1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
#/bin/bash
# 脏标记：0=不需要重建 UKI，1=需要
MKINITCPIO=0
setup_vconsole_font() {
sudo sed -i 's/^\(FONT=.*\)$/# \1\nFONT=ter-132n/' /etc/vconsole.conf
sudo cp /etc/kernel/cmdline /etc/kernel/cmdline.bak
sudo sed -i 's/$/ fbcon=font:TER16x32/' /etc/kernel/cmdline
sudo cp /boot/loader/loader.conf /boot/loader/loader.conf.bak
sudo sed -i -e '/^[[:space:]]*#\?[[:space:]]*console-mode/d' /boot/loader/loader.conf
echo 'console-mode 1' | sudo tee -a /boot/loader/loader.conf >/dev/null
# 标记需要重建
MKINITCPIO=1
}
setup_shadowsocks() {
sudo cat > /etc/shadowsocks-rust/s.json <<EOF
{
"server": "x.xxx",
"server_port": 1111,
"password": "xxxxxxxxxxxxxxxx",
"timeout": 300,
"method": "aes-256-gcm",
"locals": [
{
"local_address": "127.0.0.1",
"local_port": 1080
},
{
"local_address": "127.0.0.1",
"local_port": 3128,
"protocol": "http"
}
]
}
EOF
sudo systemctl enable --now shadowsocks-rust@s
}
setup_dae() {
sudo cat > /etc/dae/config.dae <<EOF
global {
wan_interface: auto
auto_config_kernel_parameter: true
log_level: info
# Keep the original domain when dialing through the proxy. This also makes
# domain-based routing independent from the IP returned by the local DNS.
dial_mode: domain
allow_insecure: false
}
# Reuse the local Shadowsocks SOCKS5 listener instead of duplicating the
# remote server address and password in this configuration.
node {
# local_ss: 'socks5://127.0.0.1:8888'
# Direct Shadowsocks node example using the SIP002 URI format. Replace the
# cipher, password, host, and port, then uncomment it. Base64 is encoding,
# not encryption, so keep the real link under secret/.
# example_ss: 'ss://YWVzLTEyOC1nY206dGVzdA@example.com:8388#example-ss'
ss: 'ss://aes-256-gcm:xxxxxxxxxx@xxxx:1234'
}
group {
proxy {
filter: name(ss)
policy: fixed(0)
}
}
# Let dae observe DNS queries so that routing rules can match domain names.
dns {
upstream {
router: 'udp://192.168.8.1:53'
direct_dns: 'tcp+udp://223.5.5.5:53'
}
routing {
request {
qname(suffix: l) -> router
qname(suffix: lan) -> router
fallback: direct_dns
}
response {
fallback: accept
}
}
}
routing {
# Shadowsocks must reach its remote server directly to avoid a proxy loop.
pname(sslocal) -> direct
# Keep local, multicast, and other private destinations direct.
dip(224.0.0.0/3, 'ff00::/8') -> direct
dip(geoip:private) -> direct
# Route mainland China IPs directly. Everything else uses the proxy, so
# overseas destinations do not need to be maintained in a domain list.
dip(geoip:cn) -> direct
fallback: proxy
}
EOF
}
setup_vconsole_font
setup_shadowsocks
setup_dae
# 统一重建一次
if [ "$MKINITCPIO" -eq 1 ]; then
echo ">>> mkinitcpio -P"
sudo mkinitcpio -P
fi
|
