···
torDirectory = "/var/lib/tor";
opt = name: value: optionalString (value != null) "${name} ${value}";
+
optint = name: value: optionalString (value != null && value != 0) "${name} ${toString value}";
···
GeoIPv6File ${pkgs.tor.geoip}/share/tor/geoip6
+
${optint "ControlPort" (toString cfg.controlPort)}
# Client connection config
+ optionalString cfg.client.enable ''
···
+ optionalString cfg.relay.enable ''
+
ORPort ${toString cfg.relay.port}
+
${opt "Address" cfg.relay.address}
${opt "Nickname" cfg.relay.nickname}
${opt "ContactInfo" cfg.relay.contactInfo}
···
${opt "AccountingMax" cfg.relay.accountingMax}
${opt "AccountingStart" cfg.relay.accountingStart}
+
${if (cfg.relay.role == "exit") then
opt "ExitPolicy" cfg.relay.exitPolicy
+
${optionalString (elem cfg.relay.role ["bridge" "private-bridge"]) ''
ServerTransportPlugin obfs2,obfs3 exec ${pkgs.pythonPackages.obfsproxy}/bin/obfsproxy managed
+
${optionalString (cfg.relay.role == "private-bridge") ''
+
PublishServerDescriptor 0
+
+ concatStrings (flip mapAttrsToList cfg.hiddenServices (n: v: ''
+
HiddenServiceDir ${torDirectory}/onion/${v.name}
+
${flip concatMapStrings v.map (p: ''
+
HiddenServicePort ${toString p.port} ${p.destination}
+
torRcFile = pkgs.writeText "torrc" torRc;
···
+
type = types.nullOr (types.either types.int types.str);
If set, Tor will accept connections on the specified port
···
example = "192.168.0.1:9101";
Bind to this address to listen for connections from
+
Socks-speaking applications. Same as
+
<option>socksListenAddress</option> but uses weaker
+
circuit isolation to provide performance suitable for a
···
example = "accept 192.168.0.0/16, reject *";
Entry policies to allow/deny SOCKS requests based on IP
+
address. First entry that matches wins. If no SocksPolicy
is set, we accept all (and only) requests from
+
<option>socksListenAddress</option>.
···
Whether to enable relaying TOR traffic for others.
+
See <link xlink:href="https://www.torproject.org/docs/tor-doc-relay" />
+
Setting this to true requires setting
+
<option>services.tor.relay.role</option>
+
<option>services.tor.relay.port</option>
+
type = types.enum [ "exit" "relay" "bridge" "private-bridge" ];
+
Your role in Tor network. There're several options:
+
<term><literal>exit</literal></term>
+
An exit relay. This allows Tor users to access regular
+
Internet services through your public IP.
+
Running an exit relay may expose you to abuse
+
<link xlink:href="https://www.torproject.org/faq.html.en#ExitPolicies" />
+
You can specify which services Tor users may access via
+
your exit relay using <option>exitPolicy</option> option.
+
<term><literal>relay</literal></term>
+
Regular relay. This allows Tor users to relay onion
+
traffic to other Tor nodes, but not to public
+
Note that some misconfigured and/or disrespectful
+
towards privacy sites will block you even if your
+
relay is not an exit relay. That is, just being listed
+
in a public relay directory can have unwanted
+
Which means you might not want to use
+
this role if you browse public Internet from the same
+
network as your relay, unless you want to write
+
e-mails to those sites (you should!).
+
<link xlink:href="https://www.torproject.org/docs/tor-doc-relay.html.en" />
+
<term><literal>bridge</literal></term>
+
Regular bridge. Works like a regular relay, but
+
doesn't list you in the public relay directory and
+
hides your Tor node behind obfsproxy.
+
Using this option will make Tor advertise your bridge
+
to users through various mechanisms like
+
<link xlink:href="https://bridges.torproject.org/" />, though.
+
WARNING: THE FOLLOWING PARAGRAPH IS NOT LEGAL ADVISE.
+
Consult with your lawer when in doubt.
+
This role should be safe to use in most situations
+
(unless the act of forwarding traffic for others is
+
a punishable offence under your local laws, which
+
would be pretty insane as it would make ISP
+
See <link xlink:href="https://www.torproject.org/docs/bridges.html.en" />
+
<term><literal>private-bridge</literal></term>
+
Private bridge. Works like regular bridge, but does
+
not advertise your node in any way.
