puyak.r: initrd bootstrapping via tor
This commit is contained in:
parent
a23066a27e
commit
9919cb2591
@ -7,12 +7,18 @@
|
||||
<stockholm/krebs/2configs/secret-passwords.nix>
|
||||
<stockholm/krebs/2configs/hw/x220.nix>
|
||||
|
||||
|
||||
## initrd unlocking
|
||||
# (brain hosts/puyak/luks-ssd;echo) | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
|
||||
<stockholm/krebs/2configs/tor/initrd.nix>
|
||||
|
||||
<stockholm/krebs/2configs/binary-cache/nixos.nix>
|
||||
<stockholm/krebs/2configs/binary-cache/prism.nix>
|
||||
<stockholm/krebs/2configs/go.nix>
|
||||
<stockholm/krebs/2configs/ircd.nix>
|
||||
<stockholm/krebs/2configs/news.nix>
|
||||
<stockholm/krebs/2configs/news-spam.nix>
|
||||
|
||||
### shackspace
|
||||
# handle the worlddomination map via coap
|
||||
<stockholm/krebs/2configs/shack/worlddomination.nix>
|
||||
|
50
krebs/2configs/tor/initrd.nix
Normal file
50
krebs/2configs/tor/initrd.nix
Normal file
@ -0,0 +1,50 @@
|
||||
{config, pkgs, ... }:
|
||||
## unlock command:
|
||||
# (brain hosts/puyak/luks-ssd;echo) | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
|
||||
{
|
||||
boot.initrd.network.enable = true;
|
||||
boot.initrd.network.ssh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
authorizedKeys = [
|
||||
config.krebs.users.jeschli-brauerei.pubkey
|
||||
config.krebs.users.lass.pubkey
|
||||
config.krebs.users.lass-mors.pubkey
|
||||
config.krebs.users.makefu.pubkey
|
||||
config.krebs.users.tv.pubkey
|
||||
];
|
||||
hostECDSAKey = <secrets/initrd/host_ecdsa_key>;
|
||||
};
|
||||
boot.initrd.availableKernelModules = [ "e1000e" ];
|
||||
|
||||
boot.initrd.secrets = {
|
||||
"/etc/tor/onion/bootup" = <secrets/initrd>;
|
||||
};
|
||||
|
||||
boot.initrd.extraUtilsCommands = ''
|
||||
copy_bin_and_libs ${pkgs.tor}/bin/tor
|
||||
'';
|
||||
|
||||
# start tor during boot process
|
||||
boot.initrd.network.postCommands = let
|
||||
torRc = (pkgs.writeText "tor.rc" ''
|
||||
DataDirectory /etc/tor
|
||||
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
|
||||
SOCKSPort 127.0.0.1:9063
|
||||
HiddenServiceDir /etc/tor/onion/bootup
|
||||
HiddenServicePort 22 127.0.0.1:22
|
||||
'');
|
||||
in ''
|
||||
echo "tor: preparing onion folder"
|
||||
# have to do this otherwise tor does not want to start
|
||||
chmod -R 700 /etc/tor
|
||||
|
||||
echo "make sure localhost is up"
|
||||
ip a a 127.0.0.1/8 dev lo
|
||||
ip link set lo up
|
||||
|
||||
echo "tor: starting tor"
|
||||
tor -f ${torRc} --verify-config
|
||||
tor -f ${torRc} &
|
||||
'';
|
||||
}
|
Loading…
Reference in New Issue
Block a user