nixos/byedpi: init

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -18,6 +18,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [byedpi](https://github.com/hufrea/byedpi), a DPI bypass service. Available as [services.byedpi](#opt-services.byedpi.enable).
+
 - [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as [services.overseerr](#opt-services.overseerr.enable).
 
 - [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).

nixos/modules/module-list.nix

@@ -1094,6 +1094,7 @@
   ./services/networking/bitlbee.nix
   ./services/networking/blockbook-frontend.nix
   ./services/networking/blocky.nix
+  ./services/networking/byedpi.nix
   ./services/networking/cato-client.nix
   ./services/networking/centrifugo.nix
   ./services/networking/cgit.nix

nixos/modules/services/networking/byedpi.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.byedpi;
+in
+{
+  options.services.byedpi = {
+    enable = lib.mkEnableOption "the ByeDPI service";
+    package = lib.mkPackageOption pkgs "byedpi" { };
+    extraArgs = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      example = [
+        "--split"
+        "1"
+        "--disorder"
+        "3+s"
+        "--mod-http=h,d"
+        "--auto=torst"
+        "--tlsrec"
+        "1+s"
+      ];
+      description = "Extra command line arguments.";
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    systemd.services.byedpi = {
+      description = "ByeDPI";
+      wantedBy = [ "default.target" ];
+      wants = [ "network-online.target" ];
+      after = [
+        "network-online.target"
+        "nss-lookup.target"
+      ];
+      serviceConfig = {
+        ExecStart = lib.escapeShellArgs ([ (lib.getExe cfg.package) ] ++ cfg.extraArgs);
+        NoNewPrivileges = "yes";
+        StandardOutput = "null";
+        StandardError = "journal";
+        TimeoutStopSec = "5s";
+        PrivateTmp = "true";
+        ProtectSystem = "full";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ wozrer ];
+}