Archived
beatzaplentyandClaude Sonnet 5
91d8f8fab1
New tor-relay build type (currently lxc-only) running a plain Tor middle relay via modules/tor/enable-relay.nix, plus nyx for interactive monitoring over the relay's control socket. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1.2 KiB
Nix
36 lines
1.2 KiB
Nix
{ pkgs, vars, ... }:
|
|
|
|
{
|
|
services.tor = {
|
|
enable = true;
|
|
|
|
# Opens settings.ORPort (and DirPort, unset here) in the firewall —
|
|
# see the nixpkgs tor module's own networking.firewall.mkIf block.
|
|
openFirewall = true;
|
|
|
|
relay = {
|
|
enable = true;
|
|
# Plain middle/guard relay, not "exit" — relays onion traffic between
|
|
# other Tor nodes without ever making requests to the public internet
|
|
# on a user's behalf, avoiding the abuse complaints and legal exposure
|
|
# an exit node invites.
|
|
role = "relay";
|
|
};
|
|
|
|
settings.ORPort = vars.ports.torRelayOrPort;
|
|
|
|
# Unix control socket at /run/tor/control (GroupWritable, group "tor")
|
|
# -- what nyx below actually monitors the relay through. Nyx's own
|
|
# default control-socket path (/var/run/tor/control) resolves to the
|
|
# same place, so no extra nyx config is needed.
|
|
controlSocket.enable = true;
|
|
};
|
|
|
|
# Lets the primary user's shell session read/write the control socket
|
|
# above without being root -- otherwise nyx fails to authenticate against
|
|
# it at all.
|
|
users.users.${vars.primaryUser}.extraGroups = [ "tor" ];
|
|
|
|
environment.systemPackages = [ pkgs.nyx ];
|
|
}
|