make .onion domains declarative, site updates, add helpers

flake.nix

@@ -25,7 +25,7 @@
     nixosConfigurations = {
       distrust = lib.nixosSystem {
         system = "x86_64-linux";
-        modules = [./system ./services nixos-mailserver.nixosModules.default agenix.nixosModules.default];
+        modules = [./system ./services ./helpers/services.nix nixos-mailserver.nixosModules.default agenix.nixosModules.default];
       };
     };
   };

helpers/services.nix

@@ -0,0 +1,79 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.distrust.services;
+in {
+  options = {
+    distrust = {
+      services = lib.mkOption {
+        description = "Services configuration map";
+        type = lib.types.attrsOf (
+          lib.types.submodule {
+            options = {
+              url = lib.mkOption {
+                description = "Clearnet URL";
+                type = lib.types.str;
+              };
+              onion = lib.mkOption {
+                description = "Onion service settings";
+                type = lib.types.submodule {
+                  options = {
+                    url = lib.mkOption {
+                      description = ".onion URL";
+                      type = lib.types.str;
+                    };
+                    secretKey = lib.mkOption {
+                      description = "Path to onion secret key file";
+                      type = lib.types.path;
+                    };
+                  };
+                };
+                default = {};
+              };
+              virtualHostConfig = lib.mkOption {
+                description = "Caddy virtual host config";
+                type = lib.types.str;
+              };
+            };
+          }
+        );
+        default = {};
+      };
+    };
+  };
+
+  config = {
+    services.tor.relay.onionServices =
+      builtins.foldl'
+      (acc: key:
+        acc
+        // {
+          "${key}" = {
+            map = [80];
+            inherit (cfg.${key}.onion) secretKey;
+          };
+        })
+      {}
+      (builtins.attrNames cfg);
+
+    services.caddy = {
+      enable = true;
+      virtualHosts = builtins.foldl' (acc: key: let
+        site = cfg.${key};
+        vhostKey = "${site.url} ${site.onion.url}";
+        extraCfg = ''
+          ${site.virtualHostConfig or ""}
+          header Onion-Location ${site.onion.url}
+        '';
+      in
+        acc
+        // {
+          "${vhostKey}" = {
+            extraConfig = extraCfg;
+          };
+        }) {} (builtins.attrNames cfg);
+    };
+  };
+}

helpers/tor-hostname.nix

@@ -0,0 +1,84 @@
+{pkgs ? import <nixpkgs> {}}:
+pkgs.python3Packages.buildPythonApplication rec {
+  pname = "tor-hostname";
+  version = "1.0.0";
+
+  format = "other";
+
+  propagatedBuildInputs = with pkgs.python3Packages; [
+    pynacl
+    cryptography
+  ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cat > $out/bin/tor-hostname <<'EOF'
+    #!/usr/bin/env python3
+    """Convert Tor v3 secret key to .onion hostname"""
+
+    import hashlib
+    import base64
+    import sys
+
+    def onion_address_from_public_key(public_key):
+        """Generate .onion address from ed25519 public key"""
+        version = b'\x03'
+        checksum = hashlib.sha3_256(b'.onion checksum' + public_key + version).digest()[:2]
+        onion_address = base64.b32encode(public_key + checksum + version).decode().lower()
+        return f"{onion_address}.onion"
+
+    def read_tor_secret_key(filepath):
+        """Read Tor hs_ed25519_secret_key file"""
+        with open(filepath, 'rb') as f:
+            content = f.read()
+
+        header = b'== ed25519v1-secret: type0 ==\x00\x00\x00'
+
+        if not content.startswith(header):
+            raise ValueError("Invalid Tor secret key file format")
+
+        expanded_key = content[32:96]
+        return expanded_key
+
+    def derive_public_from_expanded_secret(expanded_key):
+        """Derive ed25519 public key from 64-byte expanded secret key"""
+        from nacl.bindings import crypto_scalarmult_ed25519_base_noclamp
+
+        secret_scalar = expanded_key[:32]
+        public_key = crypto_scalarmult_ed25519_base_noclamp(secret_scalar)
+        return public_key
+
+    def main():
+        if len(sys.argv) != 2:
+            print(f"Usage: {sys.argv[0]} <path_to_hs_ed25519_secret_key>")
+            sys.exit(1)
+
+        secret_key_path = sys.argv[1]
+
+        try:
+            expanded_key = read_tor_secret_key(secret_key_path)
+            public_key = derive_public_from_expanded_secret(expanded_key)
+            hostname = onion_address_from_public_key(public_key)
+            print(hostname)
+        except FileNotFoundError:
+            print(f"Error: File not found: {secret_key_path}")
+            sys.exit(1)
+        except Exception as e:
+            print(f"Error: {e}")
+            sys.exit(1)
+
+    if __name__ == '__main__':
+        main()
+    EOF
+
+    chmod +x $out/bin/tor-hostname
+  '';
+
+  meta = with pkgs.lib; {
+    description = "Convert Tor v3 secret key to .onion hostname";
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}

