hosts/losurdo/networking/tor.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.services) tor;
   5   inherit (config.users) users;
   6   inherit (config.security) gnupg;
   7   ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]);
   8   onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd";
   9 in
  10 {
  11 environment.systemPackages = [
  12   #pkgs.pythonPackages.stem
  13   pkgs.nyx
  14 ];
  15 networking.nftables.ruleset = lib.optionalString (ports != []) ''
  16   table inet filter {
  17     chain input-net {
  18       tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "tor"
  19     }
  20   }
  21 '' + ''
  22   table inet filter {
  23     chain output-net {
  24       skuid ${users.tor.name} tcp counter accept comment "tor"
  25     }
  26   }
  27 '';
  28 systemd.services.tor.serviceConfig.LoadCredentialEncrypted =
  29   "${onion}.hs_ed25519_secret_key:" + ./tor + "/${onion}.hs_ed25519_secret_key.cred";
  30 services.tor = {
  31   enable = true;
  32   enableGeoIP = true;
  33   controlSocket.enable = true;
  34   client.enable = true;
  35   client.dns.enable = true;
  36   relay.enable = false;
  37   relay.role = "private-bridge";
  38   #client.privoxy.enable = false;
  39   relay.onionServices = {
  40     "ssh/${networking.domain}/${networking.hostName}" = {
  41       secretKey = "/run/credentials/tor.service/${onion}.hs_ed25519_secret_key";
  42       map = [ 22 ];
  43       /*
  44       authorizedClients = [
  45         "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
  46       ];
  47       */
  48       settings = {
  49         #HiddenServiceNumIntroductionPoints = 20;
  50       };
  51     };
  52   };
  53   settings.AutomapHostsSuffixes = [".onion"];
  54   settings.ORPort = [
  55     #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
  56     { port = 2222; IPv4Only = false; }
  57     #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
  58   ];
  59   settings.BandwidthRate = 500000;
  60   settings.ReducedExitPolicy = true;
  61   settings.ExitPolicy = [
  62     # irc.freenode.net
  63     "reject 185.30.166.38"
  64     "reject 185.30.166.37"
  65     "reject 38.229.70.22"
  66     "reject 130.185.232.126"
  67     "reject 185.191.225.10"
  68     "reject [2a01:7e00::f03c:91ff:fee2:413b]"
  69     "reject [2001:6b0:e:2a18::119]"
  70     "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
  71   ];
  72   /*
  73   settings.TransPort = { port = 9040; };
  74   settings.DNSPort = { port = 9053; };
  75   #settings.ExtORPort = lib.mkForce null;
  76   settings.AutomapHostsOnResolve = true;
  77   */
  78 };
  79 /*
  80 boot.initrd.secrets = {
  81   "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
  82     gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
  83 };
  84 boot.initrd.extraUtilsCommands = ''
  85   copy_bin_and_libs ${pkgs.tor}/bin/tor
  86 '';
  87 boot.initrd.network.postCommands = let
  88   torRc = pkgs.writeText "tor.rc" ''
  89     DataDirectory /var/lib/tor
  90     HiddenServicePort 22 127.0.0.1:2222
  91     HiddenServiceDir /var/lib/tor/onion/ssh
  92   '';
  93   in ''
  94   echo "tor: preparing onion folder"
  95   # have to do this otherwise tor does not want to start
  96   install -d -m 700 /var/lib/tor
  97
  98   echo "make sure localhost is up"
  99   ip addr add 127.0.0.1/8 dev lo
 100   ip link set lo up
 101
 102   echo "tor: starting tor"
 103   tor -f ${torRc} --verify-config
 104   tor -f ${torRc} &
 105 '';
 106 */
 107 }