make .onion domains declarative, site updates, add helpers
This commit is contained in:
parent
b3d2a34bc0
commit
450a5ce1d6
25 changed files with 341 additions and 109 deletions
|
|
@ -25,7 +25,7 @@
|
|||
nixosConfigurations = {
|
||||
distrust = lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [./system ./services nixos-mailserver.nixosModules.default agenix.nixosModules.default];
|
||||
modules = [./system ./services ./helpers/services.nix nixos-mailserver.nixosModules.default agenix.nixosModules.default];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
79
helpers/services.nix
Normal file
79
helpers/services.nix
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
cfg = config.distrust.services;
|
||||
in {
|
||||
options = {
|
||||
distrust = {
|
||||
services = lib.mkOption {
|
||||
description = "Services configuration map";
|
||||
type = lib.types.attrsOf (
|
||||
lib.types.submodule {
|
||||
options = {
|
||||
url = lib.mkOption {
|
||||
description = "Clearnet URL";
|
||||
type = lib.types.str;
|
||||
};
|
||||
onion = lib.mkOption {
|
||||
description = "Onion service settings";
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
url = lib.mkOption {
|
||||
description = ".onion URL";
|
||||
type = lib.types.str;
|
||||
};
|
||||
secretKey = lib.mkOption {
|
||||
description = "Path to onion secret key file";
|
||||
type = lib.types.path;
|
||||
};
|
||||
};
|
||||
};
|
||||
default = {};
|
||||
};
|
||||
virtualHostConfig = lib.mkOption {
|
||||
description = "Caddy virtual host config";
|
||||
type = lib.types.str;
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
services.tor.relay.onionServices =
|
||||
builtins.foldl'
|
||||
(acc: key:
|
||||
acc
|
||||
// {
|
||||
"${key}" = {
|
||||
map = [80];
|
||||
inherit (cfg.${key}.onion) secretKey;
|
||||
};
|
||||
})
|
||||
{}
|
||||
(builtins.attrNames cfg);
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts = builtins.foldl' (acc: key: let
|
||||
site = cfg.${key};
|
||||
vhostKey = "${site.url} ${site.onion.url}";
|
||||
extraCfg = ''
|
||||
${site.virtualHostConfig or ""}
|
||||
header Onion-Location ${site.onion.url}
|
||||
'';
|
||||
in
|
||||
acc
|
||||
// {
|
||||
"${vhostKey}" = {
|
||||
extraConfig = extraCfg;
|
||||
};
|
||||
}) {} (builtins.attrNames cfg);
|
||||
};
|
||||
};
|
||||
}
|
||||
84
helpers/tor-hostname.nix
Normal file
84
helpers/tor-hostname.nix
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
{pkgs ? import <nixpkgs> {}}:
|
||||
pkgs.python3Packages.buildPythonApplication rec {
|
||||
pname = "tor-hostname";
|
||||
version = "1.0.0";
|
||||
|
||||
format = "other";
|
||||
|
||||
propagatedBuildInputs = with pkgs.python3Packages; [
|
||||
pynacl
|
||||
cryptography
|
||||
];
|
||||
|
||||
dontUnpack = true;
|
||||
|
||||
installPhase = ''
|
||||
mkdir -p $out/bin
|
||||
cat > $out/bin/tor-hostname <<'EOF'
|
||||
#!/usr/bin/env python3
|
||||
"""Convert Tor v3 secret key to .onion hostname"""
|
||||
|
||||
import hashlib
|
||||
import base64
|
||||
import sys
|
||||
|
||||
def onion_address_from_public_key(public_key):
|
