]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking/tor.nix
nix: update flake.lock
[sourcephile-nix.git] / hosts / losurdo / networking / tor.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (config) networking;
4 inherit (config.services) tor;
5 inherit (config.users) users;
6 inherit (config.security) gnupg;
7 ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]);
8 onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd";
9 in
10 {
11 environment.systemPackages = [
12 #pkgs.pythonPackages.stem
13 pkgs.nyx
14 ];
15 networking.nftables.ruleset = ''
16 add rule inet filter fw2net meta skuid ${users.tor.name} meta l4proto tcp counter accept comment "Tor"
17 '' + lib.optionalString (ports != []) ''
18 add rule inet filter net2fw tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "Tor"
19 '';
20 #security.gnupg.secrets."tor/auth/julm" = {};
21 security.gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key" = {
22 systemdConfig.before = [ "tor.service" ];
23 systemdConfig.requiredBy = [ "tor.service" ];
24 };
25 services.tor = {
26 enable = true;
27 enableGeoIP = true;
28 controlSocket.enable = true;
29 client.enable = true;
30 client.dns.enable = true;
31 relay.enable = false;
32 relay.role = "private-bridge";
33 #client.privoxy.enable = false;
34 relay.onionServices = {
35 "ssh/${networking.domain}/${networking.hostName}" = {
36 secretKey = gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
37 map = [ 22 ];
38 /*
39 authorizedClients = [
40 "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
41 ];
42 */
43 settings = {
44 #HiddenServiceNumIntroductionPoints = 20;
45 };
46 };
47 };
48 settings.AutomapHostsSuffixes = [".onion"];
49 settings.ORPort = [
50 #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
51 { port = 2222; IPv4Only = false; }
52 #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
53 ];
54 settings.BandwidthRate = 500000;
55 settings.ReducedExitPolicy = true;
56 settings.ExitPolicy = [
57 # irc.freenode.net
58 "reject 185.30.166.38"
59 "reject 185.30.166.37"
60 "reject 38.229.70.22"
61 "reject 130.185.232.126"
62 "reject 185.191.225.10"
63 "reject [2a01:7e00::f03c:91ff:fee2:413b]"
64 "reject [2001:6b0:e:2a18::119]"
65 "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
66 ];
67 /*
68 settings.TransPort = { port = 9040; };
69 settings.DNSPort = { port = 9053; };
70 #settings.ExtORPort = lib.mkForce null;
71 settings.AutomapHostsOnResolve = true;
72 */
73 };
74 /*
75 boot.initrd.secrets = {
76 "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
77 gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
78 };
79 boot.initrd.extraUtilsCommands = ''
80 copy_bin_and_libs ${pkgs.tor}/bin/tor
81 '';
82 boot.initrd.network.postCommands = let
83 torRc = pkgs.writeText "tor.rc" ''
84 DataDirectory /var/lib/tor
85 HiddenServicePort 22 127.0.0.1:2222
86 HiddenServiceDir /var/lib/tor/onion/ssh
87 '';
88 in ''
89 echo "tor: preparing onion folder"
90 # have to do this otherwise tor does not want to start
91 install -d -m 700 /var/lib/tor
92
93 echo "make sure localhost is up"
94 ip addr add 127.0.0.1/8 dev lo
95 ip link set lo up
96
97 echo "tor: starting tor"
98 tor -f ${torRc} --verify-config
99 tor -f ${torRc} &
100 '';
101 */
102 }