From 7c0b5fc0b824fc7ad0e27dc35813312960b15781 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Mon, 2 Nov 2026 00:31:01 +0800
Subject: [PATCH] fix(mihomo): keep the proxy up when the resolved hook times
 out

On shoukei a DNS takeover that timed out failed mihomo.service, and the
nixpkgs unit has no Restart=, so the proxy stayed down. Prefix the hook
with '-' (fail open, like ai's hook). Also switch the dashboard title
patch to --replace-fail.

Assisted-by: Claude Code (claude-opus-5-5)
---
 modules/nixos/desktop/networking/mihomo/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/desktop/networking/mihomo/default.nix b/modules/nixos/desktop/networking/mihomo/default.nix
index 2b5159cd..3a9e6087 100644
--- a/modules/nixos/desktop/networking/mihomo/default.nix
+++ b/modules/nixos/desktop/networking/mihomo/default.nix
@@ -30,7 +30,7 @@ let
     cp -r ${pkgs.metacubexd} $out
     chmod -R u+w $out
     substituteInPlace $out/index.html $out/200.html $out/404.html \
-      --replace '<title>MetaCubeXD</title>' '<title>MetaCubeXD · ${host}</title>'
+      --replace-fail '<title>MetaCubeXD</title>' '<title>MetaCubeXD · ${host}</title>'
     cat >> $out/config.js <<'EOF'
 
     ;(function () {
@@ -91,7 +91,8 @@ in
       # Attach the catch-all to the TUN, leaving DHCP and more-specific VPN DNS
       # routes untouched. Removing the TUN also removes its resolved settings.
       # '+' allows the privileged D-Bus call outside mihomo's service sandbox.
-      ExecStartPost = "+${pkgs.coreutils}/bin/timeout 30 ${
+      # '-': a timed-out hook must not take the proxy down with it.
+      ExecStartPost = "-+${pkgs.coreutils}/bin/timeout 30 ${
         lib.getExe (
           pkgs.writeShellApplication {
             name = "mihomo-resolved";