||||
"""Generate .onion address from ed25519 public key"""
|
||||
version = b'\x03'
|
||||
checksum = hashlib.sha3_256(b'.onion checksum' + public_key + version).digest()[:2]
|
||||
onion_address = base64.b32encode(public_key + checksum + version).decode().lower()
|
||||
return f"{onion_address}.onion"
|
||||
|
||||
def read_tor_secret_key(filepath):
|
||||
"""Read Tor hs_ed25519_secret_key file"""
|
||||
with open(filepath, 'rb') as f:
|
||||
content = f.read()
|
||||
|
||||
header = b'== ed25519v1-secret: type0 ==\x00\x00\x00'
|
||||
|
||||
if not content.startswith(header):
|
||||
raise ValueError("Invalid Tor secret key file format")
|
||||
|
||||
expanded_key = content[32:96]
|
||||
return expanded_key
|
||||
|
||||
def derive_public_from_expanded_secret(expanded_key):
|
||||
"""Derive ed25519 public key from 64-byte expanded secret key"""
|
||||
from nacl.bindings import crypto_scalarmult_ed25519_base_noclamp
|
||||
|
||||
secret_scalar = expanded_key[:32]
|
||||
public_key = crypto_scalarmult_ed25519_base_noclamp(secret_scalar)
|
||||
return public_key
|
||||
|
||||
def main():
|
||||
if len(sys.argv) != 2:
|
||||
print(f"Usage: {sys.argv[0]} <path_to_hs_ed25519_secret_key>")
|
||||
sys.exit(1)
|
||||
|
||||
secret_key_path = sys.argv[1]
|
||||
|
||||
try:
|
||||
expanded_key = read_tor_secret_key(secret_key_path)
|
||||
public_key = derive_public_from_expanded_secret(expanded_key)
|
||||
hostname = onion_address_from_public_key(public_key)
|
||||
print(hostname)
|
||||
except FileNotFoundError:
|
||||
print(f"Error: File not found: {secret_key_path}")
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}")
|
||||
sys.exit(1)
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
EOF
|
||||
|
||||
chmod +x $out/bin/tor-hostname
|
||||
'';
|
||||
|
||||
meta = with pkgs.lib; {
|
||||
description = "Convert Tor v3 secret key to .onion hostname";
|
||||
license = licenses.mit;
|
||||
platforms = platforms.unix;
|
||||
};
|
||||
}
|
||||
BIN
secrets/bind_pw
BIN
secrets/bind_pw
Binary file not shown.
BIN
secrets/hidden_service/akkoma
Normal file
BIN
secrets/hidden_service/akkoma
Normal file
Binary file not shown.
7
secrets/hidden_service/forgejo
Normal file
7
secrets/hidden_service/forgejo
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 OPPxWw EI6x+qUDXzqxQSlCYUbP+7QPZMnjXpltYZtqKGTC0mA
|
||||
CRKukPnjX7UkoUhvbRqp9R7okrCXSdFOKQ6NqOJOQPM
|
||||
-> ssh-ed25519 aO1l/A yYtKmIaqYqE1GtbpZ57LSOvIk3ShAKRxwLhF28+kX04
|
||||
G3LaXN/I2MQsibGKQFhaN9fozZc3WTDfduVNpSs8c6c
|
||||
--- l669kOCRaI4AYjSfEnh3ipLsLClXVtsZ7XeCVtYe76A
|
||||
S'`–G¡Õhã6mÕ×Ü ÃÝ8Ý&‡Õë#rŠÔå%‡ì@ïòwŽ`oÉ"ƒBÑXeœ¸gN fŒÞPÉd!ÉÞÝ¥©‚Cý½È@ Ç<Ypž<70>Có˜Úðˆ3›ýAû/sê"§²¯RÓ<52>¢êwP±ÉJgÔewÇ7®T'# Mÿ`
|
||||
7
secrets/hidden_service/lldap
Normal file
7
secrets/hidden_service/lldap
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 OPPxWw uTCw+F+4qeg9cwzmqutlo73TKh+3gHLlKiNnGtH0pBg
|
||||
/z43V3RLple7a9DQryhGlIuyr4zEkb1VeiP5a/Wj1uE
|
||||
-> ssh-ed25519 aO1l/A 6taX73uwY+2dvd4urZsYuzdz+nCeT1esrgwVK061/Hc
|
||||
hijoJqXSWN2yWwm8wJAzn0rxYFVKboov6auJMWJiQoE
|
||||
