgs "hysteria" { };
+
+    mode = lib.mkOption {
+      type = lib.types.enum [
+        "server"
+        "client"
+      ];
+      default = "server";
+      description = "Whether to use Hysteria as a client or a server.";
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule { freeformType = settingsFormat.type; };
+      default = { };
+      description = ''
+        The Hysteria configuration, see https://hysteria.network/ for documentation.
+
+        Options containing secret data should be set to an attribute set
+        containing the attribute `_secret` - a string pointing to a file
+        containing the value the option should be set to.
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    systemd.services.hysteria = {
+      description = "Hysteria daemon, a powerful, lightning fast and censorship resistant proxy.";
+      documentation = [ "https://hysteria.network/" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      preStart = utils.genJqSecretsReplacementSnippet cfg.settings "/run/hysteria/config.json";
+      serviceConfig = {
+        ExecStart = lib.concatStringsSep " " [
+          (lib.getExe cfg.package)
+          cfg.mode
+          "--config /run/hysteria/config.json"
+        ];
+
+        DynamicUser = true;
+        RuntimeDirectory = "hysteria";
+
+        ### Hardening
+        AmbientCapabilities = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_NET_RAW"
+        ];
+        CapabilityBoundingSet = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_NET_RAW"
+        ];
+        NoNewPrivileges = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "@system-service";
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ Guanran928 ];
+}

pkgs/tools/networking/hysteria/default.nix

@@ -1,6 +1,8 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  makeBinaryWrapper,
 }:
 buildGoModule rec {
   pname = "hysteria";
@@ -17,16 +19,23 @@ buildGoModule rec {
   proxyVendor = true;
 
   ldflags =
-    let cmd = "github.com/apernet/hysteria/app/cmd";
-    in [
+    let
+      cmd = "github.com/apernet/hysteria/app/cmd";
+    in
+    [
       "-s"
       "-w"
       "-X ${cmd}.appVersion=${version}"
       "-X ${cmd}.appType=release"
     ];
 
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
   postInstall = ''
     mv $out/bin/app $out/bin/hysteria
+
+    wrapProgram $out/bin/hysteria \
+      --add-flags "--disable-update-check"
   '';
 
   # Network required