{ config, lib, pkgs, factsGenerator, clanLib, ... }: with lib; with types; { options.features.boot.tor = { enable = lib.mkOption { type = lib.types.bool; default = false; }; }; config = mkIf (config.features.boot.tor.enable) { # tor secrets clan.core.facts.services."initrd.tor" = factsGenerator.tor { name = "initrd"; addressPrefix = "init"; }; boot.initrd.secrets = mapAttrs' (name: file: nameValuePair "/etc/tor/onion/bootup/${name}" file) ( genAttrs [ "hostname" "hs_ed25519_public_key" "hs_ed25519_secret_key" ] (secret: config.clan.core.facts.services."initrd.tor".secret."tor.initrd.${secret}".path) ); boot.initrd.systemd.storePaths = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ]; boot.initrd.systemd.contents = { "/etc/tor/tor.rc".text = '' DataDirectory /etc/tor SOCKSPort 127.0.0.1:9050 IsolateDestAddr SOCKSPort 127.0.0.1:9063 HiddenServiceDir /etc/tor/onion/bootup HiddenServicePort 2222 127.0.0.1:2222 ''; }; boot.initrd.systemd.services.tor = { description = "tor during init"; wantedBy = [ "initrd.target" ]; after = [ "network.target" "initrd-nixos-copy-secrets.service" ]; before = [ "shutdown.target" ]; conflicts = [ "shutdown.target" ]; unitConfig.DefaultDependencies = false; path = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ]; script = '' echo "tor: preparing onion folder" # have to do this otherwise tor does not want to start chmod -R 700 /etc/tor echo "tor: starting tor" tor -f /etc/tor/tor.rc --verify-config tor -f /etc/tor/tor.rc ''; }; }; }