--- on7Z0/l1J9q8zvDBrcLV4vDvfuSpEIuuAAOaMCywwF8
|
||||
k×hÔ<EFBFBD>LJ‚8rs°¸1â/}9gîÁSÎ<53>-ˆ€ûîë™—ºÐzUÿ/é$àõlH¢¬Ytq¤•ª`C25Ÿ‘U‘Í ØtK >dq¥qp‹ëÒn¼åyxí"4§DÝ~"ÚƒeLAãq¬ÍzW°¤ <09>%V}âk<C3A2>âŸS.™ ê²ô
|
||||
7
secrets/hidden_service/microbin
Normal file
7
secrets/hidden_service/microbin
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 OPPxWw iecDZG4hirn38+rgldEWI2+8/8rq71uWNT+SHlfAiDY
|
||||
qx6clYF4hxRBJYYu0KKB7hRfPZwCbHcQpjLL941Z83c
|
||||
-> ssh-ed25519 aO1l/A l5cKreKOle24HArdayk83bPWXfXsRJ+Ra+hQJ/wIbxg
|
||||
so31JolmVJl3EFNBMY0+iFnt68e8IE21hPgywlgKEIA
|
||||
--- hde73O1LCWGqO/2nrIg8SefxAzPp8ZY1lJFzEOCkNEs
|
||||
9Q<02>•›Ú~=÷—{XCϧq†ŽÅÎÇŲ$4ü§N¢lkhë˜Ë ©õáÆïŒÜö‡5W³…5bäQk†”jŠÛº2„q¬‘½/}õ<>B<EFBFBD>%Ô+u<>wç Ž6
È-èõ0_;ÂÞ3Êãn¼£Ûd Š\l—ØÑÄ÷÷> чÉC*¥
|
||||
BIN
secrets/hidden_service/nextcloud
Normal file
BIN
secrets/hidden_service/nextcloud
Normal file
Binary file not shown.
BIN
secrets/hidden_service/site
Normal file
BIN
secrets/hidden_service/site
Normal file
Binary file not shown.
7
secrets/hidden_service/vaultwarden
Normal file
7
secrets/hidden_service/vaultwarden
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 OPPxWw yYJgjjH8GaBc+bDIPHIyyG5tBqDjIe7P/9gNhnNcCGw
|
||||
SomRbtpu4TqEa16yGBImEXWKNIUGNs5RIw1AT2YrEQg
|
||||
-> ssh-ed25519 aO1l/A 1qypu4ZiyZTqEEVEo9Rj8BO3SlPgoPHzn5gMA8SaajU
|
||||
zPPbrM6mWhhtAuU/3h8/ess31XjHf4kct9HRslv/pwM
|
||||
--- rF+OjMZvtrB5BSHs89xn8i+UitXqqmmDf+UFliwOxgI
|
||||
ô)Ý<>BZ׫JÐB1dφ<C38F>CÀF¯ÖI'¸º ü„&nb`éöi<C3B6>ùêï…¢<E280A6> ^)@Q¤uÍŠ0þ‹'°–´¸f<C2B8>‡àò8¨gé¶ý0ÏgIA È<07>¸Ø°4Ë›£÷<C2A3>å}Ë uíþYÕ›ÙÔv,}<7D>jC§5<C2A7>ÂÔ®‹
|
||||
Binary file not shown.
|
|
@ -10,4 +10,12 @@ in {
|
|||
"bind_pw".publicKeys = all;
|
||||
"nextcloud-admin-pass".publicKeys = all;
|
||||
"vaultwarden.env".publicKeys = all;
|
||||
|
||||
"hidden_service/akkoma".publicKeys = all;
|
||||
"hidden_service/forgejo".publicKeys = all;
|
||||
"hidden_service/lldap".publicKeys = all;
|
||||
"hidden_service/microbin".publicKeys = all;
|
||||
"hidden_service/nextcloud".publicKeys = all;
|
||||
"hidden_service/site".publicKeys = all;
|
||||
"hidden_service/vaultwarden".publicKeys = all;
|
||||
}
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -1,8 +1,13 @@
|
|||
{pkgs, ...}: let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
fediPort = 8083;
|
||||
onionUrl = "http://n5j5sq55iem2hzbgvkba5vwd5gx5qj2pkb7nxyginbtmnkah74rtulad.onion";
|
||||
inherit ((pkgs.formats.elixirConf {}).lib) mkAtom;
|
||||
in {
|
||||
age.secrets."hidden_service/akkoma".file = ../secrets/hidden_service/akkoma;
|
||||
|
||||
services = {
|
||||
akkoma = {
|
||||
enable = true;
|
||||
|
|
@ -35,14 +40,16 @@ in {
|
|||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
caddy.virtualHosts."https://social.distrust.network ${onionUrl}".extraConfig = ''
|
||||
distrust.services."akkoma" = {
|
||||
url = "https://social.distrust.network";
|
||||
onion = {
|
||||
url = "http://n5j5sq55iem2hzbgvkba5vwd5gx5qj2pkb7nxyginbtmnkah74rtulad.onion";
|
||||
secretKey = config.age.secrets."hidden_service/akkoma".path;
|
||||
};
|
||||
virtualHostConfig = ''
|
||||
reverse_proxy localhost:${toString fediPort}