+
Using this role means that you won't contribute to Tor
+
network in any way unless you advertise your node
+
Use this if you want to run a private bridge, for
+
example because you'll give out your bridge address
+
manually to your friends.
+
Switching to this role after measurable time in
+
"bridge" role is pretty useless as some Tor users
+
would have learned about your node already. In the
+
latter case you can still change
+
<option>port</option> option.
+
See <link xlink:href="https://www.torproject.org/docs/bridges.html.en" />
···
bandwidthRate = mkOption {
+
type = types.nullOr types.int;
Specify this to limit the bandwidth usage of relayed (server)
···
bandwidthBurst = mkOption {
+
type = types.nullOr types.int;
default = cfg.relay.bandwidthRate;
···
+
type = types.nullOr types.str;
+
example = "noname.example.com";
+
The IP address or full DNS name for advertised address of your relay.
+
Leave unset and Tor will guess.
+
type = types.either types.int types.str;
What port to advertise for Tor connections. This corresponds to the
<literal>ORPort</literal> section in the Tor manual; see
···
considered first to last, and the first match wins. If you
want to _replace_ the default exit policy, end this with
either a reject *:* or an accept *:*. Otherwise, you're
+
_augmenting_ (prepending to) the default exit policy.
+
Leave commented to just use the default, which is
available in the man page or at
+
<link xlink:href="https://www.torproject.org/documentation.html" />.
+
<link xlink:href="https://www.torproject.org/faq-abuse.html#TypicalAbuses" />
+
for issues you might encounter if you use the default
If certain IPs and ports are blocked externally, e.g. by
your firewall, you should update your exit policy to
···
hiddenServices = mkOption {
+
A set of static hidden services that terminate their Tor
+
Every element in this set declares a virtual onion host.
+
You can specify your onion address by putting corresponding
+
private key to an appropriate place in ${torDirectory}.
+
For services without private keys in ${torDirectory} Tor
+
daemon will generate random key pairs (which implies random
+
onion addresses) on restart. The latter could take a while,
+
Hidden services can be useful even if you don't intend to
+
actually <emphasis>hide</emphasis> them, since they can
+
also be seen as a kind of NAT traversal mechanism.
+
E.g. the example will make your sshd, whatever runs on
+
"8080" and your mail server available from anywhere where
+
the Tor network is available (which, with the help from
+
bridges, is pretty much everywhere), even if both client
+
and server machines are behind NAT you have no control
+
example = literalExample ''
+
{ "my-hidden-service-example".map = [
+
{ port = 22; } # map ssh port to this machine's ssh
+
{ port = 80; toPort = 8080; } # map http port to whatever runs on 8080
+
{ port = "sip"; toHost = "mail.example.com"; toPort = "imap"; } # because we can
+
type = types.loaOf (types.submodule ({name, config, ...}: {
+
Name of this tor hidden service.
+
This is purely descriptive.
+
After restarting Tor daemon you should be able to
+
find your .onion address in
+
<literal>${torDirectory}/onion/$name/hostname</literal>.
+
description = "Port mapping for this hidden service.";
+
type = types.listOf (types.submodule ({config, ...}: {
+
type = types.either types.int types.str;
+
Hidden service port to "bind to".
+
destination = mkOption {
+
description = "Forward these connections where?";
+
description = "Mapping destination host.";
+
type = types.either types.int types.str;
+
description = "Mapping destination port.";
+
toPort = mkDefault config.port;
+
destination = mkDefault "${config.toHost}:${toString config.toPort}";
config = mkIf cfg.enable {
+
# Not sure if `cfg.relay.role == "private-bridge"` helps as tor
+
warnings = optional (cfg.relay.enable && cfg.hiddenServices != {})
+
Running Tor hidden services on a public relay makes the
+
presence of hidden services visible through simple statistical
+
analysis of publicly available data.
+
You can safely ignore this warning if you don't intend to
+
actually hide your hidden services. In either case, you can
+
always create a container/VM with a separate Tor daemon instance.
users.extraGroups.tor.gid = config.ids.gids.tor;
···
restartTriggers = [ torRcFile ];
# Translated from the upstream contrib/dist/tor.service.in
+
install -o tor -g tor -d ${torDirectory}/onion
+
${pkgs.tor}/bin/tor -f ${torRcFile} --verify-config
ExecStart = "${pkgs.tor}/bin/tor -f ${torRcFile} --RunAsDaemon 0";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
pyrox.dev