This repository has no description
1.4 kB
52 lines
1{ config, pkgs, ... }:
2## unlock command:
3# (pass admin/$host/root;echo) | torify ssh root@$(pass hosts/$host/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
4{
5 boot.initrd.network.enable = true;
6 boot.initrd.network.ssh = {
7 enable = true;
8 port = 22;
9 authorizedKeys = [
10 config.krebs.users.lass.pubkey
11 config.krebs.users.lass-mors.pubkey
12 config.krebs.users.lass-green.pubkey
13 ];
14 hostKeys = [ "${config.krebs.secret.directory}/ssh.ed25519_key" ];
15 };
16 boot.initrd.availableKernelModules = [ "e1000e" ];
17
18 boot.initrd.secrets = {
19 "/etc/tor/onion/bootup" = "${config.krebs.secret.directory}/initrd";
20 };
21
22 boot.initrd.extraUtilsCommands = ''
23 copy_bin_and_libs ${pkgs.tor}/bin/tor
24 '';
25
26 # start tor during boot process
27 boot.initrd.network.postCommands =
28 let
29 torRc = (
30 pkgs.writeText "tor.rc" ''
31 DataDirectory /etc/tor
32 SOCKSPort 127.0.0.1:9050 IsolateDestAddr
33 SOCKSPort 127.0.0.1:9063
34 HiddenServiceDir /etc/tor/onion/bootup
35 HiddenServicePort 22 127.0.0.1:22
36 ''
37 );
38 in
39 ''
40 echo "tor: preparing onion folder"
41 # have to do this otherwise tor does not want to start
42 chmod -R 700 /etc/tor
43
44 echo "make sure localhost is up"
45 ip a a 127.0.0.1/8 dev lo
46 ip link set lo up
47
48 echo "tor: starting tor"
49 tor -f ${torRc} --verify-config
50 tor -f ${torRc} &
51 '';
52}