From 749a49d0ab72c4ad97fbfd5736e0424aa343cd3c Mon Sep 17 00:00:00 2001 From: "Casper V. Kristensen" Date: Thu, 7 Mar 2024 23:39:41 +0100 Subject: [PATCH] unmodularise tor --- hosts/tor/default.nix | 1 - {modules => hosts}/tor/tor-exit-notice.html | 0 hosts/tor/tor.nix | 98 ++++++++++++++++++- modules/tor/default.nix | 102 -------------------- 4 files changed, 97 insertions(+), 104 deletions(-) rename {modules => hosts}/tor/tor-exit-notice.html (100%) delete mode 100644 modules/tor/default.nix diff --git a/hosts/tor/default.nix b/hosts/tor/default.nix index 49d580b..dbe47a6 100644 --- a/hosts/tor/default.nix +++ b/hosts/tor/default.nix @@ -3,7 +3,6 @@ ../../overlays ../../modules/base ../../modules/server - ../../modules/tor ./hardware.nix ./network.nix ./tor.nix diff --git a/modules/tor/tor-exit-notice.html b/hosts/tor/tor-exit-notice.html similarity index 100% rename from modules/tor/tor-exit-notice.html rename to hosts/tor/tor-exit-notice.html diff --git a/hosts/tor/tor.nix b/hosts/tor/tor.nix index 1ce10d1..5efe35c 100644 --- a/hosts/tor/tor.nix +++ b/hosts/tor/tor.nix @@ -1,7 +1,18 @@ -{...}: { +{ + config, + pkgs, + ... +}: { services.tor = { + enable = true; + openFirewall = true; + relay = { + enable = true; + role = "exit"; + }; settings = { Nickname = "DXV7520"; + ContactInfo = "admin@caspervk.net"; ORPort = [ { addr = "91.210.59.57"; @@ -12,6 +23,91 @@ port = 443; } ]; + ControlPort = 9051; # for nyx + DirPort = 80; + DirPortFrontPage = builtins.toFile "tor-exit-notice.html" (builtins.readFile ./tor-exit-notice.html); + ExitRelay = true; + IPv6Exit = true; + ExitPolicy = [ + "reject *:25" + "accept *:*" + ]; }; }; + + # https://support.torproject.org/relay-operators/#relay-operators_relay-bridge-overloaded + # https://lists.torproject.org/pipermail/tor-talk/2012-August/025296.html + # https://www.ibm.com/docs/en/linux-on-systems?topic=recommendations-network-performance-tuning + # https://github.com/Enkidu-6/tor-ddos + boot.kernel.sysctl = { + # Increase the maximum size of the network interface's receive queue, used + # to store received frames after removing them from the network adapter's + # ring buffer. High speed adapters should use a high value to prevent the + # queue from becoming full and dropping packets causing retransmits. + "net.core.netdev_max_backlog" = 262144; + # Increase TCP read/write buffers to enable scaling to a larger window + # size. Larger windows increase the amount of data to be transferred before + # an acknowledgement (ACK) is required. This reduces overall latencies and + # results in increased throughput. + "net.core.rmem_max" = 33554432; + "net.core.wmem_max" = 33554432; + "net.ipv4.tcp_rmem" = "4096 131072 33554432"; + "net.ipv4.tcp_wmem" = "4096 65536 33554432"; + # Reduce the length of time an orphaned connection will wait before it is + # aborted. For workloads or systems that generate or support high levels of + # network traffic, it can be advantageous to more aggressively reclaim dead + # or stale resources. + "net.ipv4.tcp_fin_timeout" = 10; + # Maximal number of TCP sockets not attached to any user file handle, held + # by system. If this number is exceeded orphaned connections are reset + # immediately and warning is printed. This limit exists only to prevent + # simple DoS attacks, you _must_ not rely on this or lower the limit + # artificially, but rather increase it (probably, after increasing + # installed memory), if network conditions require more than default value, + # and tune network services to linger and kill such states more + # aggressively. Let me to remind again: each orphan eats up to ~64K of + # unswappable memory. + "net.ipv4.tcp_max_orphans" = 262144; + # Maximal number of timewait sockets held by system simultaneously. If this + # number is exceeded time-wait socket is immediately destroyed and warning + # is printed. This limit exists only to prevent simple DoS attacks, you + # _must_ not lower the limit artificially, but rather increase it + # (probably, after increasing installed memory), if network conditions + # require more than default value. + "net.ipv4.tcp_max_tw_buckets" = 2097152; + # In high traffic environments, sockets are created and destroyed at very + # high rates. This parameter, when set, allows "no longer needed" and + # "about to be destroyed" sockets to be used for new connections. When + # enabled, this parameter can bypass the allocation and initialization + # overhead normally associated with socket creation saving CPU cycles, + # system load and time. + "net.ipv4.tcp_tw_reuse" = 1; + # Aggressivelly check for and close broken connections + "net.ipv4.tcp_keepalive_time" = 60; + "net.ipv4.tcp_keepalive_probes" = 3; + "net.ipv4.tcp_keepalive_intvl" = 10; + # Increase the length of the SYN queue and socket listen() backlog to + # accommodate more connections waiting to connect. + "net.ipv4.tcp_max_syn_backlog" = 262144; + "net.core.somaxconn" = 32768; + # Expand local port range used for outgoing connections + "net.ipv4.ip_local_port_range" = "1025 65530"; + # Disable RFC1323 timestamps (TODO: why?) + "net.ipv4.tcp_timestamps" = 0; + }; + + environment.systemPackages = with pkgs; [ + nyx # Command-line monitor for Tor + ]; + + environment.persistence."