]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking/tor.nix
private: remove
[sourcephile-nix.git] / hosts / losurdo / networking / tor.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (config) networking;
4 inherit (config.services) tor;
5 inherit (config.users) users;
6 inherit (config.security) gnupg;
7 ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]);
8 onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd";
9 in
10 {
11 environment.systemPackages = [
12 #pkgs.pythonPackages.stem
13 pkgs.nyx
14 ];
15 networking.nftables.ruleset = lib.optionalString (ports != []) ''
16 table inet filter {
17 chain input-net {
18 tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "tor"
19 }
20 }
21 '' + ''
22 table inet filter {
23 chain output-net {
24 skuid ${users.tor.name} tcp counter accept comment "tor"
25 }
26 }
27 '';
28 systemd.services.tor.serviceConfig.LoadCredentialEncrypted =
29 "${onion}.hs_ed25519_secret_key:" + ./tor + "/${onion}.hs_ed25519_secret_key.cred";
30 services.tor = {
31 enable = true;
32 enableGeoIP = true;
33 controlSocket.enable = true;
34 client.enable = true;
35 client.dns.enable = true;
36 relay.enable = false;
37 relay.role = "private-bridge";
38 #client.privoxy.enable = false;
39 relay.onionServices = {
40 "ssh/${networking.domain}/${networking.hostName}" = {
41 secretKey = "/run/credentials/tor.service/${onion}.hs_ed25519_secret_key";
42 map = [ 22 ];
43 /*
44 authorizedClients = [
45 "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
46 ];
47 */
48 settings = {
49 #HiddenServiceNumIntroductionPoints = 20;
50 };
51 };
52 };
53 settings.AutomapHostsSuffixes = [".onion"];
54 settings.ORPort = [
55 #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
56 { port = 2222; IPv4Only = false; }
57 #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
58 ];
59 settings.BandwidthRate = 500000;
60 settings.ReducedExitPolicy = true;
61 settings.ExitPolicy = [
62 # irc.freenode.net
63 "reject 185.30.166.38"
64 "reject 185.30.166.37"
65 "reject 38.229.70.22"
66 "reject 130.185.232.126"
67 "reject 185.191.225.10"
68 "reject [2a01:7e00::f03c:91ff:fee2:413b]"
69 "reject [2001:6b0:e:2a18::119]"
70 "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
71 ];
72 /*
73 settings.TransPort = { port = 9040; };
74 settings.DNSPort = { port = 9053; };
75 #settings.ExtORPort = lib.mkForce null;
76 settings.AutomapHostsOnResolve = true;
77 */
78 };
79 /*
80 boot.initrd.secrets = {
81 "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
82 gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
83 };
84 boot.initrd.extraUtilsCommands = ''
85 copy_bin_and_libs ${pkgs.tor}/bin/tor
86 '';
87 boot.initrd.network.postCommands = let
88 torRc = pkgs.writeText "tor.rc" ''
89 DataDirectory /var/lib/tor
90 HiddenServicePort 22 127.0.0.1:2222
91 HiddenServiceDir /var/lib/tor/onion/ssh
92 '';
93 in ''
94 echo "tor: preparing onion folder"
95 # have to do this otherwise tor does not want to start
96 install -d -m 700 /var/lib/tor
97
98 echo "make sure localhost is up"
99 ip addr add 127.0.0.1/8 dev lo
100 ip link set lo up
101
102 echo "tor: starting tor"
103 tor -f ${torRc} --verify-config
104 tor -f ${torRc} &
105 '';
106 */
107 }