|
||||
header Onion-Loction ${onionUrl}
|
||||
'';
|
||||
|
||||
tor.relay.onionServices."akkoma".map = [
|
||||
80
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,13 @@
|
|||
{
|
||||
services = {
|
||||
caddy.enable = true;
|
||||
tor.enable = true;
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
#globalConfig = ''
|
||||
# pki {
|
||||
# ca local {
|
||||
# name "Distrust CA"
|
||||
# }
|
||||
# }
|
||||
#'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
|
|
|
|||
|
|
@ -1,26 +1,29 @@
|
|||
let
|
||||
{config, ...}: let
|
||||
forgejoPort = 8082;
|
||||
onionUrl = "http://cr27k6asjs7skvjxs6smhqfam3wlvmft2f3iins44k6p6rmmfyolobqd.onion";
|
||||
in {
|
||||
services = {
|
||||
forgejo = {
|
||||
age.secrets."hidden_service/forgejo" = {
|
||||
file = ../secrets/hidden_service/forgejo;
|
||||
};
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
lfs.enable = false;
|
||||
settings.server = {
|
||||
DOMAIN = "git.distrust.network";
|
||||
HTTP_PORT = forgejoPort;
|
||||
ROOT_URL = "https://git.distrust.network/";
|
||||
SSH_PORT = 292;
|
||||
SSH_PORT = builtins.head config.services.openssh.ports;
|
||||
};
|
||||
};
|
||||
|
||||
caddy.virtualHosts."https://git.distrust.network ${onionUrl}".extraConfig = ''
|
||||
distrust.services."forgejo" = {
|
||||
url = "https://git.distrust.network";
|
||||
onion = {
|
||||
url = "http://cr27k6asjs7skvjxs6smhqfam3wlvmft2f3iins44k6p6rmmfyolobqd.onion";
|
||||
secretKey = config.age.secrets."hidden_service/forgejo".path;
|
||||
};
|
||||
virtualHostConfig = ''
|
||||
reverse_proxy localhost:${toString forgejoPort}
|
||||
header Onion-Location ${onionUrl}
|
||||
'';
|
||||
|
||||
tor.relay.onionServices."forgejo".map = [
|
||||
80
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,11 +1,13 @@
|
|||
let
|
||||
onionUrl = "http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion";
|
||||
{config, ...}: let
|
||||
lldapPort = 8089;
|
||||
in {
|
||||
services = {
|
||||
lldap = {
|
||||
age.secrets."hidden_service/lldap".file = ../secrets/hidden_service/lldap;
|
||||
|
||||
services.lldap = {
|
||||
enable = true;
|
||||
settings = {
|
||||
http_url = "https://login.distrust.network";
|
||||
http_port = lldapPort;
|
||||
ldap_user_email = "root@distrust.network";
|
||||
ldap_user_dn = "root";
|
||||
ldap_base_dn = "dc=distrust,dc=network";
|
||||
|
|
@ -13,13 +15,14 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
caddy.virtualHosts."https://login.distrust.network ${onionUrl}".extraConfig = ''
|
||||
reverse_proxy localhost:17170
|
||||
header Onion-Location ${onionUrl}
|
||||
distrust.services."lldap" = {
|
||||
url = "https://login.distrust.network";
|
||||
onion = {
|
||||
url = "http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion";
|
||||
secretKey = config.age.secrets."hidden_service/lldap".path;
|
||||
};
|
||||
virtualHostConfig = ''
|
||||
reverse_proxy localhost:${toString lldapPort}
|
||||
'';
|
||||
|
||||
tor.relay.onionServices."lldap".map = [
|
||||
80
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,18 +4,21 @@
|
|||
lib,
|
||||
...
