fix: dae - github's ssh access

Justfile

@@ -100,6 +100,8 @@ dist-debug:
 
 aqua:
   colmena apply --on '@aqua'
+  # some config changes require a restart of the dae service
+  ssh ryan@aquamarine "sudo systemctl stop dae; sleep 1; sudo systemctl start dae"
 
 ruby:
   colmena apply --on '@ruby'

hosts/idols_aquamarine/config.dae

@@ -205,7 +205,11 @@ group {
         policy: min_avg10
     }
 
+<<<<<<< HEAD
     github {
+=======
+    ssh-proxy {
+>>>>>>> 7aa2276 (fix: dae - github's ssh access)
         filter: name(keyword: 'UK')
         filter: name(keyword: '英国')
         policy: min_avg10
@@ -251,10 +255,6 @@ routing {
     dip(geoip:cn) -> direct
     domain(geosite:cn) -> direct
 
-    # Use HK to access all other foreign sites
-    domain(geosite:geolocation-!cn) -> proxy
-    !dip(geoip:cn) -> proxy
-
     # Block ads
     domain(geosite:category-ads) -> block
     domain(geosite:category-ads-all) -> block
@@ -268,8 +268,8 @@ routing {
 
     # --- Rules for other commonly used sites ---#
 
-    # Github
+    # SSH - tcp port 22 is blocked by many proxy servers.
-    domain(geosite:github) -> github
+    dport(22) && !dip(geoip:cn) && !domain(geosite:cn) -> ssh-proxy
 
     ### OpenAI
     domain(geosite:openai) -> sg
@@ -312,5 +312,11 @@ routing {
     domain(keyword:'douyu') -> direct
     domain(geosite:cloudflare-cn) -> direct
 
+    # --- Fallback rules ---#
+
+    # Access all other foreign sites
+    domain(geosite:geolocation-!cn) -> proxy
+    !dip(geoip:cn) -> proxy
+
     fallback: direct
 }

hosts/idols_aquamarine/router.nix

@@ -117,7 +117,7 @@ in {
   services.dnsmasq = {
     enable = true;
     # resolve local queries (add 127.0.0.1 to /etc/resolv.conf)
-    resolveLocalQueries = false; # may be conflict with dae, disable this.
+    resolveLocalQueries = true; # may be conflict with dae, disable this.
     alwaysKeepRunning = true;
     # https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=tree
     settings = {