dentritic refactor

modules/nixos/net/net-network-manager.ulu.nix

@@ -0,0 +1,26 @@
+{ ... }:
+{
+  flake.nixosModules.net-network-manager =
+    { ... }:
+    {
+      networking.hostName = "copland";
+      networking.networkmanager.enable = true;
+
+      services.resolved = {
+        enable = true;
+
+        settings = {
+          Resolve = {
+            DNS = "1.1.1.1";
+            DNSOverTLS = "yes";
+            DNSSEC = "false";
+            Domains = [ "~." ];
+            FallbackDNS = [
+              "1.1.1.1"
+              "8.8.8.8"
+            ];
+          };
+        };
+      };
+    };
+}

modules/nixos/net/net-vpn.ulu.nix

@@ -0,0 +1,39 @@
+{ ... }:
+{
+  flake.nixosModules.net-vpn =
+    { ... }:
+    {
+      services.zapret = {
+        enable = true;
+        params = [
+          "--filter-tcp=80"
+          "--dpi-desync=fake,multisplit"
+          "--dpi-desync-split-pos=method+2"
+          "--dpi-desync-fooling=md5sig"
+          "--new"
+          "--filter-tcp=443"
+          "--dpi-desync=fake,multidisorder"
+          "--dpi-desync-split-pos=1,midsld"
+          "--dpi-desync-fooling=badseq,md5sig"
+          "--new"
+          "--filter-udp=443"
+          "--dpi-desync=fake"
+          "--dpi-desync-repeats=6"
+        ];
+      };
+
+      networking.enableIPv6 = false;
+
+      networking.firewall.extraCommands = ''
+        iptables -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
+        iptables -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
+        iptables -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN
+      '';
+
+      networking.firewall.extraStopCommands = ''
+        iptables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
+        iptables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
+        iptables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true
+      '';
+    };
+}