try to enable tor in initrd for ssh but does not work
This commit is contained in:
parent
43e28c2d41
commit
d910872efb
4 changed files with 85 additions and 103 deletions
|
@ -38,7 +38,6 @@ in
|
||||||
{
|
{
|
||||||
|
|
||||||
imports = [
|
imports = [
|
||||||
./known-hosts-bootup.nix
|
|
||||||
./known-hosts-public.nix
|
./known-hosts-public.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
|
@ -1,85 +0,0 @@
|
||||||
{ config, lib, pkgs, private_assets, ... }:
|
|
||||||
with lib;
|
|
||||||
let
|
|
||||||
|
|
||||||
computers = {
|
|
||||||
pepe = {
|
|
||||||
onionId = fileContents "${private_assets}/onion_id_pepe";
|
|
||||||
# SHA256:aOZbqpgc5CcTNtRAzjuG/0BQZ9MF5c9u/N+UC88y8kI
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5K4UHD8cIcXB33UiOj5vyXJj+4CyyiLFDMwcyad92a";
|
|
||||||
};
|
|
||||||
chungus = {
|
|
||||||
onionId = fileContents "${private_assets}/onion_id_chungus";
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJpPfGAiARWgZbID+2IIT9dbo/PqgG/pkFsBaBUKGiu";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
in
|
|
||||||
{
|
|
||||||
|
|
||||||
config = mkIf (config.components.network.sshd.enable) {
|
|
||||||
|
|
||||||
services.openssh.knownHosts = {
|
|
||||||
"robi-init-ssh" = {
|
|
||||||
hostNames = [
|
|
||||||
"[robi]:2222"
|
|
||||||
"[144.76.13.147]:2222"
|
|
||||||
];
|
|
||||||
# SHA256:rhvbJ84cPXXezaoJiY7tFsG8CJxI2F/lLKz8q+xUW+g
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMKQ7XB6Cs9FJmHkuZ9ihbj76WsK0uJBh882ceyKaaKJ";
|
|
||||||
};
|
|
||||||
} // (mapAttrs'
|
|
||||||
(name:
|
|
||||||
{ onionId, publicKey, ... }: {
|
|
||||||
name = "${name}-init-ssh";
|
|
||||||
value = {
|
|
||||||
hostNames = [ "[${onionId}]:2222" ];
|
|
||||||
inherit publicKey;
|
|
||||||
};
|
|
||||||
})
|
|
||||||
computers);
|
|
||||||
|
|
||||||
environment.systemPackages =
|
|
||||||
let
|
|
||||||
|
|
||||||
sshTor = mapAttrsToList
|
|
||||||
(name:
|
|
||||||
{ onionId, ... }:
|
|
||||||
pkgs.writers.writeDashBin "ssh-boot-to-${name}-via-tor" ''
|
|
||||||
${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222
|
|
||||||
'')
|
|
||||||
computers;
|
|
||||||
|
|
||||||
passwordTor = mapAttrsToList
|
|
||||||
(name:
|
|
||||||
{ onionId, ... }:
|
|
||||||
pkgs.writers.writeDashBin "unlock-boot-${name}-via-tor" ''
|
|
||||||
${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222 '
|
|
||||||
echo -n "enter password : "
|
|
||||||
read password
|
|
||||||
echo "$password" > /crypt-ramfs/passphrase
|
|
||||||
'
|
|
||||||
'')
|
|
||||||
computers;
|
|
||||||
|
|
||||||
unlockInit = mapAttrsToList
|
|
||||||
(name:
|
|
||||||
{ public_ip, ... }:
|
|
||||||
pkgs.writers.writeDashBin "unlock-boot-${name}" ''
|
|
||||||
${pkgs.openssh}/bin/ssh root@${public_ip} -p 2222 '
|
|
||||||
echo -n "enter password : "
|
|
||||||
read password
|
|
||||||
echo "$password" | systemctl default
|
|
||||||
'
|
|
||||||
'')
|
|
||||||
{
|
|
||||||
orbi = {
|
|
||||||
public_ip = "95.216.66.212";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
in
|
|
||||||
sshTor ++ passwordTor ++ unlockInit;
|
|
||||||
|
|
||||||
};
|
|
||||||
}
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, factsGenerator, clanLib, ... }:
|
||||||
with lib;
|
with lib;
|
||||||
with types;
|
with types;
|
||||||
|
|
||||||
|
@ -17,19 +17,96 @@ with types;
|
||||||
"lspci -v will tell you which kernel module is used for the ethernet interface";
|
"lspci -v will tell you which kernel module is used for the ethernet interface";
|
||||||
};
|
};
|
||||||
|
|
||||||
ssh = {
|
ssh.enable = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
enable = lib.mkOption {
|
default = config.components.nixos.boot.enable;
|
||||||
type = lib.types.bool;
|
};
|
||||||
default = config.components.nixos.boot.enable;
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
|
tor.enable = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = config.components.nixos.boot.ssh.enable;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkMerge [
|
config = mkMerge [
|
||||||
|
|
||||||
|
# todo : not working at the moment, because onion hostnames are secrets
|
||||||
|
(
|
||||||
|
let
|
||||||
|
