feat: mautirx-telegram
This commit is contained in:
@@ -4,6 +4,9 @@
|
|||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
{
|
{
|
||||||
|
nixpkgs.config.permittedInsecurePackages = [
|
||||||
|
"olm-3.2.16"
|
||||||
|
];
|
||||||
sops.secrets.tuwunel-reg-token = {
|
sops.secrets.tuwunel-reg-token = {
|
||||||
sopsFile = secrets.tuwunel-reg-token;
|
sopsFile = secrets.tuwunel-reg-token;
|
||||||
format = "binary";
|
format = "binary";
|
||||||
@@ -22,17 +25,21 @@
|
|||||||
address = [ "127.0.0.1" ];
|
address = [ "127.0.0.1" ];
|
||||||
port = [ 8094 ];
|
port = [ 8094 ];
|
||||||
server_name = "imxyy.top";
|
server_name = "imxyy.top";
|
||||||
allow_registration = true;
|
|
||||||
registration_token_file = config.sops.secrets.tuwunel-reg-token.path;
|
|
||||||
well_known = {
|
well_known = {
|
||||||
server = "matrix.imxyy.top:443";
|
server = "matrix.imxyy.top:443";
|
||||||
client = "https://matrix.imxyy.top";
|
client = "https://matrix.imxyy.top";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
allow_registration = true;
|
||||||
|
registration_token_file = config.sops.secrets.tuwunel-reg-token.path;
|
||||||
|
|
||||||
turn_uris = [
|
turn_uris = [
|
||||||
"turn:hk.vkvm.imxyy.top?transport=udp"
|
"turn:hk.vkvm.imxyy.top?transport=udp"
|
||||||
"turn:hk.vkvm.imxyy.top?transport=tcp"
|
"turn:hk.vkvm.imxyy.top?transport=tcp"
|
||||||
];
|
];
|
||||||
turn_secret_file = config.sops.secrets.tuwunel-turn-secret.path;
|
turn_secret_file = config.sops.secrets.tuwunel-turn-secret.path;
|
||||||
|
|
||||||
|
new_user_displayname_suffix = "";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
services.caddy.virtualHosts."imxyy.top" = {
|
services.caddy.virtualHosts."imxyy.top" = {
|
||||||
@@ -56,4 +63,40 @@
|
|||||||
reverse_proxy :8094
|
reverse_proxy :8094
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
sops.secrets.mautrix-telegram = {
|
||||||
|
sopsFile = secrets.mautrix-telegram;
|
||||||
|
format = "dotenv";
|
||||||
|
owner = "mautrix-telegram";
|
||||||
|
group = "mautrix-telegram";
|
||||||
|
};
|
||||||
|
services.mautrix-telegram = {
|
||||||
|
enable = true;
|
||||||
|
environmentFile = config.sops.secrets.mautrix-telegram.path;
|
||||||
|
settings = {
|
||||||
|
homeserver = {
|
||||||
|
address = "http://127.0.0.1:8094";
|
||||||
|
domain = "imxyy.top";
|
||||||
|
};
|
||||||
|
appservice = {
|
||||||
|
address = "http://127.0.0.1:8098";
|
||||||
|
hostname = "127.0.0.1";
|
||||||
|
port = "8098";
|
||||||
|
bot_username = "telegrambot";
|
||||||
|
};
|
||||||
|
bridge = {
|
||||||
|
username_template = "telegram_{userid}";
|
||||||
|
alias_template = "telegram_{groupname}";
|
||||||
|
displayname_template = "{displayname} (Telegram)";
|
||||||
|
permissions = {
|
||||||
|
"@imxyy_soope_:imxyy.top" = "admin";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
telegram = {
|
||||||
|
# borrowed from https://github.com/telegramdesktop/tdesktop/blob/9bdc19e2fd4d497c8f403891848383a88faadc25/snap/snapcraft.yaml#L134-L135
|
||||||
|
api_id = "611335";
|
||||||
|
api_hash = "d524b414d21f4d37f08684c1df41ac9c";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
