hosts/losurdo/networking/tor.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.services) tor;
   5   inherit (config.users) users;
   6   ports = lib.flatten (map (map (p: p.port)) [ tor.settings.ORPort tor.settings.DirPort ]);
   7   onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd";
   8 in
   9 {
  10   environment.systemPackages = [
  11     #pkgs.pythonPackages.stem
  12     pkgs.nyx
  13   ];
  14   networking.nftables.ruleset = lib.optionalString (ports != [ ]) ''
  15     table inet filter {
  16       chain input-net {
  17         tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "tor"
  18       }
  19     }
  20   '' + ''
  21     table inet filter {
  22       chain output-net {
  23         skuid ${users.tor.name} tcp counter accept comment "tor"
  24       }
  25     }
  26   '';
  27   systemd.services.tor.serviceConfig.LoadCredentialEncrypted = [
  28     "${onion}.hs_ed25519_secret_key:${./tor + "/${onion}.hs_ed25519_secret_key.cred"}"
  29   ];
  30   services.tor = {
  31     enable = true;
  32     enableGeoIP = true;
  33     controlSocket.enable = true;
  34     client.enable = true;
  35     client.dns.enable = true;
  36     relay.enable = false;
  37     relay.role = "private-bridge";
  38     #client.privoxy.enable = false;
  39     relay.onionServices = {
  40       "ssh/${networking.domain}/${networking.hostName}" = {
  41         secretKey = "/run/credentials/tor.service/${onion}.hs_ed25519_secret_key";
  42         map = [ 22 ];
  43         /*
  44       authorizedClients = [
  45         "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
  46       ];
  47         */
  48         settings = {
  49           #HiddenServiceNumIntroductionPoints = 20;
  50         };
  51       };
  52     };
  53     settings.AutomapHostsSuffixes = [ ".onion" ];
  54     settings.ORPort = [
  55       #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
  56       { port = 2222; IPv4Only = false; }
  57       #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
  58     ];
  59     settings.BandwidthRate = 500000;
  60     settings.ReducedExitPolicy = true;
  61     settings.ExitPolicy = [
  62       # irc.freenode.net
  63       "reject 185.30.166.38"
  64       "reject 185.30.166.37"
  65       "reject 38.229.70.22"
  66       "reject 130.185.232.126"
  67       "reject 185.191.225.10"
  68       "reject [2a01:7e00::f03c:91ff:fee2:413b]"
  69       "reject [2001:6b0:e:2a18::119]"
  70       "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
  71     ];
  72     /*
  73       settings.TransPort = { port = 9040; };
  74       settings.DNSPort = { port = 9053; };
  75       #settings.ExtORPort = lib.mkForce null;
  76       settings.AutomapHostsOnResolve = true;
  77     */
  78   };
  79   /*
  80     boot.initrd.secrets = {
  81     "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
  82     gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
  83     };
  84     boot.initrd.extraUtilsCommands = ''
  85     copy_bin_and_libs ${pkgs.tor}/bin/tor
  86     '';
  87     boot.initrd.network.postCommands = let
  88     torRc = pkgs.writeText "tor.rc" ''
  89     DataDirectory /var/lib/tor
  90     HiddenServicePort 22 127.0.0.1:2222
  91     HiddenServiceDir /var/lib/tor/onion/ssh
  92     '';
  93     in ''
  94     echo "tor: preparing onion folder"
  95     # have to do this otherwise tor does not want to start
  96     install -d -m 700 /var/lib/tor
  97
  98     echo "make sure localhost is up"
  99     ip addr add 127.0.0.1/8 dev lo
 100     ip link set lo up
 101
 102     echo "tor: starting tor"
 103     tor -f ${torRc} --verify-config
 104     tor -f ${torRc} &
 105     '';
 106   */
 107 }