diff --git a/modules/module-list.nix b/modules/module-list.nix index ce131b8a55d..7433b82e4ab 100644 --- a/modules/module-list.nix +++ b/modules/module-list.nix @@ -112,7 +112,7 @@ ./services/scheduling/cron.nix ./services/scheduling/fcron.nix ./services/security/tor.nix - ./services/security/torify.nix + ./services/security/torsocks.nix ./services/system/dbus.nix ./services/system/kerberos.nix ./services/system/nscd.nix diff --git a/modules/services/security/tor.nix b/modules/services/security/tor.nix index 8ddc468aa38..de96a7638d1 100644 --- a/modules/services/security/tor.nix +++ b/modules/services/security/tor.nix @@ -47,9 +47,9 @@ in socksListenAddress = mkOption { default = "127.0.0.1:9050"; - example = "127.0.0.1:9050, 192.168.0.1:9100"; + example = "192.168.0.1:9100"; description = '' - Bind to this address(es) to listen for connections from Socks-speaking + Bind to this address to listen for connections from Socks-speaking applications. You can also specify a port. ''; }; diff --git a/modules/services/security/torify.nix b/modules/services/security/torify.nix deleted file mode 100644 index b91d7d58505..00000000000 --- a/modules/services/security/torify.nix +++ /dev/null @@ -1,69 +0,0 @@ -{ config, pkgs, ... }: -with pkgs.lib; -let - - cfg = config.services.tor; - - torify = pkgs.writeTextFile { - name = "torify"; - text = '' - #!${pkgs.stdenv.shell} - TSOCKS_CONF_FILE=${pkgs.writeText "tsocks.conf" cfg.torify.config} LD_PRELOAD="${pkgs.tsocks}/lib/libtsocks.so $LD_PRELOAD" $@ - ''; - executable = true; - destination = "/bin/torify"; - }; - -in - -{ - - ###### interface - - options = { - - services.tor.torify = { - - enable = mkOption { - default = cfg.client.enable; - description = '' - Whether to build torify scipt to relay application traffic via TOR. - ''; - }; - - server = mkOption { - default = "localhost:9050"; - example = "192.168.0.20"; - description = '' - IP address of TOR client to use. - ''; - }; - - config = mkOption { - default = ""; - description = '' - Extra configuration. Contents will be added verbatim to TSocks - configuration file. - ''; - }; - - }; - - }; - - ###### implementation - - config = mkIf cfg.torify.enable { - - environment.systemPackages = [ torify ]; # expose it to the users - - services.tor.torify.config = '' - server = ${toString(head (splitString ":" cfg.torify.server))} - server_port = ${toString(tail (splitString ":" cfg.torify.server))} - - local = 127.0.0.0/255.128.0.0 - local = 127.128.0.0/255.192.0.0 - ''; - }; - -} \ No newline at end of file diff --git a/modules/services/security/torsocks.nix b/modules/services/security/torsocks.nix new file mode 100644 index 00000000000..5257327b384 --- /dev/null +++ b/modules/services/security/torsocks.nix @@ -0,0 +1,72 @@ +{ config, pkgs, ... }: +with pkgs.lib; +let + + cfg = config.services.tor; + + torsocks = pkgs.writeTextFile { + name = "torsocks"; + text = '' + #!${pkgs.stdenv.shell} + TORSOCKS_CONF_FILE=${pkgs.writeText "torsocks.conf" cfg.torsocks.config} LD_PRELOAD="${pkgs.torsocks}/lib/torsocks/libtorsocks.so $LD_PRELOAD" $@ + ''; + executable = true; + destination = "/bin/torsocks"; + }; + +in + +{ + + ###### interface + + options = { + + services.tor.torsocks = { + + enable = mkOption { + default = cfg.client.enable; + description = '' + Whether to build torsocks scipt to relay application traffic via TOR. + ''; + }; + + server = mkOption { + default = cfg.client.socksListenAddress; + example = "192.168.0.20"; + description = '' + IP address of TOR client to use. + ''; + }; + + config = mkOption { + default = ""; + description = '' + Extra configuration. Contents will be added verbatim to torsocks + configuration file. + ''; + }; + + }; + + }; + + ###### implementation + + config = mkIf cfg.torsocks.enable { + + environment.systemPackages = [ torsocks ]; # expose it to the users + + services.tor.torsocks.config = '' + server = ${toString(head (splitString ":" cfg.torsocks.server))} + server_port = ${toString(tail (splitString ":" cfg.torsocks.server))} + + local = 127.0.0.0/255.128.0.0 + local = 127.128.0.0/255.192.0.0 + local = 169.254.0.0/255.255.0.0 + local = 172.16.0.0/255.240.0.0 + local = 192.168.0.0/255.255.0.0 + ''; + }; + +}