onionIds = clanLib.readFactFromAllMachines "tor.initrd.hostname";
|
||||||
|
generateOnionUnlockScript = machine: onionId: pkgs.writers.writeDashBin "unlock-boot-${machine}-via-tor" ''
|
||||||
|
${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222
|
||||||
|
'';
|
||||||
|
in
|
||||||
|
{
|
||||||
|
# add known hosts
|
||||||
|
services.openssh.knownHosts =
|
||||||
|
mapAttrs
|
||||||
|
(_machine: onionId: {
|
||||||
|
hostNames = [ "[${onionId}]:2222" ];
|
||||||
|
})
|
||||||
|
onionIds;
|
||||||
|
|
||||||
|
# create unlook tor boot script
|
||||||
|
environment.systemPackages =
|
||||||
|
mapAttrsToList generateOnionUnlockScript onionIds;
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
# tor part
|
||||||
|
# --------
|
||||||
|
(mkIf (config.components.nixos.boot.tor.enable) {
|
||||||
|
|
||||||
|
#services.tor = {
|
||||||
|
# enable = true;
|
||||||
|
# client.enable = true;
|
||||||
|
# relay.onionServices.bootup.map = [{ port = 2222; }];
|
||||||
|
#};
|
||||||
|
|
||||||
|
# tor setup
|
||||||
|
clanCore.facts.services.initrd_tor = factsGenerator.tor { name = "initrd"; };
|
||||||
|
|
||||||
|
boot.initrd.secrets = {
|
||||||
|
"/etc/tor/onion/bootup/tor.priv" = config.clanCore.facts.services.initrd_tor.secret."tor.initrd.priv".path;
|
||||||
|
"/etc/tor/onion/bootup/hostname" = config.clanCore.facts.services.initrd_tor.secret."tor.initrd.hostname".path;
|
||||||
|
};
|
||||||
|
|
||||||
|
#boot.initrd.extraUtilsCommands = ''
|
||||||
|
# copy_bin_and_libs ${pkgs.tor}/bin/tor
|
||||||
|
#'';
|
||||||
|
|
||||||
|
# fixme: this thing is not working for some reason.
|
||||||
|
boot.initrd.systemd.packages = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ];
|
||||||
|
boot.initrd.systemd.services.tor = {
|
||||||
|
path = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ];
|
||||||
|
# todo: set wanted by
|
||||||
|
script =
|
||||||
|
let
|
||||||
|
torRc = pkgs.writeText "tor.rc" ''
|
||||||
|
DataDirectory /etc/tor
|
||||||
|
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
|
||||||
|
SOCKSPort 127.0.0.1:9063
|
||||||
|
HiddenServiceDir /etc/tor/onion/bootup
|
||||||
|
HiddenServicePort 2222 127.0.0.1:2222
|
||||||
|
'';
|
||||||
|
in
|
||||||
|
''
|
||||||
|
echo "tor: preparing onion folder"
|
||||||
|
# have to do this otherwise tor does not want to start
|
||||||
|
chmod -R 700 /etc/tor
|
||||||
|
|
||||||
|
echo "make sure localhost is up"
|
||||||
|
ip a a 127.0.0.1/8 dev lo
|
||||||
|
ip link set lo up
|
||||||
|
|
||||||
|
echo "tor: starting tor"
|
||||||
|
tor -f ${torRc} --verify-config
|
||||||
|
tor -f ${torRc}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
})
|
||||||
|
|
||||||
|
|
||||||
# ssh part
|
# ssh part
|
||||||
# --------
|
# --------
|
||||||
(mkIf (config.components.nixos.boot.ssh.enable) {
|
(mkIf (config.components.nixos.boot.ssh.enable) {
|
||||||
|
|
|
@ -65,14 +65,8 @@
|
||||||
|
|
||||||
services.printing.enable = false;
|
services.printing.enable = false;
|
||||||
|
|
||||||
#virtualisation.containers.storage.settings = {
|
|
||||||
# # fixes: Error: 'overlay' is not supported over zfs, a mount_program is required: backing file system is unsupported for this graph driver
|
|
||||||
# storage.options.mount_program = "${pkgs.fuse-overlayfs}/bin/fuse-overlayfs";
|
|
||||||
#};
|
|
||||||
virtualisation.podman.extraPackages = [ pkgs.zfs ]; # make sure /var/lib/containers/storage is a zfs dataset
|
virtualisation.podman.extraPackages = [ pkgs.zfs ]; # make sure /var/lib/containers/storage is a zfs dataset
|
||||||
|
|
||||||
#sops.defaultSopsFile = ../../secrets/chungus.yaml;
|
|
||||||
|
|
||||||
networking.hostName = "chungus";
|
networking.hostName = "chungus";
|
||||||
|
|
||||||
hardware.opengl = {
|
hardware.opengl = {
|
||||||
|
@ -85,9 +79,6 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
# just enable lan
|
|
||||||
#networking.dhcpcd.allowInterfaces = [ "enp0s25" ];
|
|
||||||
|
|
||||||
# nix-shell -p speedtest_cli --run speedtest
|
# nix-shell -p speedtest_cli --run speedtest
|
||||||
#configuration.fireqos = {
|
#configuration.fireqos = {
|
||||||
# enable = false;
|
# enable = false;
|
||||||
|
|
Loading…
Reference in a new issue