secrets/hidden_service/forgejo

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 OPPxWw EI6x+qUDXzqxQSlCYUbP+7QPZMnjXpltYZtqKGTC0mA
+CRKukPnjX7UkoUhvbRqp9R7okrCXSdFOKQ6NqOJOQPM
+-> ssh-ed25519 aO1l/A yYtKmIaqYqE1GtbpZ57LSOvIk3ShAKRxwLhF28+kX04
+G3LaXN/I2MQsibGKQFhaN9fozZc3WTDfduVNpSs8c6c
+--- l669kOCRaI4AYjSfEnh3ipLsLClXVtsZ7XeCVtYe76A
+S'`–G¡Õhã6mÕ­×ÜÃÝ8Ý&‡Õë#rŠÔå%‡ì@ïòwŽ`oÉ"ƒBÑXeœ¸gN fŒÞPÉd!ÉÞÝ¥©‚Cý½È@Ç<Ypž<70>Có˜Úðˆ3›ýAû/sê"§²¯RÓ<52>¢êwP±ÉJgÔewÇ7®T'# Mÿ`

secrets/hidden_service/lldap

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 OPPxWw uTCw+F+4qeg9cwzmqutlo73TKh+3gHLlKiNnGtH0pBg
+/z43V3RLple7a9DQryhGlIuyr4zEkb1VeiP5a/Wj1uE
+-> ssh-ed25519 aO1l/A 6taX73uwY+2dvd4urZsYuzdz+nCeT1esrgwVK061/Hc
+hijoJqXSWN2yWwm8wJAzn0rxYFVKboov6auJMWJiQoE
+--- on7Z0/l1J9q8zvDBrcLV4vDvfuSpEIuuAAOaMCywwF8
+k×hÔ<EFBFBD>LJ‚8rs°¸1â/}9gîÁSÎ<53>-ˆ€ûîë™—ºÐzUÿ/é$àõlH¢¬
Ytq¤•ª`C25Ÿ‘U‘Í ØtK	>dq¥qp‹ëÒn¼åyxí"4§DÝ~"ÚƒeLAãq¬ÍzW°¤	<09>%V}âk<C3A2>âŸS.™ê²ô

secrets/hidden_service/microbin

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 OPPxWw iecDZG4hirn38+rgldEWI2+8/8rq71uWNT+SHlfAiDY
+qx6clYF4hxRBJYYu0KKB7hRfPZwCbHcQpjLL941Z83c
+-> ssh-ed25519 aO1l/A l5cKreKOle24HArdayk83bPWXfXsRJ+Ra+hQJ/wIbxg
+so31JolmVJl3EFNBMY0+iFnt68e8IE21hPgywlgKEIA
+--- hde73O1LCWGqO/2nrIg8SefxAzPp8ZY1lJFzEOCkNEs
+9Q<02>•›Ú~=÷—{XCϧq†ŽÅÎÇÅ
²$4ü§N¢lkhë˜Ë	©õáÆïŒÜö‡5W³…5bäQk†”jŠÛº2„q¬‘½/}õ<>B<EFBFBD>%Ô+u<>wçŽ6
È-èõ0_;ÂÞ3Êãn¼£ÛdŠ\l—ØÑÄ÷÷> чÉC*¥

secrets/hidden_service/vaultwarden

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 OPPxWw yYJgjjH8GaBc+bDIPHIyyG5tBqDjIe7P/9gNhnNcCGw
+SomRbtpu4TqEa16yGBImEXWKNIUGNs5RIw1AT2YrEQg
+-> ssh-ed25519 aO1l/A 1qypu4ZiyZTqEEVEo9Rj8BO3SlPgoPHzn5gMA8SaajU
+zPPbrM6mWhhtAuU/3h8/ess31XjHf4kct9HRslv/pwM
+--- rF+OjMZvtrB5BSHs89xn8i+UitXqqmmDf+UFliwOxgI
+ô)Ý<>BZ׫JÐB1dφ<C38F>CÀF¯ÖI'¸º ü„&nb`éöi<C3B6>ùêï…¢<E280A6>^)@Q¤uÍŠ0þ‹'°–´¸f<C2B8>‡àò8¨gé¶ý0ÏgIAÈ<07>¸Ø°4Ë›£÷<C2A3>å}Ë uíþYÕ›ÙÔv,}<7D>jC§5<C2A7>ÂÔ®‹

