9b7a34989d
Split the mkinitcpio-only remote-LUKS-unlock path into an InitramfsBackend ABC with a get_backend() dispatch, and add the initramfs-tools backend for Debian / Raspberry Pi OS. - base.py: six-step backend contract; encryption.py becomes a thin, distro-neutral sequencer (get_backend by distribution). - initramfs_tools.py: crypttab `none luks,initramfs`, cmdline rewritten to root=/dev/mapper + ip=::::host:eth0:dhcp, dropbear-initramfs authorized_keys, update-initramfs -k all (no build-host uname leak). - shipped hooks (configuration/initramfs-tools/*): single-hop non-anonymous onion, libnss DNS baking, sed-not-source DHCP, kill-tor-before-pivot. - shared offline onion keygen in keygen.py; tor.py removed (logic moved to mkinitcpio.py). - raspios added to the apt distro family (session.py, raspberry.py). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
17 lines
834 B
Plaintext
17 lines
834 B
Plaintext
# Tor configuration for the initramfs onion unlock service (initramfs-tools).
|
|
# Baked into the initramfs as /etc/tor/torrc by the "tor" hook; the onion keys
|
|
# come from /etc/tor/initramfs-onion on the system.
|
|
DataDirectory /var/lib/tor
|
|
HiddenServiceDir /etc/tor/onion
|
|
HiddenServicePort 22 127.0.0.1:22
|
|
SocksPort 0
|
|
# Single-hop, non-anonymous onion service. A boot-unlock onion needs
|
|
# reachability (behind NAT / a dynamic IP), NOT server-location anonymity, so
|
|
# it can skip the multi-hop, vanguards-restricted circuits that a fresh Tor
|
|
# with a limited relay view fails to build ("Giving up on launching a
|
|
# rendezvous circuit"). Single-hop builds trivial 1-hop circuits that publish
|
|
# and rendezvous reliably. Entry guards are likewise unnecessary here.
|
|
HiddenServiceNonAnonymousMode 1
|
|
HiddenServiceSingleHopMode 1
|
|
UseEntryGuards 0
|