From 6777a7652fff9b5f3aecad34913fe0515921c60c Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Mon, 6 Apr 2026 02:35:19 +0300
Subject: [PATCH] ssh: bypass tun2socks via direct SOCKS5 to fix post-quantum
 kex issue

---
 modules/xray.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/xray.nix b/modules/xray.nix
index c570812..668e328 100644
--- a/modules/xray.nix
+++ b/modules/xray.nix
@@ -57,6 +57,12 @@ in
     };
   };
 
+  # SSH bypasses tun0, goes through SOCKS5 directly (avoids tun2socks kex issues)
+  programs.ssh.extraConfig = ''
+    Host *
+      ProxyCommand ${pkgs.netcat-openbsd}/bin/nc -X 5 -x 127.0.0.1:10808 %h %p
+  '';
+
   # DNS through tunnel — use public DNS that will go through tun0
   networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];