$ show nikkinikki-org/OpenWrt-nikki
This repository provides a transparent proxy package for OpenWrt using Mihomo (a clash-compatible rule-based proxy core) as the backend. It is a full LuCI application that allows users to configure proxy modes (redirect, TPROXY, TUN), manage subscriptions, define access control rules, and monitor logs through a web interface. The system is designed for OpenWrt ≥24.10 with firewall4 (nftables) and kernel ≥5.13. The architecture consists of three OpenWrt packages: `nikki` (main service and scripts), `mihomo-meta` (stable core), and `mihomo-alpha` (alpha variant). The service is managed via procd init script (`nikki.init`), which handles starting/stopping Mihomo, setting up routing rules and nftables tables, and scheduling tasks. Configuration is stored in UCI (OpenWrt's standard configuration system) and processed through a pipeline: UCI options → `mixin.uc` (ucode script) generates a JSON overlay → `yq` merges it with a base profile → final Mihomo config. Traffic interception rules are generated dynamically from a utpl template (`hijack.ut`) that produces nftables rulesets. Key entry points include the LuCI views (`app.js`, `profile.js`, `mixin.js`, `proxy.js`, `editor.js`, `log.js`) for web-based management, the init script for service lifecycle, and shell scripts for installation/upgrade. External dependencies are Mihomo core, `yq` for YAML processing, and standard OpenWrt tools (procd, nftables, ucode). The repository also includes a large hardcoded nftables set of Chinese IP prefixes (`geoip_cn.nft`) for bypassing mainland China traffic.
The LLM identified 3 files worth highlighting for reuse:
A ucode script that reads UCI configuration options and generates a JSON overlay for Mihomo's configuration. It is self-contained, parameterized, and can be adapted to generate configurations for other proxy software or services that accept JSON-based configs. Demonstrates a clean pattern for transforming structured options into a target configuration format.
A utpl template that dynamically generates nftables rulesets for traffic interception (redirect, TPROXY, TUN modes). It is a reusable template engine pattern that can be extracted and applied to other nftables-based projects requiring dynamic rule generation. The template handles multiple scenarios (TCP/UDP, IPv4/IPv6, access control) in a maintainable way.
A shell script library defining common paths, logging functions, and utility helpers used across the package. It is isolated and can be reused in other OpenWrt packages or embedded Linux projects. Demonstrates good practices for shell scripting: idempotent path definitions, consistent logging, and modular function design.