]> Git — Sourcephile - sourcephile-nix.git/blob - machines/losurdo/networking/tor.nix
nix: fix PASSWORD_STORE_DIR
[sourcephile-nix.git] / machines / losurdo / networking / tor.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (config) networking;
4 inherit (config.services) tor;
5 inherit (config.users) users;
6 inherit (config.security) gnupg;
7 ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]);
8 in
9 {
10 environment.systemPackages = [
11 #pkgs.pythonPackages.stem
12 pkgs.nyx
13 ];
14 networking.nftables.ruleset = ''
15 add rule inet filter net2fw tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "Tor"
16 add rule inet filter fw2net meta skuid ${users.tor.name} meta l4proto tcp counter accept comment "Tor"
17 '';
18 systemd.services.tor-init.script = ''
19 install -d -m 700 -o tor -g tor /var/lib/tor/onion/${networking.domain}
20 '';
21 systemd.services.tor.serviceConfig.StateDirectoryMode = "0700";
22 #security.gnupg.secrets."tor/auth/julm" = {};
23 services.tor = {
24 enable = true;
25 #enableGeoIP = false;
26 controlSocket.enable = true;
27 #controlPort = [9051];
28 relay.enable = true;
29 relay.role = "private-bridge";
30 client.enable = true;
31 client.privoxy.enable = true;
32 /*
33 hiddenServices = {
34 "${networking.domain}/${networking.hostName}" = {
35 version = 3;
36 map = [
37 { port = 22; target = { addr = "127.0.0.1"; port = 22; }; }
38 ];
39 settings = {
40 #HiddenServiceNumIntroductionPoints = 20;
41 };
42 };
43 };
44 */
45 settings.ORPort = [
46 #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
47 { port = 2222; NoAdvertise = false; IPv4Only = false; }
48 #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
49 ];
50 settings.BandwidthRate = 500000;
51 settings.ReducedExitPolicy = true;
52 settings.ExitPolicy = [
53 # irc.freenode.net
54 "reject 185.30.166.38"
55 "reject 185.30.166.37"
56 "reject 38.229.70.22"
57 "reject 130.185.232.126"
58 "reject 185.191.225.10"
59 "reject [2a01:7e00::f03c:91ff:fee2:413b]"
60 "reject [2001:6b0:e:2a18::119]"
61 "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
62 ];
63 settings.TransPort = { port = 9040; };
64 settings.DNSPort = { port = 9053; };
65 #settings.ExtORPort = lib.mkForce null;
66 settings.AutomapHostsOnResolve = true;
67 };
68 /*
69 # copy your onion folder
70 boot.initrd.secrets = {
71 "/etc/tor/onion/bootup" = /home/tony/tor/onion; # maybe find a better spot to store this.
72 };
73
74 # copy tor to you initrd
75 boot.initrd.extraUtilsCommands = ''
76 copy_bin_and_libs ${pkgs.tor}/bin/tor
77 '';
78
79 # start tor during boot process
80 boot.initrd.network.postCommands = let
81 torRc = (pkgs.writeText "tor.rc" ''
82 DataDirectory /etc/tor
83 SOCKSPort 127.0.0.1:9050 IsolateDestAddr
84 SOCKSPort 127.0.0.1:9063
85 HiddenServiceDir /etc/tor/onion/bootup
86 HiddenServicePort 22 127.0.0.1:22
87 '');
88 in ''
89 echo "tor: preparing onion folder"
90 # have to do this otherwise tor does not want to start
91 chmod -R 700 /etc/tor
92
93 echo "make sure localhost is up"
94 ip a a 127.0.0.1/8 dev lo
95 ip link set lo up
96
97 echo "tor: starting tor"
98 tor -f ${torRc} --verify-config
99 tor -f ${torRc} &
100 '';
101 */
102 }