machines/losurdo/networking/tor.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.services) tor;
   5   inherit (config.users) users;
   6   inherit (config.security) gnupg;
   7   ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]);
   8   onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd";
   9 in
  10 {
  11 environment.systemPackages = [
  12   #pkgs.pythonPackages.stem
  13   pkgs.nyx
  14 ];
  15 networking.nftables.ruleset = ''
  16   add rule inet filter fw2net meta skuid ${users.tor.name} meta l4proto tcp counter accept comment "Tor"
  17 '' + lib.optionalString (ports != []) ''
  18   add rule inet filter net2fw tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "Tor"
  19 '';
  20 #security.gnupg.secrets."tor/auth/julm" = {};
  21 security.gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key" = {};
  22 systemd.services.tor = {
  23   after    = [ gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".service ];
  24   requires = [ gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".service ];
  25 };
  26 services.tor = {
  27   enable = true;
  28   enableGeoIP = true;
  29   controlSocket.enable = true;
  30   client.enable = true;
  31   relay.enable = false;
  32   relay.role = "private-bridge";
  33   #client.privoxy.enable = false;
  34   relay.onionServices = {
  35     "ssh/${networking.domain}/${networking.hostName}" = {
  36       secretKey = gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
  37       map = [ 22 ];
  38       /*
  39       authorizedClients = [
  40         "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
  41       ];
  42       */
  43       settings = {
  44         #HiddenServiceNumIntroductionPoints = 20;
  45       };
  46     };
  47   };
  48   settings.ORPort = [
  49     #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
  50     { port = 2222; IPv4Only = false; }
  51     #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
  52   ];
  53   settings.BandwidthRate = 500000;
  54   settings.ReducedExitPolicy = true;
  55   settings.ExitPolicy = [
  56     # irc.freenode.net
  57     "reject 185.30.166.38"
  58     "reject 185.30.166.37"
  59     "reject 38.229.70.22"
  60     "reject 130.185.232.126"
  61     "reject 185.191.225.10"
  62     "reject [2a01:7e00::f03c:91ff:fee2:413b]"
  63     "reject [2001:6b0:e:2a18::119]"
  64     "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
  65   ];
  66   /*
  67   settings.TransPort = { port = 9040; };
  68   settings.DNSPort = { port = 9053; };
  69   #settings.ExtORPort = lib.mkForce null;
  70   settings.AutomapHostsOnResolve = true;
  71   */
  72 };
  73 /*
  74 boot.initrd.secrets = {
  75   "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
  76     gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
  77 };
  78 boot.initrd.extraUtilsCommands = ''
  79   copy_bin_and_libs ${pkgs.tor}/bin/tor
  80 '';
  81 boot.initrd.network.postCommands = let
  82   torRc = pkgs.writeText "tor.rc" ''
  83     DataDirectory /var/lib/tor
  84     HiddenServicePort 22 127.0.0.1:2222
  85     HiddenServiceDir /var/lib/tor/onion/ssh
  86   '';
  87   in ''
  88   echo "tor: preparing onion folder"
  89   # have to do this otherwise tor does not want to start
  90   install -d -m 700 /var/lib/tor
  91
  92   echo "make sure localhost is up"
  93   ip addr add 127.0.0.1/8 dev lo
  94   ip link set lo up
  95
  96   echo "tor: starting tor"
  97   tor -f ${torRc} --verify-config
  98   tor -f ${torRc} &
  99 '';
 100 */
 101 }