124
dae1.dae
Normal file
124
dae1.dae
Normal file
@@ -0,0 +1,124 @@
|
|||||||
|
global {
|
||||||
|
##### 软件选项。
|
||||||
|
|
||||||
|
# 监听的 tproxy 端口。不是 HTTP/SOCKS 端口，仅供 eBPF 程序使用.
|
||||||
|
# 一般情况下，你不需要使用它。
|
||||||
|
tproxy_port: 12345
|
||||||
|
|
||||||
|
# 设为 true 来避免意外的流量进入 tproxy 端口。 设为 false 以配合用户自定义的 iptables tproxy 规则。
|
||||||
|
tproxy_port_protect: true
|
||||||
|
|
||||||
|
# 若非 0，dae 发出的流量会打上 SO_MARK。 这有助于使用 iptables tproxy 规则时避免流量回环。
|
||||||
|
so_mark_from_dae: 0
|
||||||
|
|
||||||
|
# 日志等级: error, warn, info, debug, trace。
|
||||||
|
log_level: info
|
||||||
|
|
||||||
|
# 禁用等待网络以拉取订阅。
|
||||||
|
disable_waiting_network: false
|
||||||
|
|
||||||
|
|
||||||
|
##### 接口和内核选项。
|
||||||
|
|
||||||
|
# 绑定的 LAN 接口。使用它来代理局域网设备。
|
||||||
|
# 多个接口使用 "," 分隔。
|
||||||
|
lan_interface: podman0,mac0
|
||||||
|
|
||||||
|
# 绑定的 WAN 接口. 使用它来代理本机。
|
||||||
|
# 多个接口使用 "," 分隔。使用 "auto" 自动检测接口.
|
||||||
|
wan_interface: mac0
|
||||||
|
|
||||||
|
# 自动配置 Linux 的内核选项（如 ip_forward 和 send_redirects）。
|
||||||
|
# 参考https://github.com/daeuniverse/dae/blob/main/docs/en/user-guide/kernel-parameters.md
|
||||||
|
auto_config_kernel_parameter: true
|
||||||
|
|
||||||
|
|
||||||
|
##### 节点连通性检测。
|
||||||
|
|
||||||
|
# 如果你本地网络为双栈，URL的主机应该同时支持 IPv4 和 IPv6。
|
||||||
|
# 第一个是 URL，如果在其后填写了 IP 地址，代表对 URL 中 Host 的固定解析。
|
||||||
|
# 考虑到流量消耗，推荐使用具有任播且响应简短的站点。
|
||||||
|
#tcp_check_url: 'http://cp.cloudflare.com'
|
||||||
|
tcp_check_url: 'http://cp.cloudflare.com,1.1.1.1,2606:4700:4700::1111'
|
||||||
|
|
||||||
|
tcp_check_http_method: HEAD
|
||||||
|
|
||||||
|
# 该 DNS 用于检测节点的 UDP 连通性。若包含 tcp 的 DNS，同样用于检测节点的 TCP DNS 连通性。
|
||||||
|
# 第一个是 URL，如果在其后填写了 IP 地址，代表对 URL 中 Host 的固定解析。
|
||||||
|
# 如果你本地网络为双栈，DNS 服务器应同时支持 IPv4 和 IPv6。
|
||||||
|
udp_check_dns: 'dns.google.com:53,8.8.8.8,2001:4860:4860::8888'
|
||||||
|
|
||||||
|
check_interval: 30s
|
||||||
|
|
||||||
|
check_tolerance: 50ms
|
||||||
|
|
||||||
|
|
||||||
|
# dial_mode 选项为:
|
||||||
|
# 1. "ip"。 使用 DNS 查询得到的 IP 直接发送代理。这允许 ipv4、ipv6 分别选择最佳路径，并使应用程序请求的 IP 版本满足预期。
|
||||||
|
# 例如，如果使用 curl-4 ip.sb，将通过代理请求 IPv4 并获得 IPv4 响应。curl-6 ip.sb 将请求 IPv6。若节点支持IPv6，
|
||||||
|
# 这可能会解决一些奇怪的全锥问题。在此模式下将禁用嗅探。
|
||||||
|
# 2. "domain"。 使用嗅探到的域名发送代理。若 DNS 环境不纯净，这将在很大程度上缓解 DNS 污染问题。通常，这种模式会带来更快的
|
||||||
|
# 代理响应，因为代理会在远程重新解析域名，从而获得更好的 IP 连接结果。此策略不影响路由，也就是说，域名重写将在路由的
|
||||||
|
# 流量拆分后进行， dae 不会重新路由。
|
||||||
|
# 3. "domain+"。 基于 domain 模式但不会检查嗅探得到域名的真实性。 对于 DNS 请求不经过 dae 但想要更快的代理响应的用户有用。
|
