{ pkgs, lib, config, ... }: let inherit (config) networking; inherit (config.services) tor; inherit (config.users) users; inherit (config.security) gnupg; ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]); onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd"; in { environment.systemPackages = [ #pkgs.pythonPackages.stem pkgs.nyx ]; networking.nftables.ruleset = '' add rule inet filter fw2net meta skuid ${users.tor.name} meta l4proto tcp counter accept comment "Tor" '' + lib.optionalString (ports != []) '' add rule inet filter net2fw tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "Tor" ''; #security.gnupg.secrets."tor/auth/julm" = {}; security.gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key" = {}; services.tor = { enable = true; enableGeoIP = true; controlSocket.enable = true; client.enable = true; relay.enable = false; relay.role = "private-bridge"; #client.privoxy.enable = false; relay.onionServices = { "ssh/${networking.domain}/${networking.hostName}" = { secretKey = gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path; map = [ 22 ]; /* authorizedClients = [ "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm ]; */ settings = { #HiddenServiceNumIntroductionPoints = 20; }; }; }; settings.ORPort = [ #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; } { port = 2222; IPv4Only = false; } #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; } ]; settings.BandwidthRate = 500000; settings.ReducedExitPolicy = true; settings.ExitPolicy = [ # irc.freenode.net "reject 185.30.166.38" "reject 185.30.166.37" "reject 38.229.70.22" "reject 130.185.232.126" "reject 185.191.225.10" "reject [2a01:7e00::f03c:91ff:fee2:413b]" "reject [2001:6b0:e:2a18::119]" "reject [2600:3c02::f03c:91ff:fe59:7d2e]" ]; /* settings.TransPort = { port = 9040; }; settings.DNSPort = { port = 9053; }; #settings.ExtORPort = lib.mkForce null; settings.AutomapHostsOnResolve = true; */ }; boot.initrd.secrets = { "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" = gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path; }; boot.initrd.extraUtilsCommands = '' copy_bin_and_libs ${pkgs.tor}/bin/tor ''; boot.initrd.network.postCommands = let torRc = pkgs.writeText "tor.rc" '' DataDirectory /var/lib/tor HiddenServicePort 22 127.0.0.1:2222 HiddenServiceDir /var/lib/tor/onion/ssh ''; in '' echo "tor: preparing onion folder" # have to do this otherwise tor does not want to start install -d -m 700 /var/lib/tor echo "make sure localhost is up" ip addr add 127.0.0.1/8 dev lo ip link set lo up echo "tor: starting tor" tor -f ${torRc} --verify-config tor -f ${torRc} & ''; }