38 lines
1.6 KiB
Plaintext
38 lines
1.6 KiB
Plaintext
|
#!/bin/bash
|
||
|
|
# mkinitcpio install hook: Tor onion service for remote LUKS unlock.
|
||
|
|
# Installed to /etc/initcpio/install/tor by linux-image-manager.
|
||
|
|
|
||
|
|
build() {
|
||
|
|
add_binary /usr/bin/tor
|
||
|
|
# Full busybox for the ntpd applet: boards without an RTC (e.g. most
|
||
|
|
# Raspberry Pis) wake up in 1970, which Tor's consensus checks reject.
|
||
|
|
# A different target path keeps mkinitcpio's own busybox untouched.
|
||
|
|
add_binary /usr/bin/busybox /usr/local/bin/busybox
|
||
|
|
# glibc resolves the NTP server hostname via getaddrinfo(), which dlopen()s
|
||
|
|
# these NSS modules at runtime — add_binary only follows NEEDED libs, so
|
||
|
|
# without them DNS silently fails, ntpd never syncs, and the clock stays
|
||
|
|
# at 1970. glibc's built-in default (no nsswitch.conf) is "dns ... files".
|
||
|
|
add_binary /usr/lib/libnss_dns.so.2
|
||
|
|
add_binary /usr/lib/libnss_files.so.2
|
||
|
|
add_file /etc/tor/initramfs-torrc /etc/tor/torrc
|
||
|
|
add_file /etc/tor/initramfs-onion/hostname /etc/tor/onion/hostname
|
||
|
|
add_file /etc/tor/initramfs-onion/hs_ed25519_public_key /etc/tor/onion/hs_ed25519_public_key
|
||
|
|
add_file /etc/tor/initramfs-onion/hs_ed25519_secret_key /etc/tor/onion/hs_ed25519_secret_key
|
||
|
|
add_runscript
|
||
|
|
}
|
||
|
|
|
||
|
|
help() {
|
||
|
|
cat <<HELPEOF
|
||
|
|
Starts a Tor onion service in early userspace so the dropbear unlock
|
||
|
|
shell stays reachable under the .onion address baked into the image,
|
||
|
|
even behind NAT or a dynamic IP.
|
||
|
|
|
||
|
|
Place it between netconf and dropbear:
|
||
|
|
HOOKS=(... netconf tor dropbear encryptssh ...)
|
||
|
|
|
||
|
|
Optional kernel parameter:
|
||
|
|
tor_ntp=<server> NTP server used to set the clock before Tor starts
|
||
|
|
(default: pool.ntp.org)
|
||
|
|
HELPEOF
|
||
|
|
}
|