machines/losurdo/networking/tor.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.services) tor;
   5   inherit (config.users) users;
   6   ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]);
   7 in
   8 {
   9 environment.systemPackages = [
  10   #pkgs.pythonPackages.stem
  11   pkgs.nyx
  12 ];
  13 networking.nftables.ruleset = ''
  14   add rule inet filter net2fw tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "Tor"
  15   add rule inet filter fw2net meta skuid ${users.tor.name} meta l4proto tcp counter accept comment "Tor"
  16 '';
  17 systemd.services.tor-init.script = ''
  18   install -d -m 700 -o tor -g tor /var/lib/tor/onion/${networking.domain}
  19 '';
  20 systemd.services.tor.serviceConfig.StateDirectoryMode = "0700";
  21 services.tor = {
  22   enable = true;
  23   #enableGeoIP = false;
  24   controlSocket.enable = true;
  25   #controlPort = [9051];
  26   relay.enable = true;
  27   relay.role = "private-bridge";
  28   settings.ORPort = [
  29     { address = "[2001:912:2601:0:82ee:73ff:feed:f98a]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
  30     { port = 2222; NoAdvertise = false; IPv4Only = true; }
  31     #{ address = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
  32   ];
  33   #relay.exitPolicy = "accept *:*, accept6 *:*";
  34   settings.BandwidthRate = 500000;
  35   settings.ClientUseIPv4 = true;
  36   settings.ClientUseIPv6 = true;
  37   settings.ClientPreferIPv6ORPort = false;
  38   settings.ReducedExitPolicy = true;
  39   settings.ExitPolicy = [
  40     # irc.freenode.net
  41     "reject 185.30.166.38"
  42     "reject 185.30.166.37"
  43     "reject 38.229.70.22"
  44     "reject 130.185.232.126"
  45     "reject 185.191.225.10"
  46     "reject [2a01:7e00::f03c:91ff:fee2:413b]"
  47     "reject [2001:6b0:e:2a18::119]"
  48     "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
  49   ];
  50   settings.HiddenServiceDir = {
  51     "${networking.domain}/${networking.hostName}" = {
  52       HiddenServiceVersion = 3;
  53       HiddenServicePort = [
  54         { port = 22; target = { address = "127.0.0.1"; port = 22; }; }
  55       ];
  56     };
  57   };
  58   settings.TransPort = { port = 9040; };
  59   settings.DNSPort = { port = 9053; };
  60   settings.ExtORPort = lib.mkForce null;
  61   settings.AutomapHostsOnResolve = true;
  62 };
  63 /*
  64 # copy your onion folder
  65 boot.initrd.secrets = {
  66   "/etc/tor/onion/bootup" = /home/tony/tor/onion; # maybe find a better spot to store this.
  67 };
  68
  69 # copy tor to you initrd
  70 boot.initrd.extraUtilsCommands = ''
  71   copy_bin_and_libs ${pkgs.tor}/bin/tor
  72 '';
  73
  74 # start tor during boot process
  75 boot.initrd.network.postCommands = let
  76   torRc = (pkgs.writeText "tor.rc" ''
  77     DataDirectory /etc/tor
  78     SOCKSPort 127.0.0.1:9050 IsolateDestAddr
  79     SOCKSPort 127.0.0.1:9063
  80     HiddenServiceDir /etc/tor/onion/bootup
  81     HiddenServicePort 22 127.0.0.1:22
  82   '');
  83 in ''
  84   echo "tor: preparing onion folder"
  85   # have to do this otherwise tor does not want to start
  86   chmod -R 700 /etc/tor
  87
  88   echo "make sure localhost is up"
  89   ip a a 127.0.0.1/8 dev lo
  90   ip link set lo up
  91
  92   echo "tor: starting tor"
  93   tor -f ${torRc} --verify-config
  94   tor -f ${torRc} &
  95 '';
  96 */
  97 }