diff options
author | tv <tv@krebsco.de> | 2020-12-02 00:45:50 +0100 |
---|---|---|
committer | tv <tv@krebsco.de> | 2020-12-02 00:45:50 +0100 |
commit | d60b1b793f3a1635c1fe30aa11b64831fd665b4f (patch) | |
tree | d484b1315dab9b6c3d230118f6e33b0888f0aca5 /krebs/2configs/tor | |
parent | 29827720520b6a4885dbdcb3237070e6e45dd910 (diff) | |
parent | 813eefa3c55fd1cd234b0adb1da7286bd761b579 (diff) |
Merge remote-tracking branch 'prism/master' into master
Diffstat (limited to 'krebs/2configs/tor')
-rw-r--r-- | krebs/2configs/tor/initrd.nix | 50 |
1 files changed, 50 insertions, 0 deletions
diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix new file mode 100644 index 00000000..98ed039b --- /dev/null +++ b/krebs/2configs/tor/initrd.nix @@ -0,0 +1,50 @@ +{config, pkgs, ... }: +## unlock command: +# (brain hosts/puyak/luks-ssd;echo) | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase' +{ + boot.initrd.network.enable = true; + boot.initrd.network.ssh = { + enable = true; + port = 22; + authorizedKeys = [ + config.krebs.users.jeschli-brauerei.pubkey + config.krebs.users.lass.pubkey + config.krebs.users.lass-mors.pubkey + config.krebs.users.makefu.pubkey + config.krebs.users.tv.pubkey + ]; + hostKeys = [ <secrets/initrd/openssh_host_ecdsa_key> ]; + }; + boot.initrd.availableKernelModules = [ "e1000e" ]; + + boot.initrd.secrets = { + "/etc/tor/onion/bootup" = <secrets/initrd>; + }; + + boot.initrd.extraUtilsCommands = '' + copy_bin_and_libs ${pkgs.tor}/bin/tor + ''; + + # start tor during boot process + boot.initrd.network.postCommands = let + torRc = (pkgs.writeText "tor.rc" '' + DataDirectory /etc/tor + SOCKSPort 127.0.0.1:9050 IsolateDestAddr + SOCKSPort 127.0.0.1:9063 + HiddenServiceDir /etc/tor/onion/bootup + HiddenServicePort 22 127.0.0.1:22 + ''); + in '' + echo "tor: preparing onion folder" + # have to do this otherwise tor does not want to start + chmod -R 700 /etc/tor + + echo "make sure localhost is up" + ip a a 127.0.0.1/8 dev lo + ip link set lo up + + echo "tor: starting tor" + tor -f ${torRc} --verify-config + tor -f ${torRc} & + ''; +} |