secrets/secrets.nix

@@ -10,4 +10,12 @@ in {
   "bind_pw".publicKeys = all;
   "nextcloud-admin-pass".publicKeys = all;
   "vaultwarden.env".publicKeys = all;
+
+  "hidden_service/akkoma".publicKeys = all;
+  "hidden_service/forgejo".publicKeys = all;
+  "hidden_service/lldap".publicKeys = all;
+  "hidden_service/microbin".publicKeys = all;
+  "hidden_service/nextcloud".publicKeys = all;
+  "hidden_service/site".publicKeys = all;
+  "hidden_service/vaultwarden".publicKeys = all;
 }

services/akkoma.nix

@@ -1,8 +1,13 @@
-{pkgs, ...}: let
+{
+  pkgs,
+  config,
+  ...
+}: let
   fediPort = 8083;
-  onionUrl = "http://n5j5sq55iem2hzbgvkba5vwd5gx5qj2pkb7nxyginbtmnkah74rtulad.onion";
   inherit ((pkgs.formats.elixirConf {}).lib) mkAtom;
 in {
+  age.secrets."hidden_service/akkoma".file = ../secrets/hidden_service/akkoma;
+
   services = {
     akkoma = {
       enable = true;
@@ -35,14 +40,16 @@ in {
         };
       };
     };
+  };
 
-    caddy.virtualHosts."https://social.distrust.network ${onionUrl}".extraConfig = ''
+  distrust.services."akkoma" = {
+    url = "https://social.distrust.network";
+    onion = {
+      url = "http://n5j5sq55iem2hzbgvkba5vwd5gx5qj2pkb7nxyginbtmnkah74rtulad.onion";
+      secretKey = config.age.secrets."hidden_service/akkoma".path;
+    };
+    virtualHostConfig = ''
       reverse_proxy localhost:${toString fediPort}
-      header Onion-Loction ${onionUrl}
     '';
-
-    tor.relay.onionServices."akkoma".map = [
-      80
-    ];
   };
 }

services/caddy.nix

@@ -1,7 +1,13 @@
 {
-  services = {
+  services.caddy = {
-    caddy.enable = true;
+    enable = true;
-    tor.enable = true;
+    #globalConfig = ''
+    #  pki {
+    #    ca local {
+    #      name "Distrust CA"
+    #    }
+    #  }
+    #'';
   };
 
   networking.firewall.allowedTCPPorts = [80 443];

services/forgejo.nix

@@ -1,26 +1,29 @@
-let
+{config, ...}: let
   forgejoPort = 8082;
-  onionUrl = "http://cr27k6asjs7skvjxs6smhqfam3wlvmft2f3iins44k6p6rmmfyolobqd.onion";
 in {
-  services = {
+  age.secrets."hidden_service/forgejo" = {
-    forgejo = {
+    file = ../secrets/hidden_service/forgejo;
+  };
+
+  services.forgejo = {
     enable = true;
     lfs.enable = false;
     settings.server = {
       DOMAIN = "git.distrust.network";
       HTTP_PORT = forgejoPort;
       ROOT_URL = "https://git.distrust.network/";
-        SSH_PORT = 292;
+      SSH_PORT = builtins.head config.services.openssh.ports;
     };
   };
 
-    caddy.virtualHosts."https://git.distrust.network ${onionUrl}".extraConfig = ''
+  distrust.services."forgejo" = {
+    url = "https://git.distrust.network";
+    onion = {
+      url = "http://cr27k6asjs7skvjxs6smhqfam3wlvmft2f3iins44k6p6rmmfyolobqd.onion";
+      secretKey = config.age.secrets."hidden_service/forgejo".path;
+    };
+    virtualHostConfig = ''
       reverse_proxy localhost:${toString forgejoPort}
-      header Onion-Location ${onionUrl}
     '';
-
-    tor.relay.onionServices."forgejo".map = [
-      80
-    ];
   };
 }

services/lldap.nix

@@ -1,11 +1,13 @@
-let
+{config, ...}: let
-  onionUrl = "http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion";
+  lldapPort = 8089;
 in {
-  services = {
+  age.secrets."hidden_service/lldap".file = ../secrets/hidden_service/lldap;
-    lldap = {
+
+  services.lldap = {
     enable = true;
     settings = {
       http_url = "https://login.distrust.network";
+      http_port = lldapPort;
       ldap_user_email = "root@distrust.network";
       ldap_user_dn = "root";
       ldap_base_dn = "dc=distrust,dc=network";
@@ -13,13 +15,14 @@ in {
     };
   };
 
