diff options
| author | lassulus <lassulus@lassul.us> | 2021-05-03 17:59:52 +0200 |
|---|---|---|
| committer | lassulus <lassulus@lassul.us> | 2021-05-03 18:41:17 +0200 |
| commit | 950a735472f2b09b08119ba79f10c54a9efb28e6 (patch) | |
| tree | 9517e7ee5d2a5bdd1624c2689610a55ac0219a30 /lass/2configs | |
| parent | 020154a8599142dae4f9ac838fe1657dbf0da8d3 (diff) | |
l: (re)init echelon.r (with ssh tor unlocking)
Diffstat (limited to 'lass/2configs')
| -rw-r--r-- | lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key | 0 | ||||
| -rw-r--r-- | lass/2configs/tor-initrd.nix | 49 |
2 files changed, 49 insertions, 0 deletions
diff --git a/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key b/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key diff --git a/lass/2configs/tor-initrd.nix b/lass/2configs/tor-initrd.nix new file mode 100644 index 000000000..64e64b5b3 --- /dev/null +++ b/lass/2configs/tor-initrd.nix @@ -0,0 +1,49 @@ +{config, pkgs, ... }: +## unlock command: +# (pass admin/$host/root;echo) | torify ssh root@$(pass hosts/$host/initrd/hostname) 'cat > /crypt-ramfs/passphrase' +{ + boot.initrd.network.enable = true; + boot.initrd.network.ssh = { + enable = true; + port = 22; + authorizedKeys = [ + config.krebs.users.lass.pubkey + config.krebs.users.lass-mors.pubkey + config.krebs.users.lass-green.pubkey + ]; + hostKeys = [ <secrets/initrd/ssh.ed25519_key> ]; + }; + boot.initrd.availableKernelModules = [ "e1000e" ]; + + boot.initrd.secrets = { + "/etc/tor/onion/bootup" = <secrets/initrd>; + }; + + boot.initrd.extraUtilsCommands = '' + copy_bin_and_libs ${pkgs.tor}/bin/tor + ''; + + # start tor during boot process + boot.initrd.network.postCommands = let + torRc = (pkgs.writeText "tor.rc" '' + DataDirectory /etc/tor + SOCKSPort 127.0.0.1:9050 IsolateDestAddr + SOCKSPort 127.0.0.1:9063 + HiddenServiceDir /etc/tor/onion/bootup + HiddenServicePort 22 127.0.0.1:22 + ''); + in '' + echo "tor: preparing onion folder" + # have to do this otherwise tor does not want to start + chmod -R 700 /etc/tor + + echo "make sure localhost is up" + ip a a 127.0.0.1/8 dev lo + ip link set lo up + + echo "tor: starting tor" + tor -f ${torRc} --verify-config + tor -f ${torRc} & + ''; +} + |