until SERVER=$(/etc/profiles/per-user/iopq/bin/dig @$NAME_SERVER +short A $DOMAIN); do /run/current-system/sw/bin/sleep 2; done;
/etc/udp2raw_binaries/udp2raw_amd64_hw_aes -c -l 127.0.0.1:6443 -r $SERVER:443 -k $UDP2RAW_PWD --raw-mode $RAW_MODE --auth-mode hmac_sha1 --fix-gro

/etc/udp2raw_binaries/udp2raw_amd64_hw_aes \
    -c \
    -l 127.0.0.1:6443 \
    -r ${SERVER_IP}:${PORT} \
    -k ${UDP2RAW_PWD} \
    --raw-mode ${RAW_MODE} \
    --auth-mode hmac_sha1 \
    --fix-gro

iptables -t mangle -A XRAY_MASK -m owner --gid-owner 988 -j RETURN

iptables -t mangle -A XRAY_MASK -m owner --gid-owner 1988 -j RETURN

  nixpkgs.config.firefox.speechSynthesisSupport = true;

  #programs.ssh.startAgent = true;

  #programs.ssh.startAgent = true; #can't start it and GnuPG at the same time

  services.pcscd.enable = true;

  #services.pcscd.enable = true; #smartcard reader

  users.users.xray_tproxy.isSystemUser= true;

#  users.users.xray_tproxy.isSystemUser= true;
  users.users.xray_tproxy.isNormalUser= true;

    gid = 988;

    gid = 1988;

  systemd.services.tproxy-rules = {
    enable = true;
    after = [ "network.target" ];

    systemd.tmpfiles.rules = [
    "d /run/udp2raw 0755 xray_tproxy xray_tproxy -"
  ];
  systemd.services.NetworkManager-wait-online.enable = true;
  systemd.services.tproxy = {
    description = "Transparent Proxy Rule Manager";

    description = "Tproxy rules";
    path = [
    pkgs.nftables
    pkgs.iptables
    pkgs.iproute2]; #realpath $(which ip)

    wants = [ "network-online.target" ];
    after = [ "network-online.target" ];
    path = [ pkgs.iproute2 pkgs.iptables];

        EnvironmentFile = "/etc/nixos/scripts/.env";
        Type = "oneshot";
        RemainAfterExit="yes";
        ExecStart = "/etc/nixos/scripts/tproxy-rules.sh";
        ExecStop=''/etc/nixos/scripts/ipclean.sh ; \
        /run/current-system/sw/bin/ip route del local default dev lo table 100 ; /run/current-system/sw/bin/ip rule del table 100'';

      ExecStart = "/etc/nixos/scripts/tproxy-controller /etc/nixos/scripts/servers.yaml";
      Restart = "always";
      User = "xray_tproxy";
      RuntimeDirectory = "tproxy";
      AmbientCapabilities = [ "CAP_NET_ADMIN" ];
      CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
      WorkingDirectory = "/run/tproxy";
      RestartSec=5;

/*

    after = [ "tproxy-rules.service" ];

    wants = [ "network-online.target" ];
    after = [ "network-online.target" ];

    };
  };
*/
  systemd.services.udp2raw-restart-trigger = {
    description = "Trigger restart of udp2raw on .env change";
    serviceConfig = {
      Type = "oneshot";
      # The actual command to restart the service
      ExecStart = "${pkgs.systemd}/bin/systemctl restart udp2raw.service";
    };
  };
  systemd.paths.udp2raw = {
    description = "Watch udp2raw IP env file";
    wantedBy = [ "multi-user.target" ];
    pathConfig = {
      PathChanged = "/run/udp2raw/.env";
      Unit = "udp2raw-restart-trigger.service";
    };
  };
  systemd.services.udp2raw = {
    description = "udp2raw tunnel";
    wants = [ "udp2raw.path"
              "tproxy.service" ];
    after = [ "tproxy.service" ];
    serviceConfig = {
      User = "xray_tproxy";
      # Load SERVER_IP from tproxy's generated file
      EnvironmentFile = "/run/udp2raw/.env";
      ExecStart = ''/etc/nixos/scripts/udp2raw.sh'';
      Restart = "always";
      RestartSec = "3s";

    wantedBy = [ "multi-user.target" ];

    after = [ "tproxy-rules.service" ];

    wants = [ "udp2raw.path"
              "tproxy.service"];
    after = [ "tproxy.service" ];
    path = [ pkgs.udpspeeder ];

      EnvironmentFile = "/etc/nixos/scripts/.env";
      ExecStart = ''/etc/speederv2_binaries/speederv2_amd64 -c -l 0.0.0.0:7443 -r 127.0.0.1:6443 -k $SPEEDER_PWD -f2:2,20:8,50:15 --timeout 4 --mode 0 --log-level 5'';

      EnvironmentFile = "/run/udp2raw/.env";
      #ExecStart = ''${pkgs.udpspeeder}/bin/speederv2 -c -l 0.0.0.0:7443 -r 127.0.0.1:6443 -k $UDPSPEEDER_PWD -f2:1,150:50 --timeout 10 -i 10 --mode 0 --log-level 5'';
      ExecStart = ''/etc/speederv2_binaries/speederv2_amd64 -c -l 0.0.0.0:7443 -r 127.0.0.1:6443 -k $UDPSPEEDER_PWD -f2:1,150:50 --timeout 10 -i 10 --mode 0 --log-level 5'';

    extraGroups = [ "networkmanager" "wheel" ];

    extraGroups = [ "networkmanager" "wheel" "xray_tproxy"];

      ghc
      haskellPackages.network-info

      stack
      udpspeeder

  nixpkgs.config.firefox.speechSynthesisSupport = true;