{ config, lib, pkgs, factsGenerator, clanLib, ... }: with lib; with types; { options.components.nixos.boot = { enable = lib.mkOption { type = lib.types.bool; default = false; }; kernelModules = mkOption { type = listOf str; default = [ ]; description = "lspci -v will tell you which kernel module is used for the ethernet interface"; }; ssh.enable = lib.mkOption { type = lib.types.bool; default = config.components.nixos.boot.enable; }; tor.enable = lib.mkOption { type = lib.types.bool; default = config.components.nixos.boot.ssh.enable; }; }; config = mkMerge [ # todo : not working at the moment, because onion hostnames are secrets ( let onionIds = clanLib.readFactFromAllMachines "tor.initrd.hostname"; generateOnionUnlockScript = machine: onionId: pkgs.writers.writeDashBin "unlock-boot-${machine}-via-tor" '' ${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222 ''; in { # add known hosts services.openssh.knownHosts = mapAttrs (_machine: onionId: { hostNames = [ "[${onionId}]:2222" ]; }) onionIds; # create unlook tor boot script environment.systemPackages = mapAttrsToList generateOnionUnlockScript onionIds; } ) # tor part # -------- (mkIf (config.components.nixos.boot.tor.enable) { #services.tor = { # enable = true; # client.enable = true; # relay.onionServices.bootup.map = [{ port = 2222; }]; #}; # tor setup clanCore.facts.services.initrd_tor = factsGenerator.tor { name = "initrd"; }; boot.initrd.secrets = { "/etc/tor/onion/bootup/tor.priv" = config.clanCore.facts.services.initrd_tor.secret."tor.initrd.priv".path; "/etc/tor/onion/bootup/hostname" = config.clanCore.facts.services.initrd_tor.secret."tor.initrd.hostname".path; }; #boot.initrd.extraUtilsCommands = '' # copy_bin_and_libs ${pkgs.tor}/bin/tor #''; # fixme: this thing is not working for some reason. boot.initrd.systemd.packages = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ]; boot.initrd.systemd.services.tor = { path = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ]; # todo: set wanted by script = let torRc = pkgs.writeText "tor.rc" '' DataDirectory /etc/tor SOCKSPort 127.0.0.1:9050 IsolateDestAddr SOCKSPort 127.0.0.1:9063 HiddenServiceDir /etc/tor/onion/bootup HiddenServicePort 2222 127.0.0.1:2222 ''; in '' echo "tor: preparing onion folder" # have to do this otherwise tor does not want to start chmod -R 700 /etc/tor echo "make sure localhost is up" ip a a 127.0.0.1/8 dev lo ip link set lo up echo "tor: starting tor" tor -f ${torRc} --verify-config tor -f ${torRc} ''; }; }) # ssh part # -------- (mkIf (config.components.nixos.boot.ssh.enable) { # boot boot.initrd.systemd.enable = true; boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}"; # network boot.initrd.systemd.network.enable = true; boot.initrd.availableKernelModules = config.components.nixos.boot.kernelModules; # ssh boot.initrd.network.enable = true; boot.initrd.network.ssh = { enable = true; #authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys ; #authorizedKeyFiles = config.users.users.root.openssh.authorizedKeys.keyFiles; port = 2222; hostKeys = map ({ path, ... }: path) config.services.openssh.hostKeys; }; }) ]; }