From dbc3d6475a79cd00ede3ada15c33f396a84b911d Mon Sep 17 00:00:00 2001
From: dawn <90008@klbr.net>
Date: Thu, 23 Jul 2026 23:44:27 +0000
Subject: [PATCH] feat(pupos): deploy CLIProxyAPI

---
 deploy.nu | 5 +++++
 hosts/default.nix | 1 +
 hosts/pupos/default.nix | 45 +++++++++++++++++++++++++++++++++++++++++++++
 hosts/pupos/hardware-configuration.nix | 30 ++++++++++++++++++++++++++++++
 pkgs-set/pkgs/cliproxyapi.nix | 26 ++++++++++++++++++++++++++
 hosts/pupos/modules/cliproxy.nix | 28 ++++++++++++++++++++++++++++
 6 file(s) changed, 135 insertion(s)(+), 0 deletion(s)(-)

diff --git a/deploy.nu b/deploy.nu
--- a/deploy.nu
+++ b/deploy.nu
@@ -60,6 +60,11 @@
     user: "root",
     addr: "159.195.58.28",
   },
+  pupos: {
+    type: "nixos",
+    user: "dawn",
+    addr: "pupos",
+  },
 }
 
 def deploy [hostname: string, boot: bool] {
diff --git a/hosts/default.nix b/hosts/default.nix
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -35,6 +35,7 @@
     volsinii = allPkgsSets.x86_64-linux;
     chernobog = allPkgsSets.x86_64-linux;
     trimounts = allPkgsSets.x86_64-linux;
+    pupos = allPkgsSets.x86_64-linux;
   };
 in
 lib.mapAttrs mkSystem systems
diff --git a/hosts/pupos/default.nix b/hosts/pupos/default.nix
new file mode 100644
--- /dev/null
+++ b/hosts/pupos/default.nix
@@ -0,0 +1,45 @@
+{ inputs, tlib, ... }:
+{
+  imports = [
+    "${inputs.home}/nixos"
+    ../../modules
+    ./hardware-configuration.nix
+    ./modules/cliproxy.nix
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.networkmanager.enable = true;
+  time.timeZone = "UTC";
+
+  users.users.dawn = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "networkmanager" ];
+    openssh.authorizedKeys.keys = [
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHzGssWmVUOzJ9NyBPkcNfXk/cMAGYyDGDdYyAydN8dNAAAABHNzaDo="
+    ];
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  services.tailscale = {
+    enable = true;
+    authKeyFile = "/etc/tailscale/authkey";
+    extraUpFlags = [
+      "--login-server=https://headscale.nekomimi.pet"
+      "--accept-routes"
+      "--accept-dns"
+    ];
+  };
+
+  environment.systemPackages = [ ];
+  system.stateVersion = "25.11";
+}
diff --git a/hosts/pupos/hardware-configuration.nix b/hosts/pupos/hardware-configuration.nix
new file mode 100644
--- /dev/null
+++ b/hosts/pupos/hardware-configuration.nix
@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/20e749f9-408e-4a92-be35-017c024b05df";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/05C2-E394";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/pkgs-set/pkgs/cliproxyapi.nix b/pkgs-set/pkgs/cliproxyapi.nix
new file mode 100644
--- /dev/null
+++ b/pkgs-set/pkgs/cliproxyapi.nix
@@ -0,0 +1,26 @@
+{
+  stdenvNoCC,
+  fetchurl,
+  autoPatchelfHook,
+  ...
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "cliproxyapi";
+  version = "7.2.97";
+
+  src = fetchurl {
+    url = "https://github.com/router-for-me/CLIProxyAPI/releases/download/v7.2.97/CLIProxyAPI_7.2.97_linux_amd64.tar.gz";
+    hash = "sha256-nefXh2m9WqKJAe8YdmxlxB/bdQJYpbMYES3gKSgBbtQ=";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    tar -xzf "$src"
+    install -Dm755 cli-proxy-api $out/bin/cli-proxy-api
+    install -Dm644 LICENSE $out/share/licenses/cliproxyapi/LICENSE
+  '';
+}
diff --git a/hosts/pupos/modules/cliproxy.nix b/hosts/pupos/modules/cliproxy.nix
new file mode 100644
--- /dev/null
+++ b/hosts/pupos/modules/cliproxy.nix
@@ -0,0 +1,28 @@
+{ terra, ... }:
+{
+  networking.firewall.allowedTCPPorts = [ 8317 ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/cliproxy 0700 dawn users -"
+    "d /var/lib/cliproxy/auths 0700 dawn users -"
+    "d /var/lib/cliproxy/logs 0700 dawn users -"
+  ];
+
+  systemd.services.cliproxyapi = {
+    description = "CLIProxyAPI";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "simple";
+      User = "dawn";
+      Group = "users";
+      WorkingDirectory = "/var/lib/cliproxy";
+      ExecStart = "${terra.cliproxyapi}/bin/cli-proxy-api -config /var/lib/cliproxy/config.yaml";
+      Restart = "on-failure";
+      RestartSec = 5;
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+    };
+  };
+}

--
tangled.sh