lim/configuration/initramfs-tools/torrc

# Tor configuration for the initramfs onion unlock service (initramfs-tools).
# Baked into the initramfs as /etc/tor/torrc by the "tor" hook; the onion keys
# come from /etc/tor/initramfs-onion on the system.
DataDirectory /var/lib/tor
HiddenServiceDir /etc/tor/onion
HiddenServicePort 22 127.0.0.1:22
SocksPort 0
# Single-hop, non-anonymous onion service. A boot-unlock onion needs
# reachability (behind NAT / a dynamic IP), NOT server-location anonymity, so
# it can skip the multi-hop, vanguards-restricted circuits that a fresh Tor
# with a limited relay view fails to build ("Giving up on launching a
# rendezvous circuit"). Single-hop builds trivial 1-hop circuits that publish
# and rendezvous reliably. Entry guards are likewise unnecessary here.
HiddenServiceNonAnonymousMode 1
HiddenServiceSingleHopMode 1
UseEntryGuards 0
feat(image): distro-agnostic remote unlock via initramfs backends + Debian support Split the mkinitcpio-only remote-LUKS-unlock path into an InitramfsBackend ABC with a get_backend() dispatch, and add the initramfs-tools backend for Debian / Raspberry Pi OS. - base.py: six-step backend contract; encryption.py becomes a thin, distro-neutral sequencer (get_backend by distribution). - initramfs_tools.py: crypttab `none luks,initramfs`, cmdline rewritten to root=/dev/mapper + ip=::::host:eth0:dhcp, dropbear-initramfs authorized_keys, update-initramfs -k all (no build-host uname leak). - shipped hooks (configuration/initramfs-tools/*): single-hop non-anonymous onion, libnss DNS baking, sed-not-source DHCP, kill-tor-before-pivot. - shared offline onion keygen in keygen.py; tor.py removed (logic moved to mkinitcpio.py). - raspios added to the apt distro family (session.py, raspberry.py). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 2026-07-22 17:00:26 +02:00			`# Tor configuration for the initramfs onion unlock service (initramfs-tools).`
			`# Baked into the initramfs as /etc/tor/torrc by the "tor" hook; the onion keys`
			`# come from /etc/tor/initramfs-onion on the system.`
			`DataDirectory /var/lib/tor`
			`HiddenServiceDir /etc/tor/onion`
			`HiddenServicePort 22 127.0.0.1:22`
			`SocksPort 0`
			`# Single-hop, non-anonymous onion service. A boot-unlock onion needs`
			`# reachability (behind NAT / a dynamic IP), NOT server-location anonymity, so`
			`# it can skip the multi-hop, vanguards-restricted circuits that a fresh Tor`
			`# with a limited relay view fails to build ("Giving up on launching a`
			`# rendezvous circuit"). Single-hop builds trivial 1-hop circuits that publish`
			`# and rendezvous reliably. Entry guards are likewise unnecessary here.`
			`HiddenServiceNonAnonymousMode 1`
			`HiddenServiceSingleHopMode 1`
			`UseEntryGuards 0`