||||||
|
# 但是， 若 DNS 请求不经过 dae，基于域名的流量拆分将失效。
|
||||||
|
# 4. "domain++"。 基于 domain+ 模式但会根据嗅探到的域名重新进行流量路由，以部分恢复基于域名的流量拆分能力。对于直连流量无效
|
||||||
|
# 且会占用更多的 CPU 资源。
|
||||||
|
dial_mode: domain
|
||||||
|
|
||||||
|
allow_insecure: false
|
||||||
|
|
||||||
|
sniffing_timeout: 100ms
|
||||||
|
|
||||||
|
tls_implementation: tls
|
||||||
|
|
||||||
|
utls_imitate: chrome_auto
|
||||||
|
}
|
||||||
|
|
||||||
|
dns {
|
||||||
|
ipversion_prefer: 4
|
||||||
|
upstream {
|
||||||
|
cf: 'https://1.1.1.1/dns-query'
|
||||||
|
ali: 'udp://223.5.5.5:53'
|
||||||
|
local: 'udp://127.0.0.1:53'
|
||||||
|
}
|
||||||
|
routing {
|
||||||
|
request {
|
||||||
|
fallback: local
|
||||||
|
}
|
||||||
|
response {
|
||||||
|
qname(suffix: imxyy.top) -> accept
|
||||||
|
qtype(https) -> reject
|
||||||
|
qtype(aaaa) && !qname(geosite:cn) -> reject
|
||||||
|
upstream(cf) -> accept
|
||||||
|
ip(geoip:private) && !qname(geosite:cn) -> cf
|
||||||
|
fallback: accept
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
node {
|
||||||
|
mihomo:'socks5://127.0.0.1:2080'
|
||||||
|
}
|
||||||
|
|
||||||
|
group {
|
||||||
|
proxy {
|
||||||
|
policy: fixed(0)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
routing{
|
||||||
|
ipversion(6) -> must_direct
|
||||||
|
pname(mihomo) -> must_direct
|
||||||
|
pname(easytier-core) -> must_direct
|
||||||
|
!sip(192.168.3.2) && dport(53) -> must_direct
|
||||||
|
pname(dnsmasq) -> must_direct
|
||||||
|
dip(109.176.254.67, 38.207.175.172, 31.57.67.74, 111.173.106.225) -> must_direct
|
||||||
|
pname(systemd-resolved) -> must_direct
|
||||||
|
domain(suffix: bing.com) -> proxy
|
||||||
|
domain(geosite:cn) -> direct
|
||||||
|
dip(224.0.0.0/3, 'ff00::/8') -> direct
|
||||||
|
ip(geoip:private) -> direct
|
||||||
|
ip(geoip:cn) -> direct
|
||||||
|
fallback: proxy
|
||||||
|
}
|
||||||
File diff suppressed because one or more lines are too long
13
secrets/mautrix-telegram.env
Normal file
13
secrets/mautrix-telegram.env
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN=ENC[AES256_GCM,data:B+gL1Ai045XiEcBkFcaEwByEdHgCrbc00Efd/WEb/s1l3rhIqdEmdyhnpqYJQojDQ8cQfYb1gMOW38sZ0GL4zA==,iv:F3Y92S3rM1qUrRN0cR5SFep+ExeP90l/oiWmrDk4yfc=,tag:CZrujwoVdGFiDKMxgM1tCg==,type:str]
|
||||||
|
MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN=ENC[AES256_GCM,data:LDNVwG4cOqgb7stZFCAbzBpqTvt+kcuItaVGrM6Zd1wpxTZJ+sHQTf7acCh1obxdw1S13j8Kw2FsmBk4ojkWtQ==,iv:WJrt9G6BhZTuCxxC9A2AlRvon/MlCa9Y5dGNZ2DO7Mw=,tag:H0SLY4E/G1eJ0Tua+/zxww==,type:str]
