From 9919cb25912dfcc50881239f95494dd2f8e7b858 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 5 Nov 2020 22:14:09 +0100 Subject: puyak.r: initrd bootstrapping via tor --- krebs/2configs/tor/initrd.nix | 50 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 krebs/2configs/tor/initrd.nix (limited to 'krebs/2configs/tor/initrd.nix') diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix new file mode 100644 index 00000000..cb6008f7 --- /dev/null +++ b/krebs/2configs/tor/initrd.nix @@ -0,0 +1,50 @@ +{config, pkgs, ... }: +## unlock command: +# (brain hosts/puyak/luks-ssd;echo) | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase' +{ + boot.initrd.network.enable = true; + boot.initrd.network.ssh = { + enable = true; + port = 22; + authorizedKeys = [ + config.krebs.users.jeschli-brauerei.pubkey + config.krebs.users.lass.pubkey + config.krebs.users.lass-mors.pubkey + config.krebs.users.makefu.pubkey + config.krebs.users.tv.pubkey + ]; + hostECDSAKey = ; + }; + boot.initrd.availableKernelModules = [ "e1000e" ]; + + boot.initrd.secrets = { + "/etc/tor/onion/bootup" = ; + }; + + boot.initrd.extraUtilsCommands = '' + copy_bin_and_libs ${pkgs.tor}/bin/tor + ''; + + # start tor during boot process + boot.initrd.network.postCommands = let + torRc = (pkgs.writeText "tor.rc" '' + DataDirectory /etc/tor + SOCKSPort 127.0.0.1:9050 IsolateDestAddr + SOCKSPort 127.0.0.1:9063 + HiddenServiceDir /etc/tor/onion/bootup + HiddenServicePort 22 127.0.0.1:22 + ''); + in '' + echo "tor: preparing onion folder" + # have to do this otherwise tor does not want to start + chmod -R 700 /etc/tor + + echo "make sure localhost is up" + ip a a 127.0.0.1/8 dev lo + ip link set lo up + + echo "tor: starting tor" + tor -f ${torRc} --verify-config + tor -f ${torRc} & + ''; +} -- cgit v1.2.3 From a84ec5151b0c8824bfab226c8ebd0a32fbd20ddd Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 16 Nov 2020 22:25:22 +0100 Subject: tor/initrd: use hostKeys instead of hostECDSAKey --- krebs/2configs/tor/initrd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs/2configs/tor/initrd.nix') diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix index cb6008f7..41158822 100644 --- a/krebs/2configs/tor/initrd.nix +++ b/krebs/2configs/tor/initrd.nix @@ -13,7 +13,7 @@ config.krebs.users.makefu.pubkey config.krebs.users.tv.pubkey ]; - hostECDSAKey = ; + hostKeys = [ ]; }; boot.initrd.availableKernelModules = [ "e1000e" ]; -- cgit v1.2.3 From 299039549272f6c4df6d182de5fb6579b1e474c3 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 17 Nov 2020 09:41:39 +0100 Subject: tor/initrd: fix typo in secrets-path --- krebs/2configs/tor/initrd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs/2configs/tor/initrd.nix') diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix index 41158822..98ed039b 100644 --- a/krebs/2configs/tor/initrd.nix +++ b/krebs/2configs/tor/initrd.nix @@ -13,7 +13,7 @@ config.krebs.users.makefu.pubkey config.krebs.users.tv.pubkey ]; - hostKeys = [ ]; + hostKeys = [ ]; }; boot.initrd.availableKernelModules = [ "e1000e" ]; -- cgit v1.2.3