Cleanup remote LUKS unlock

2023-02-11 18:40:08 -07:00
parent 2c8576a295
commit 3e0cde40b8
9 changed files with 49 additions and 54 deletions
--- a/common/boot/remote-luks-unlock.nix
+++ b/common/boot/remote-luks-unlock.nix
@@ -0,0 +1,93 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.remoteLuksUnlock;
+in {
+  options.remoteLuksUnlock = {
+    enable = lib.mkEnableOption "enable luks root remote decrypt over ssh/tor";
+    enableTorUnlock = lib.mkOption {
+      type = lib.types.bool;
+      default = cfg.enable;
+      description = "Make machine accessable over tor for ssh boot unlock";
+    };
+    sshHostKeys = lib.mkOption {
+      type = lib.types.listOf (lib.types.either lib.types.str lib.types.path);
+      default = [
+        "/secret/ssh_host_rsa_key"
+        "/secret/ssh_host_ed25519_key"
+      ];
+    };
+    sshAuthorizedKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = config.users.users.googlebot.openssh.authorizedKeys.keys;
+    };
+    onionConfig = lib.mkOption {
+      type = lib.types.path;
+      default = /secret/onion;
+    };
+    kernelModules = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "e1000" "e1000e" "virtio_pci" "r8169" ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # boot.initrd.luks.devices.${cfg.device.name} = {
+    #   device = cfg.device.path;
+    #   allowDiscards = cfg.device.allowDiscards;
+    # };
+
+    # Unlock LUKS disk over ssh
+    boot.initrd.network.enable = true;
+    boot.initrd.kernelModules = cfg.kernelModules;
+    boot.initrd.network.ssh = {
+      enable = true;
+      port = 22;
+      hostKeys = cfg.sshHostKeys;
+      authorizedKeys = cfg.sshAuthorizedKeys;
+    };
+
+    boot.initrd.postDeviceCommands = ''
+      echo 'waiting for root device to be opened...'
+      mkfifo /crypt-ramfs/passphrase
+      echo /crypt-ramfs/passphrase >> /dev/null
+    '';
+
+    boot.initrd.secrets = lib.mkIf cfg.enableTorUnlock {
+      "/etc/tor/onion/bootup" = cfg.onionConfig;
+    };
+    boot.initrd.extraUtilsCommands = lib.mkIf cfg.enableTorUnlock ''
+      copy_bin_and_libs ${pkgs.tor}/bin/tor
+      copy_bin_and_libs ${pkgs.haveged}/bin/haveged
+    '';
+    boot.initrd.network.postCommands = lib.mkMerge [
+      (''
+        # Add nice prompt for giving LUKS passphrase over ssh
+        echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
+      '')
+      
+      (let torRc = (pkgs.writeText "tor.rc" ''
+        DataDirectory /etc/tor
+        SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+        SOCKSPort 127.0.0.1:9063
+        HiddenServiceDir /etc/tor/onion/bootup
+        HiddenServicePort 22 127.0.0.1:22
+      ''); in lib.mkIf cfg.enableTorUnlock ''
+        echo "tor: preparing onion folder"
+        # have to do this otherwise tor does not want to start
+        chmod -R 700 /etc/tor
+
+        echo "make sure localhost is up"
+        ip a a 127.0.0.1/8 dev lo
+        ip link set lo up
+
+        echo "haveged: starting haveged"
+        haveged -F &
+
+        echo "tor: starting tor"
+        tor -f ${torRc} --verify-config
+        tor -f ${torRc} &
+      '')
+    ];
+  };
+}