|
||||
}: let
|
||||
onionDomain = "znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion";
|
||||
onionUrl = "http://${onionDomain}";
|
||||
onionHostName = "znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion";
|
||||
in {
|
||||
age.secrets."nextcloud-admin-pass".file = ../secrets/nextcloud-admin-pass;
|
||||
age.secrets = {
|
||||
"nextcloud-admin-pass".file = ../secrets/nextcloud-admin-pass;
|
||||
"hidden_service/nextcloud".file = ../secrets/hidden_service/nextcloud;
|
||||
};
|
||||
|
||||
users.groups.nextcloud.members = ["nextcloud" "caddy"];
|
||||
|
||||
services = {
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
hostName = "cloud.distrust.network";
|
||||
settings = {
|
||||
trusted_domains = [onionDomain];
|
||||
trusted_domains = [onionHostName];
|
||||
trusted_proxies = ["127.0.0.1"];
|
||||
maintenance_window_start = 1;
|
||||
};
|
||||
|
|
@ -38,7 +41,15 @@ in {
|
|||
"listen.owner" = "caddy";
|
||||
"listen.group" = "caddy";
|
||||
};
|
||||
caddy.virtualHosts."https://cloud.distrust.network ${onionUrl}".extraConfig = ''
|
||||
};
|
||||
|
||||
distrust.services."nextcloud" = {
|
||||
url = "https://cloud.distrust.network";
|
||||
onion = {
|
||||
url = "http://${onionHostName}";
|
||||
secretKey = config.age.secrets."hidden_service/nextcloud".path;
|
||||
};
|
||||
virtualHostConfig = ''
|
||||
# encode zstd gzip
|
||||
|
||||
root * ${config.services.nginx.virtualHosts."cloud.distrust.network".root}
|
||||
|
|
@ -64,7 +75,7 @@ in {
|
|||
X-Forwarded-For {remote_host}
|
||||
X-Forwarded-Proto {scheme}
|
||||
X-Forwarded-Host {host}
|
||||
Onion-Loation ${onionUrl}
|
||||
Onion-Loation http://${onionHostName}
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -98,9 +109,5 @@ in {
|
|||
|
||||
file_server
|
||||
'';
|
||||
|
||||
tor.relay.onionServices."nextcloud".map = [
|
||||
80
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
let
|
||||
{config, ...}: let
|
||||
pastePort = 8087;
|
||||
onionUrl = "http://s4h5nfnwwhzku55opxlqouobioibx4htwygnp2l4fkp256lur5s53rad.onion";
|
||||
in {
|
||||
services = {
|
||||
microbin = {
|
||||
age.secrets."hidden_service/microbin".file = ../secrets/hidden_service/microbin;
|
||||
|
||||
services.microbin = {
|
||||
enable = true;
|
||||
settings = {
|
||||
MICROBIN_PORT = pastePort;
|
||||
|
|
@ -15,13 +15,14 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
caddy.virtualHosts."https://paste.distrust.network ${onionUrl}".extraConfig = ''
|
||||
distrust.services."microbin" = {
|
||||
url = "https://paste.distrust.network";
|
||||
onion = {
|
||||
url = "http://s4h5nfnwwhzku55opxlqouobioibx4htwygnp2l4fkp256lur5s53rad.onion";
|
||||
secretKey = config.age.secrets."hidden_service/microbin".path;
|
||||
};
|
||||
virtualHostConfig = ''
|
||||
reverse_proxy localhost:${toString pastePort}
|
||||
header Onion-Location ${onionUrl}
|
||||
'';
|
||||
|
||||
tor.relay.onionServices."microbin".map = [
|
||||
80
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,15 +1,17 @@
|
|||
let
|
||||
onionUrl = "http://distrustdtp5qgbk2firlzfkkmu5p6v6acuh2ox454zd2i3ujdqad5yd.onion";
|
||||
in {
|
||||
services.caddy.virtualHosts = {
|
||||
"https://distrust.network ${onionUrl}".extraConfig = ''
|
||||
root * /etc/nixos/site
|
||||
file_server
|
||||
header Onion-Location ${onionUrl}
|
||||
'';
|
||||
{config, ...}: {
|
||||
age.secrets."hidden_service/site" = {
|
||||
file = ../secrets/hidden_service/site;
|
||||
};
|
||||
|
||||
services.tor.relay.onionServices."site".map = [
|
||||
80
|
||||
];
|
||||
distrust.services."site" = {
|