/nix/persist" = { + directories = [ + { + directory = "/var/lib/tor"; + user = "tor"; + group = "tor"; + mode = "0700"; + } + ]; + }; } diff --git a/modules/tor/default.nix b/modules/tor/default.nix deleted file mode 100644 index ef8928a..0000000 --- a/modules/tor/default.nix +++ /dev/null @@ -1,102 +0,0 @@ -{ - config, - pkgs, - ... -}: { - services.tor = { - enable = true; - openFirewall = true; - relay = { - enable = true; - role = "exit"; - }; - settings = { - ContactInfo = "admin@caspervk.net"; - ControlPort = 9051; # for nyx - DirPort = 80; - DirPortFrontPage = builtins.toFile "tor-exit-notice.html" (builtins.readFile ./tor-exit-notice.html); - ExitRelay = true; - IPv6Exit = true; - ExitPolicy = [ - "reject *:25" - "accept *:*" - ]; - }; - }; - - # https://support.torproject.org/relay-operators/#relay-operators_relay-bridge-overloaded - # https://lists.torproject.org/pipermail/tor-talk/2012-August/025296.html - # https://www.ibm.com/docs/en/linux-on-systems?topic=recommendations-network-performance-tuning - # https://github.com/Enkidu-6/tor-ddos - boot.kernel.sysctl = { - # Increase the maximum size of the network interface's receive queue, used - # to store received frames after removing them from the network adapter's - # ring buffer. High speed adapters should use a high value to prevent the - # queue from becoming full and dropping packets causing retransmits. - "net.core.netdev_max_backlog" = 262144; - # Increase TCP read/write buffers to enable scaling to a larger window - # size. Larger windows increase the amount of data to be transferred before - # an acknowledgement (ACK) is required. This reduces overall latencies and - # results in increased throughput. - "net.core.rmem_max" = 33554432; - "net.core.wmem_max" = 33554432; - "net.ipv4.tcp_rmem" = "4096 131072 33554432"; - "net.ipv4.tcp_wmem" = "4096 65536 33554432"; - # Reduce the length of time an orphaned connection will wait before it is - # aborted. For workloads or systems that generate or support high levels of - # network traffic, it can be advantageous to more aggressively reclaim dead - # or stale resources. - "net.ipv4.tcp_fin_timeout" = 10; - # Maximal number of TCP sockets not attached to any user file handle, held - # by system. If this number is exceeded orphaned connections are reset - # immediately and warning is printed. This limit exists only to prevent - # simple DoS attacks, you _must_ not rely on this or lower the limit - # artificially, but rather increase it (probably, after increasing - # installed memory), if network conditions require more than default value, - # and tune network services to linger and kill such states more - # aggressively. Let me to remind again: each orphan eats up to ~64K of - # unswappable memory. - "net.ipv4.tcp_max_orphans" = 262144; - # Maximal number of timewait sockets held by system simultaneously. If this - # number is exceeded time-wait socket is immediately destroyed and warning - # is printed. This limit exists only to prevent simple DoS attacks, you - # _must_ not lower the limit artificially, but rather increase it - # (probably, after increasing installed memory), if network conditions - # require more than default value. - "net.ipv4.tcp_max_tw_buckets" = 2097152; - # In high traffic environments, sockets are created and destroyed at very - # high rates. This parameter, when set, allows "no longer needed" and - # "about to be destroyed" sockets to be used for new connections. When - # enabled, this parameter can bypass the allocation and initialization - # overhead normally associated with socket creation saving CPU cycles, - # system load and time. - "net.ipv4.tcp_tw_reuse" = 1; - # Aggressivelly check for and close broken connections - "net.ipv4.tcp_keepalive_time" = 60; - "net.ipv4.tcp_keepalive_probes" = 3; - "net.ipv4.tcp_keepalive_intvl" = 10; - # Increase the length of the SYN queue and socket listen() backlog to - # accommodate more connections waiting to connect. - "net.ipv4.tcp_max_syn_backlog" = 262144; - "net.core.somaxconn" = 32768; - # Expand local port range used for outgoing connections - "net.ipv4.ip_local_port_range" = "1025 65530"; - # Disable RFC1323 timestamps (TODO: why?) - "net.ipv4.tcp_timestamps" = 0; - }; - - environment.systemPackages = with pkgs; [ - nyx # Command-line monitor for Tor - ]; - - environment.persistence."/nix/persist" = { - directories = [ - { - directory = "/var/lib/tor"; - user = "tor"; - group = "tor"; - mode = "0700"; - } - ]; - }; -}