-    caddy.virtualHosts."https://login.distrust.network ${onionUrl}".extraConfig = ''
+  distrust.services."lldap" = {
-      reverse_proxy localhost:17170
+    url = "https://login.distrust.network";
-      header Onion-Location ${onionUrl}
+    onion = {
+      url = "http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion";
+      secretKey = config.age.secrets."hidden_service/lldap".path;
+    };
+    virtualHostConfig = ''
+      reverse_proxy localhost:${toString lldapPort}
     '';
-
-    tor.relay.onionServices."lldap".map = [
-      80
-    ];
   };
 }

services/nextcloud.nix

@@ -4,18 +4,21 @@
   lib,
   ...
 }: let
-  onionDomain = "znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion";
+  onionHostName = "znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion";
-  onionUrl = "http://${onionDomain}";
 in {
-  age.secrets."nextcloud-admin-pass".file = ../secrets/nextcloud-admin-pass;
+  age.secrets = {
+    "nextcloud-admin-pass".file = ../secrets/nextcloud-admin-pass;
+    "hidden_service/nextcloud".file = ../secrets/hidden_service/nextcloud;
+  };
 
   users.groups.nextcloud.members = ["nextcloud" "caddy"];
+
   services = {
     nextcloud = {
       enable = true;
       hostName = "cloud.distrust.network";
       settings = {
-        trusted_domains = [onionDomain];
+        trusted_domains = [onionHostName];
         trusted_proxies = ["127.0.0.1"];
         maintenance_window_start = 1;
       };
@@ -38,7 +41,15 @@ in {
       "listen.owner" = "caddy";
       "listen.group" = "caddy";
     };
-    caddy.virtualHosts."https://cloud.distrust.network ${onionUrl}".extraConfig = ''
+  };
+
+  distrust.services."nextcloud" = {
+    url = "https://cloud.distrust.network";
+    onion = {
+      url = "http://${onionHostName}";
+      secretKey = config.age.secrets."hidden_service/nextcloud".path;
+    };
+    virtualHostConfig = ''
       # encode zstd gzip
 
       root * ${config.services.nginx.virtualHosts."cloud.distrust.network".root}
@@ -64,7 +75,7 @@ in {
         X-Forwarded-For {remote_host}
         X-Forwarded-Proto {scheme}
         X-Forwarded-Host {host}
-        Onion-Loation ${onionUrl}
+        Onion-Loation http://${onionHostName}
       }
 
 
@@ -98,9 +109,5 @@ in {
 
       file_server
     '';
-
-    tor.relay.onionServices."nextcloud".map = [
-      80
-    ];
   };
 }

services/paste.nix

@@ -1,9 +1,9 @@
-let
+{config, ...}: let
   pastePort = 8087;
-  onionUrl = "http://s4h5nfnwwhzku55opxlqouobioibx4htwygnp2l4fkp256lur5s53rad.onion";
 in {
-  services = {
+  age.secrets."hidden_service/microbin".file = ../secrets/hidden_service/microbin;
-    microbin = {
+
+  services.microbin = {
     enable = true;
     settings = {
       MICROBIN_PORT = pastePort;
@@ -15,13 +15,14 @@ in {
     };
   };
 
-    caddy.virtualHosts."https://paste.distrust.network ${onionUrl}".extraConfig = ''
+  distrust.services."microbin" = {
+    url = "https://paste.distrust.network";
+    onion = {
+      url = "http://s4h5nfnwwhzku55opxlqouobioibx4htwygnp2l4fkp256lur5s53rad.onion";
+      secretKey = config.age.secrets."hidden_service/microbin".path;
+    };
+    virtualHostConfig = ''
       reverse_proxy localhost:${toString pastePort}
-      header Onion-Location ${onionUrl}
     '';
-
-    tor.relay.onionServices."microbin".map = [
-      80
-    ];
   };
 }

services/site.nix

@@ -1,15 +1,17 @@
-let
+{config, ...}: {
-  onionUrl = "http://distrustdtp5qgbk2firlzfkkmu5p6v6acuh2ox454zd2i3ujdqad5yd.onion";
+  age.secrets."hidden_service/site" = {
-in {
+    file = ../secrets/hidden_service/site;
-  services.caddy.virtualHosts = {
-    "https://distrust.network ${onionUrl}".extraConfig = ''
-      root * /etc/nixos/site
-      file_server
-      header Onion-Location ${onionUrl}
-    '';
   };
 
