hosts/losurdo/networking/tor.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.services) tor;
   5   inherit (config.users) users;
   6   ports = lib.flatten (map (map (p: p.port)) [ tor.settings.ORPort tor.settings.DirPort ]);
   7   onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd";
   8 in
   9 {
  10   environment.systemPackages = [
  11     #pkgs.pythonPackages.stem
  12     pkgs.nyx
  13   ];
  14   networking.nftables.ruleset = lib.optionalString (ports != [ ]) ''
  15     table inet filter {
  16       chain input-net {
  17         tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "tor"
  18       }
  19     }
  20   '' + ''
  21     table inet filter {
  22       chain output-net {
  23         skuid ${users.tor.name} tcp counter accept comment "tor"
  24       }
  25     }
  26   '';
  27   systemd.services.tor.serviceConfig.LoadCredentialEncrypted =
  28     "${onion}.hs_ed25519_secret_key:" + ./tor + "/${onion}.hs_ed25519_secret_key.cred";
  29   services.tor = {
  30     enable = true;
  31     enableGeoIP = true;
  32     controlSocket.enable = true;
  33     client.enable = true;
  34     client.dns.enable = true;
  35     relay.enable = false;
  36     relay.role = "private-bridge";
  37     #client.privoxy.enable = false;
  38     relay.onionServices = {
  39       "ssh/${networking.domain}/${networking.hostName}" = {
  40         secretKey = "/run/credentials/tor.service/${onion}.hs_ed25519_secret_key";
  41         map = [ 22 ];
  42         /*
  43       authorizedClients = [
  44         "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
  45       ];
  46         */
  47         settings = {
  48           #HiddenServiceNumIntroductionPoints = 20;
  49         };
  50       };
  51     };
  52     settings.AutomapHostsSuffixes = [ ".onion" ];
  53     settings.ORPort = [
  54       #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
  55       { port = 2222; IPv4Only = false; }
  56       #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
  57     ];
  58     settings.BandwidthRate = 500000;
  59     settings.ReducedExitPolicy = true;
  60     settings.ExitPolicy = [
  61       # irc.freenode.net
  62       "reject 185.30.166.38"
  63       "reject 185.30.166.37"
  64       "reject 38.229.70.22"
  65       "reject 130.185.232.126"
  66       "reject 185.191.225.10"
  67       "reject [2a01:7e00::f03c:91ff:fee2:413b]"
  68       "reject [2001:6b0:e:2a18::119]"
  69       "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
  70     ];
  71     /*
  72       settings.TransPort = { port = 9040; };
  73       settings.DNSPort = { port = 9053; };
  74       #settings.ExtORPort = lib.mkForce null;
  75       settings.AutomapHostsOnResolve = true;
  76     */
  77   };
  78   /*
  79     boot.initrd.secrets = {
  80     "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
  81     gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
  82     };
  83     boot.initrd.extraUtilsCommands = ''
  84     copy_bin_and_libs ${pkgs.tor}/bin/tor
  85     '';
  86     boot.initrd.network.postCommands = let
  87     torRc = pkgs.writeText "tor.rc" ''
  88     DataDirectory /var/lib/tor
  89     HiddenServicePort 22 127.0.0.1:2222
  90     HiddenServiceDir /var/lib/tor/onion/ssh
  91     '';
  92     in ''
  93     echo "tor: preparing onion folder"
  94     # have to do this otherwise tor does not want to start
  95     install -d -m 700 /var/lib/tor
  96
  97     echo "make sure localhost is up"
  98     ip addr add 127.0.0.1/8 dev lo
  99     ip link set lo up
 100
 101     echo "tor: starting tor"
 102     tor -f ${torRc} --verify-config
 103     tor -f ${torRc} &
 104     '';
 105   */
 106 }