machines/losurdo/networking/tor.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.services) tor;
   5   inherit (config.users) users;
   6   inherit (config.security) gnupg;
   7   ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]);
   8 in
   9 {
  10 environment.systemPackages = [
  11   #pkgs.pythonPackages.stem
  12   pkgs.nyx
  13 ];
  14 networking.nftables.ruleset = ''
  15   add rule inet filter net2fw tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "Tor"
  16   add rule inet filter fw2net meta skuid ${users.tor.name} meta l4proto tcp counter accept comment "Tor"
  17 '';
  18 systemd.services.tor-init.script = ''
  19   install -d -m 700 -o tor -g tor /var/lib/tor/onion/${networking.domain}
  20 '';
  21 systemd.services.tor.serviceConfig.StateDirectoryMode = "0700";
  22 #security.gnupg.secrets."tor/auth/julm" = {};
  23 services.tor = {
  24   enable = true;
  25   #enableGeoIP = false;
  26   controlSocket.enable = true;
  27   #controlPort = [9051];
  28   relay.enable = true;
  29   relay.role = "private-bridge";
  30   client.enable = true;
  31   client.privoxy.enable = true;
  32   /*
  33   hiddenServices = {
  34     "${networking.domain}/${networking.hostName}" = {
  35       version = 3;
  36       map = [
  37         { port = 22; target = { addr = "127.0.0.1"; port = 22; }; }
  38       ];
  39       settings = {
  40         #HiddenServiceNumIntroductionPoints = 20;
  41       };
  42     };
  43   };
  44   */
  45   settings.ORPort = [
  46     #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
  47     { port = 2222; NoAdvertise = false; IPv4Only = false; }
  48     #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
  49   ];
  50   settings.BandwidthRate = 500000;
  51   settings.ReducedExitPolicy = true;
  52   settings.ExitPolicy = [
  53     # irc.freenode.net
  54     "reject 185.30.166.38"
  55     "reject 185.30.166.37"
  56     "reject 38.229.70.22"
  57     "reject 130.185.232.126"
  58     "reject 185.191.225.10"
  59     "reject [2a01:7e00::f03c:91ff:fee2:413b]"
  60     "reject [2001:6b0:e:2a18::119]"
  61     "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
  62   ];
  63   settings.TransPort = { port = 9040; };
  64   settings.DNSPort = { port = 9053; };
  65   #settings.ExtORPort = lib.mkForce null;
  66   settings.AutomapHostsOnResolve = true;
  67 };
  68 /*
  69 # copy your onion folder
  70 boot.initrd.secrets = {
  71   "/etc/tor/onion/bootup" = /home/tony/tor/onion; # maybe find a better spot to store this.
  72 };
  73
  74 # copy tor to you initrd
  75 boot.initrd.extraUtilsCommands = ''
  76   copy_bin_and_libs ${pkgs.tor}/bin/tor
  77 '';
  78
  79 # start tor during boot process
  80 boot.initrd.network.postCommands = let
  81   torRc = (pkgs.writeText "tor.rc" ''
  82     DataDirectory /etc/tor
  83     SOCKSPort 127.0.0.1:9050 IsolateDestAddr
  84     SOCKSPort 127.0.0.1:9063
  85     HiddenServiceDir /etc/tor/onion/bootup
  86     HiddenServicePort 22 127.0.0.1:22
  87   '');
  88 in ''
  89   echo "tor: preparing onion folder"
  90   # have to do this otherwise tor does not want to start
  91   chmod -R 700 /etc/tor
  92
  93   echo "make sure localhost is up"
  94   ip a a 127.0.0.1/8 dev lo
  95   ip link set lo up
  96
  97   echo "tor: starting tor"
  98   tor -f ${torRc} --verify-config
  99   tor -f ${torRc} &
 100 '';
 101 */
 102 }