inherit (config) networking;
inherit (config.services) tor;
inherit (config.users) users;
- inherit (config.security) gnupg;
- ports = lib.flatten (map (map (p: p.port)) [tor.settings.ORPort tor.settings.DirPort]);
+ ports = lib.flatten (map (map (p: p.port)) [ tor.settings.ORPort tor.settings.DirPort ]);
onion = "5spcvlzbaxwo4knhwnrekjtnakxmvekmlc5qwsigi33rn45hd5gewlyd";
in
{
-environment.systemPackages = [
- #pkgs.pythonPackages.stem
- pkgs.nyx
-];
-networking.nftables.ruleset = lib.optionalString (ports != []) ''
- table inet filter {
- chain input-net {
- tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "tor"
+ environment.systemPackages = [
+ #pkgs.pythonPackages.stem
+ pkgs.nyx
+ ];
+ networking.nftables.ruleset = lib.optionalString (ports != [ ]) ''
+ table inet filter {
+ chain input-net {
+ tcp dport {${lib.concatMapStringsSep "," toString ports}} counter accept comment "tor"
+ }
}
- }
-'' + ''
- table inet filter {
- chain output-net {
- skuid ${users.tor.name} tcp counter accept comment "tor"
+ '' + ''
+ table inet filter {
+ chain output-net {
+ skuid ${users.tor.name} tcp counter accept comment "tor"
+ }
}
- }
-'';
-systemd.services.tor.serviceConfig.LoadCredentialEncrypted =
- "${onion}.hs_ed25519_secret_key:" + ./tor + "/${onion}.hs_ed25519_secret_key.cred";
-services.tor = {
- enable = true;
- enableGeoIP = true;
- controlSocket.enable = true;
- client.enable = true;
- client.dns.enable = true;
- relay.enable = false;
- relay.role = "private-bridge";
- #client.privoxy.enable = false;
- relay.onionServices = {
- "ssh/${networking.domain}/${networking.hostName}" = {
- secretKey = "/run/credentials/tor.service/${onion}.hs_ed25519_secret_key";
- map = [ 22 ];
- /*
+ '';
+ systemd.services.tor.serviceConfig.LoadCredentialEncrypted = [
+ "${onion}.hs_ed25519_secret_key:${./tor + "/${onion}.hs_ed25519_secret_key.cred"}"
+ ];
+ services.tor = {
+ enable = true;
+ enableGeoIP = true;
+ controlSocket.enable = true;
+ client.enable = true;
+ client.dns.enable = true;
+ relay.enable = false;
+ relay.role = "private-bridge";
+ #client.privoxy.enable = false;
+ relay.onionServices = {
+ "ssh/${networking.domain}/${networking.hostName}" = {
+ secretKey = "/run/credentials/tor.service/${onion}.hs_ed25519_secret_key";
+ map = [ 22 ];
+ /*
authorizedClients = [
"descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
];
- */
- settings = {
- #HiddenServiceNumIntroductionPoints = 20;
+ */
+ settings = {
+ #HiddenServiceNumIntroductionPoints = 20;
+ };
};
};
+ settings.AutomapHostsSuffixes = [ ".onion" ];
+ settings.ORPort = [
+ #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
+ { port = 2222; IPv4Only = false; }
+ #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
+ ];
+ settings.BandwidthRate = 500000;
+ settings.ReducedExitPolicy = true;
+ settings.ExitPolicy = [
+ # irc.freenode.net
+ "reject 185.30.166.38"
+ "reject 185.30.166.37"
+ "reject 38.229.70.22"
+ "reject 130.185.232.126"
+ "reject 185.191.225.10"
+ "reject [2a01:7e00::f03c:91ff:fee2:413b]"
+ "reject [2001:6b0:e:2a18::119]"
+ "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
+ ];
+ /*
+ settings.TransPort = { port = 9040; };
+ settings.DNSPort = { port = 9053; };
+ #settings.ExtORPort = lib.mkForce null;
+ settings.AutomapHostsOnResolve = true;
+ */
};
- settings.AutomapHostsSuffixes = [".onion"];
- settings.ORPort = [
- #{ addr = "[::]"; port = 2222; NoAdvertise = false; IPv6Only = true; }
- { port = 2222; IPv4Only = false; }
- #{ addr = "80.67.180.251"; port = 222; IPv4Only = true; NoAdvertise = true; }
- ];
- settings.BandwidthRate = 500000;
- settings.ReducedExitPolicy = true;
- settings.ExitPolicy = [
- # irc.freenode.net
- "reject 185.30.166.38"
- "reject 185.30.166.37"
- "reject 38.229.70.22"
- "reject 130.185.232.126"
- "reject 185.191.225.10"
- "reject [2a01:7e00::f03c:91ff:fee2:413b]"
- "reject [2001:6b0:e:2a18::119]"
- "reject [2600:3c02::f03c:91ff:fe59:7d2e]"
- ];
/*
- settings.TransPort = { port = 9040; };
- settings.DNSPort = { port = 9053; };
- #settings.ExtORPort = lib.mkForce null;
- settings.AutomapHostsOnResolve = true;
- */
-};
-/*
-boot.initrd.secrets = {
- "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
+ boot.initrd.secrets = {
+ "/var/lib/tor/onion/ssh/hs_ed25519_secret_key" =
gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
-};
-boot.initrd.extraUtilsCommands = ''
- copy_bin_and_libs ${pkgs.tor}/bin/tor
-'';
-boot.initrd.network.postCommands = let
- torRc = pkgs.writeText "tor.rc" ''
+ };
+ boot.initrd.extraUtilsCommands = ''
+ copy_bin_and_libs ${pkgs.tor}/bin/tor
+ '';
+ boot.initrd.network.postCommands = let
+ torRc = pkgs.writeText "tor.rc" ''
DataDirectory /var/lib/tor
HiddenServicePort 22 127.0.0.1:2222
HiddenServiceDir /var/lib/tor/onion/ssh
- '';
- in ''
- echo "tor: preparing onion folder"
- # have to do this otherwise tor does not want to start
- install -d -m 700 /var/lib/tor
+ '';
+ in ''
+ echo "tor: preparing onion folder"
+ # have to do this otherwise tor does not want to start
+ install -d -m 700 /var/lib/tor
- echo "make sure localhost is up"
- ip addr add 127.0.0.1/8 dev lo
- ip link set lo up
+ echo "make sure localhost is up"
+ ip addr add 127.0.0.1/8 dev lo
+ ip link set lo up
- echo "tor: starting tor"
- tor -f ${torRc} --verify-config
- tor -f ${torRc} &
-'';
-*/
+ echo "tor: starting tor"
+ tor -f ${torRc} --verify-config
+ tor -f ${torRc} &
+ '';
+ */
}