-  services.tor.relay.onionServices."site".map = [
+  distrust.services."site" = {
-    80
+    url = "https://distrust.network";
-  ];
+    onion = {
+      url = "http://distrustdtp5qgbk2firlzfkkmu5p6v6acuh2ox454zd2i3ujdqad5yd.onion";
+      secretKey = config.age.secrets."hidden_service/site".path;
+    };
+    virtualHostConfig = ''
+      root * /etc/nixos/site
+      file_server
+    '';
+  };
 }

services/tor.nix

@@ -11,5 +11,5 @@
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 9001 ];
+  networking.firewall.allowedTCPPorts = [9001];
 }

services/vaultwarden.nix

@@ -1,11 +1,12 @@
 {config, ...}: let
   vaultPort = 8222;
-  onionUrl = "http://gfoqwlo4nmhcywzzyhfanhkf7hz64lkjayngfyrpbd7ohaucu3q4znqd.onion";
 in {
-  age.secrets."vaultwarden.env".file = ../secrets/vaultwarden.env;
+  age.secrets = {
+    "vaultwarden.env".file = ../secrets/vaultwarden.env;
+    "hidden_service/vaultwarden".file = ../secrets/hidden_service/vaultwarden;
+  };
 
-  services = {
+  services.vaultwarden = {
-    vaultwarden = {
     enable = true;
     config = {
       DOMAIN = "https://vault.distrust.network";
@@ -14,13 +15,14 @@ in {
     environmentFile = config.age.secrets."vaultwarden.env".path;
   };
 
-    caddy.virtualHosts."https://vault.distrust.network ${onionUrl}".extraConfig = ''
+  distrust.services."vaultwarden" = {
+    url = "https://vault.distrust.network";
+    onion = {
+      url = "http://gfoqwlo4nmhcywzzyhfanhkf7hz64lkjayngfyrpbd7ohaucu3q4znqd.onion";
+      secretKey = config.age.secrets."hidden_service/vaultwarden".path;
+    };
+    virtualHostConfig = ''
       reverse_proxy localhost:${toString vaultPort}
-      header Onion-Location ${onionUrl}
     '';
-
-    tor.relay.onionServices."vaultwarden".map = [
-      80
-    ];
   };
 }

site/index.html

@@ -117,6 +117,7 @@
 					<a title="Once you have logged in for the first time, check your inbox for an invite." class="hover">[hover]</a></small></li>
 				<li>Microbin (Paste) <small><a href="http://s4h5nfnwwhzku55opxlqouobioibx4htwygnp2l4fkp256lur5s53rad.onion">[tor]</a>
 					<a href="https://paste.distrust.network/">[clearnet]</a></small></li>
+				<li>Self-Serve Password Changes <small><a href="http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion/">[tor]</a> <a href="https://login.distrust.network">[clearnet]</a></small></li>
 			</ul>
 			<p>We also host nodes for <a href="https://bitnodes.io/nodes/157.173.124.100-8333/" class="external">Bitcoin (BTC)</a>, <a href="https://xmr.distrust.network/get_info" title="Only available at https://xmr.distrust.network over clearnet. Port 18081 over TOR" class="hover">Monero (XMR)</a>, an <a href="https://ipfs.distrust.network/ipfs/Qmc5gCcjYypU7y28oCALwfSvxCBskLuPKWpK4qpterKC7z" title="Only available at https://ipfs.distrust.network over clearnet. Port 8080 over TOR" class="hover">IPFS gateway</a>, and a <a href="https://metrics.torproject.org/rs.html#details/DF11EEF85A2B3AD56716D89D00380D9FC5EA0740" class="external">TOR relay</a>
 				to strengthen their respective networks. They are all available over clearnet and TOR using this main webpages <a title="157.173.124.100, 2a02:c207:2288:2816::1" class="hover">IP</a>

system/configuration.nix

@@ -3,8 +3,9 @@
     #!/bin/sh
     nixos-rebuild switch --flake /etc/nixos#distrust --impure
   '';
+  tor-hostname = import ../helpers/tor-hostname.nix {inherit pkgs;};
 in {
-  environment.systemPackages = with pkgs; [vim btop git alejandra statix deadnix] ++ [updateScript];
+  environment.systemPackages = with pkgs; [vim btop git alejandra statix deadnix] ++ [updateScript tor-hostname];
 
   nix.settings.experimental-features = ["nix-command" "flakes"];