|
||||||
|
MAUTRIX_TELEGRAM_BRIDGE_LOGIN_SHARED_SECRET_MAP=ENC[AES256_GCM,data:UcpnOqYwa3fFvU6/A+qUMfB784FuX/wBoilS3lZs3HHLazr9a12m9xivVs+9Kd7l+5xi5VqtQf9ZyF6EjGIeAFc4BFpADx2uvL7HP5kZ2WLGky/un1w=,iv:9ZtTU/iPhOX30uSbx7h3IMUcnCh127lE18Z3gkiydzo=,tag:DzHPBeKl9C28shR6c6t6mA==,type:str]
|
||||||
|
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDltTWRrUSAyUGVr\neFhRVERqUy9pRkFNRUVvQ3NMNFlnZEtQVnNhaWZJbzJUUWN4cG1ZCkduU2NJYnIz\nWm9vWHpGS2hPL1ZNdlhHRWJDaGJYOVFucXA3QktLV1VOdDAKLS0tIDROd2dtMm4v\nN1ZETmxkemk5RFNsU3AzTEphYlVKMTVzajFQNytRRGNBUmMKEwwN7MnPNP0ze0XJ\nm7QTQJhnd9QihXpGVYWKneL2Ef2YU1FZGUPOez9syDRepY/tl8jSFo77+aCLJ2/H\nPzM/4Q==\n-----END AGE ENCRYPTED FILE-----\n
|
||||||
|
sops_age__list_0__map_recipient=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEFLUkyeaK8ZPPZdVNEmtx8zvoxi7xqS2Z6oxRBuUPO
|
||||||
|
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHJNY1d1ZyA0S0VJ\nTlVpOStxVU1rZ0E2MVVNWmI0d0VxMStSeFJ3dnpONTR3N044dWg0CnZBOFpDbkw3\nWjJ6ZHRQaDNaV2JDNHRYWkdSOVFBSDF5M0kvOExaSnBCeGcKLS0tIGJOSCtHRlNt\ncmpYTmN4dklYWEp1WjR0Uk16VkJjRFNqb2hQNEZHSkdSa1EKpO1hMZr1NTzrEbCr\nycIvP4J3U9X1iTAL2/R98lOhUVPWlu7QN1GWvQIyB3TInTIpKNVV1Q8nkrq8GSFG\n6QHTCA==\n-----END AGE ENCRYPTED FILE-----\n
|
||||||
|
sops_age__list_1__map_recipient=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB28jpN+h5euh3NtdN+A+EtqgIatC22e4i1TPTioKire
|
||||||
|
sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFhGYmtrZyBWbk1h\ndVhCL2kyczUvR09YY3lvYXlmeExjdHYvd1dNQktHcUFVeWdYeFQ4CmJQSTVjY1Bq\nLzh1ZnpEWVJvaUZCeU0rMk5UWXBmMmNDMi9xTERlSlIyd1kKLS0tIHJaYlpaQmtE\nd21nQThCTXBVU0RJRnV0OHFTcWZYeSt4eWlmQVVyUWNSdGsKaPXqoSWS87MOHETx\nl7dbIo4maAV+eXbAbEYF2dZzw+Fea5vTrfsg1QQ4YVNGib7o8nvG2vouMyqq6vI3\n37HGfg==\n-----END AGE ENCRYPTED FILE-----\n
|
||||||
|
sops_age__list_2__map_recipient=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMb5G/ieEYBOng66YeyttBQLThyM6W//z2POsNyq4Rw/
|
||||||
|
sops_lastmodified=2025-08-22T02:52:07Z
|
||||||
|
sops_mac=ENC[AES256_GCM,data:ahjIUwIKPUfqTSl704AekBIVTTe8n0YUbMyVKxFSZb5ZoaQ3KRVgWPWCAn9n/Qwpa1oHWvVcqqbTd+wrxqmkpOgFCfg72ZWdPsSbzg6RGcUVHlg5r2b9DE7Pq+qDtgNBVkmdmlCAY2+mQTepXv8fGbWltu6tzdqOvsOBwfSw694=,iv:OJ2M6X23k5LokCrx4Ekz2a5+hUGV66YNjlFBQZdrkSA=,tag:2xjX3CX45kkpYt+skEgKOw==,type:str]
|
||||||
|
sops_unencrypted_suffix=_unencrypted
|
||||||
|
sops_version=3.10.2
|
||||||
Reference in New Issue
Block a user