||||
url = "https://distrust.network";
|
||||
onion = {
|
||||
url = "http://distrustdtp5qgbk2firlzfkkmu5p6v6acuh2ox454zd2i3ujdqad5yd.onion";
|
||||
secretKey = config.age.secrets."hidden_service/site".path;
|
||||
};
|
||||
virtualHostConfig = ''
|
||||
root * /etc/nixos/site
|
||||
file_server
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,11 +1,12 @@
|
|||
{config, ...}: let
|
||||
vaultPort = 8222;
|
||||
onionUrl = "http://gfoqwlo4nmhcywzzyhfanhkf7hz64lkjayngfyrpbd7ohaucu3q4znqd.onion";
|
||||
in {
|
||||
age.secrets."vaultwarden.env".file = ../secrets/vaultwarden.env;
|
||||
age.secrets = {
|
||||
"vaultwarden.env".file = ../secrets/vaultwarden.env;
|
||||
"hidden_service/vaultwarden".file = ../secrets/hidden_service/vaultwarden;
|
||||
};
|
||||
|
||||
services = {
|
||||
vaultwarden = {
|
||||
services.vaultwarden = {
|
||||
enable = true;
|
||||
config = {
|
||||
DOMAIN = "https://vault.distrust.network";
|
||||
|
|
@ -14,13 +15,14 @@ in {
|
|||
environmentFile = config.age.secrets."vaultwarden.env".path;
|
||||
};
|
||||
|
||||
caddy.virtualHosts."https://vault.distrust.network ${onionUrl}".extraConfig = ''
|
||||
distrust.services."vaultwarden" = {
|
||||
url = "https://vault.distrust.network";
|
||||
onion = {
|
||||
url = "http://gfoqwlo4nmhcywzzyhfanhkf7hz64lkjayngfyrpbd7ohaucu3q4znqd.onion";
|
||||
secretKey = config.age.secrets."hidden_service/vaultwarden".path;
|
||||
};
|
||||
virtualHostConfig = ''
|
||||
reverse_proxy localhost:${toString vaultPort}
|
||||
header Onion-Location ${onionUrl}
|
||||
'';
|
||||
|
||||
tor.relay.onionServices."vaultwarden".map = [
|
||||
80
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -117,6 +117,7 @@
|
|||
<a title="Once you have logged in for the first time, check your inbox for an invite." class="hover">[hover]</a></small></li>
|
||||
<li>Microbin (Paste) <small><a href="http://s4h5nfnwwhzku55opxlqouobioibx4htwygnp2l4fkp256lur5s53rad.onion">[tor]</a>
|
||||
<a href="https://paste.distrust.network/">[clearnet]</a></small></li>
|
||||
<li>Self-Serve Password Changes <small><a href="http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion/">[tor]</a> <a href="https://login.distrust.network">[clearnet]</a></small></li>
|
||||
</ul>
|
||||
<p>We also host nodes for <a href="https://bitnodes.io/nodes/157.173.124.100-8333/" class="external">Bitcoin (BTC)</a>, <a href="https://xmr.distrust.network/get_info" title="Only available at https://xmr.distrust.network over clearnet. Port 18081 over TOR" class="hover">Monero (XMR)</a>, an <a href="https://ipfs.distrust.network/ipfs/Qmc5gCcjYypU7y28oCALwfSvxCBskLuPKWpK4qpterKC7z" title="Only available at https://ipfs.distrust.network over clearnet. Port 8080 over TOR" class="hover">IPFS gateway</a>, and a <a href="https://metrics.torproject.org/rs.html#details/DF11EEF85A2B3AD56716D89D00380D9FC5EA0740" class="external">TOR relay</a>
|
||||
to strengthen their respective networks. They are all available over clearnet and TOR using this main webpages <a title="157.173.124.100, 2a02:c207:2288:2816::1" class="hover">IP</a>
|
||||
|
|
|
|||
|
|
@ -3,8 +3,9 @@
|
|||
#!/bin/sh
|
||||
nixos-rebuild switch --flake /etc/nixos#distrust --impure
|
||||
'';
|
||||
tor-hostname = import ../helpers/tor-hostname.nix {inherit pkgs;};
|
||||
in {
|
||||
environment.systemPackages = with pkgs; [vim btop git alejandra statix deadnix] ++ [updateScript];
|
||||
environment.systemPackages = with pkgs; [vim btop git alejandra statix deadnix] ++ [updateScript tor-hostname];
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue