summaryrefslogtreecommitdiffstats
path: root/krebs/2configs/tor/initrd.nix
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2020-12-02 00:45:50 +0100
committertv <tv@krebsco.de>2020-12-02 00:45:50 +0100
commitd60b1b793f3a1635c1fe30aa11b64831fd665b4f (patch)
treed484b1315dab9b6c3d230118f6e33b0888f0aca5 /krebs/2configs/tor/initrd.nix
parent29827720520b6a4885dbdcb3237070e6e45dd910 (diff)
parent813eefa3c55fd1cd234b0adb1da7286bd761b579 (diff)
Merge remote-tracking branch 'prism/master' into master
Diffstat (limited to 'krebs/2configs/tor/initrd.nix')
-rw-r--r--krebs/2configs/tor/initrd.nix50
1 files changed, 50 insertions, 0 deletions
diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix
new file mode 100644
index 000000000..98ed039b4
--- /dev/null
+++ b/krebs/2configs/tor/initrd.nix
@@ -0,0 +1,50 @@
+{config, pkgs, ... }:
+## unlock command:
+# (brain hosts/puyak/luks-ssd;echo) | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
+{
+ boot.initrd.network.enable = true;
+ boot.initrd.network.ssh = {
+ enable = true;
+ port = 22;
+ authorizedKeys = [
+ config.krebs.users.jeschli-brauerei.pubkey
+ config.krebs.users.lass.pubkey
+ config.krebs.users.lass-mors.pubkey
+ config.krebs.users.makefu.pubkey
+ config.krebs.users.tv.pubkey
+ ];
+ hostKeys = [ <secrets/initrd/openssh_host_ecdsa_key> ];
+ };
+ boot.initrd.availableKernelModules = [ "e1000e" ];
+
+ boot.initrd.secrets = {
+ "/etc/tor/onion/bootup" = <secrets/initrd>;
+ };
+
+ boot.initrd.extraUtilsCommands = ''
+ copy_bin_and_libs ${pkgs.tor}/bin/tor
+ '';
+
+ # start tor during boot process
+ boot.initrd.network.postCommands = let
+ torRc = (pkgs.writeText "tor.rc" ''
+ DataDirectory /etc/tor
+ SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+ SOCKSPort 127.0.0.1:9063
+ HiddenServiceDir /etc/tor/onion/bootup
+ HiddenServicePort 22 127.0.0.1:22
+ '');
+ in ''
+ echo "tor: preparing onion folder"
+ # have to do this otherwise tor does not want to start
+ chmod -R 700 /etc/tor
+
+ echo "make sure localhost is up"
+ ip a a 127.0.0.1/8 dev lo
+ ip link set lo up
+
+ echo "tor: starting tor"
+ tor -f ${torRc} --verify-config
+ tor -f ${torRc} &
+ '';
+}