Admins will be upgrading ORNL GitLab Servers on Saturday, 16 May 2026, from 7 AM until 11 AM EST. Repositories will experience intermittent outages during this time.
@@ -73,6 +73,8 @@ In addition to numerous new and upgraded packages, this release has the followin
-[v2rayA](https://v2raya.org), a Linux web GUI client of Project V which supports V2Ray, Xray, SS, SSR, Trojan and Pingtunnel. Available as [services.v2raya](options.html#opt-services.v2raya.enable).
-[wstunnel](https://github.com/erebe/wstunnel), a proxy tunnelling arbitrary TCP or UDP traffic through a WebSocket connection. Instances may be configured via [services.wstunnel](options.html#opt-services.wstunnel.enable).
-[ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable).
-[jellyseerr](https://github.com/Fallenbagel/jellyseerr), a web-based requests manager for Jellyfin, forked from Overseerr. Available as [services.jellyseerr](#opt-services.jellyseerr.enable).
description=mdDoc"Whether to enable this `wstunnel` instance.";
type=types.bool;
default=true;
};
package=mkPackageOptionMDpkgs"wstunnel"{};
autoStart=mkOption{
description=mdDoc"Whether this tunnel server should be started automatically.";
type=types.bool;
default=true;
};
extraArgs=mkOption{
description=mdDoc"Extra command line arguments to pass to `wstunnel`. Attributes of the form `argName = true;` will be translated to `--argName`, and `argName = \"value\"` to `--argName=value`.";
type=withtypes;attrsOf(eitherstrbool);
default={};
example={
"someNewOption"=true;
"someNewOptionWithValue"="someValue";
};
};
verboseLogging=mkOption{
description=mdDoc"Enable verbose logging.";
type=types.bool;
default=false;
};
environmentFile=mkOption{
description=mdDoc"Environment file to be passed to the systemd service. Useful for passing secrets to the service to prevent them from being world-readable in the Nix store. Note however that the secrets are passed to `wstunnel` through the command line, which makes them locally readable for all users of the system at runtime.";
type=types.nullOrtypes.path;
default=null;
example="/var/lib/secrets/wstunnelSecrets";
};
};
serverSubmodule={config,...}:{
options=commonOptions//{
listen=mkOption{
description=mdDoc"Address and port to listen on. Setting the port to a value below 1024 will also give the process the required `CAP_NET_BIND_SERVICE` capability.";
type=types.submodulehostPortSubmodule;
default={
address="0.0.0.0";
port=ifconfig.enableHTTPSthen443else80;
};
defaultText=literalExpression''
{
address = "0.0.0.0";
port = if enableHTTPS then 443 else 80;
}
'';
};
restrictTo=mkOption{
description=mdDoc"Accepted traffic will be forwarded only to this service. Set to `null` to allow forwarding to arbitrary addresses.";
description=mdDoc"Use HTTPS for the tunnel server.";
type=types.bool;
default=true;
};
tlsCertificate=mkOption{
description=mdDoc"TLS certificate to use instead of the hardcoded one in case of HTTPS connections. Use together with `tlsKey`.";
type=types.nullOrtypes.path;
default=null;
example="/var/lib/secrets/cert.pem";
};
tlsKey=mkOption{
description=mdDoc"TLS key to use instead of the hardcoded on in case of HTTPS connections. Use together with `tlsCertificate`.";
type=types.nullOrtypes.path;
default=null;
example="/var/lib/secrets/key.pem";
};
useACMEHost=mkOption{
description=mdDoc"Use a certificate generated by the NixOS ACME module for the given host. Note that this will not generate a new certificate - you will need to do so with `security.acme.certs`.";
type=types.nullOrtypes.str;
default=null;
example="example.com";
};
};
};
clientSubmodule={config,...}:{
options=commonOptions//{
connectTo=mkOption{
description=mdDoc"Server address and port to connect to.";
type=types.submodulehostPortSubmodule;
example={
host="example.com";
};
};
enableHTTPS=mkOption{
description=mdDoc"Enable HTTPS when connecting to the server.";
type=types.bool;
default=true;
};
localToRemote=mkOption{
description=mdDoc"Local hosts and ports to listen on, plus the hosts and ports on remote to forward traffic to. Setting a local port to a value less than 1024 will additionally give the process the required CAP_NET_BIND_SERVICE capability.";
description=mdDoc"Host and port for the SOCKS5 proxy to dynamically forward traffic to. Leave this at `null` to disable the SOCKS5 proxy. Setting the port to a value less than 1024 will additionally give the service the required CAP_NET_BIND_SERVICE capability.";
description=mdDoc"Whether to forward UDP instead of TCP traffic.";
type=types.bool;
default=false;
};
udpTimeout=mkOption{
description=mdDoc"When using UDP forwarding, timeout in seconds after which the tunnel connection is closed. `-1` means no timeout.";
type=types.int;
default=30;
};
httpProxy=mkOption{
description=mdDoc''
Proxy to use to connect to the wstunnel server (`USER:PASS@HOST:PORT`).
::: {.warning}
Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the `environmentFile` option to a file containing `PROXY_PASSWORD=<your-password-here>` and set this option to `<user>:$PROXY_PASSWORD@<host>:<port>`. Note however that this will also locally leak the passwords at runtime via e.g. /proc/<pid>/cmdline.
:::
'';
type=types.nullOrtypes.str;
default=null;
};
soMark=mkOption{
description=mdDoc"Mark network packets with the SO_MARK sockoption with the specified value. Setting this option will also enable the required `CAP_NET_ADMIN` capability for the systemd service.";
type=types.nullOrtypes.int;
default=null;
};
upgradePathPrefix=mkOption{
description=mdDoc"Use a specific HTTP path prefix that will show up in the upgrade request to the `wstunnel` server. Useful when running `wstunnel` behind a reverse proxy.";
type=types.nullOrtypes.str;
default=null;
example="wstunnel";
};
hostHeader=mkOption{
description=mdDoc"Use this as the HTTP host header instead of the real hostname. Useful for circumventing hostname-based firewalls.";
type=types.nullOrtypes.str;
default=null;
};
tlsSNI=mkOption{
description=mdDoc"Use this as the SNI while connecting via TLS. Useful for circumventing hostname-based firewalls.";
type=types.nullOrtypes.str;
default=null;
};
tlsVerifyCertificate=mkOption{
description=mdDoc"Whether to verify the TLS certificate of the server. It might be useful to set this to `false` when working with the `tlsSNI` option.";
type=types.bool;
default=true;
};
# The original argument name `websocketPingFrequency` is a misnomer, as the frequency is the inverse of the interval.
websocketPingInterval=mkOption{
description=mdDoc"Do a heartbeat ping every N seconds to keep up the websocket connection.";
type=types.nullOrtypes.ints.unsigned;
default=null;
};
upgradeCredentials=mkOption{
description=mdDoc''
Use these credentials to authenticate during the HTTP upgrade request (Basic authorization type, `USER:[PASS]`).
::: {.warning}
Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the `environmentFile` option to a file containing `HTTP_PASSWORD=<your-password-here>` and set this option to `<user>:$HTTP_PASSWORD`. Note however that this will also locally leak the passwords at runtime via e.g. /proc/<pid>/cmdline.
:::
'';
type=types.nullOrtypes.str;
default=null;
};
customHeaders=mkOption{
description=mdDoc"Custom HTTP headers to send during the upgrade request.";
