nix-bitcoin/modules/onion-chef.nix

# The onion chef module allows unprivileged users to read onion hostnames.
# By default the onion hostnames in /var/lib/tor/onion are only readable by the
# tor user. The onion chef copies the onion hostnames into into
# /var/lib/onion-chef and sets permissions according to the access option.

{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.onion-chef;
  inherit (config) nix-bitcoin-services;
  dataDir = "/var/lib/onion-chef/";
  onion-chef-script = pkgs.writeScript "onion-chef.sh" ''
    # wait until tor is up
    until ls -l /var/lib/tor/state; do sleep 1; done

    cd ${dataDir}

    # Create directory for every user and set permissions
    ${ builtins.foldl'
      (x: user: x +
        ''
        mkdir -p -m 0700 ${user}
        chown ${user} ${user}
          # Copy onion hostnames into the user's directory
          ${ builtins.foldl'
            (x: onion: x +
              ''
              ONION_FILE=/var/lib/tor/onion/${onion}/hostname
              if [ -e "$ONION_FILE" ]; then
                cp $ONION_FILE ${user}/${onion}
                chown ${user} ${user}/${onion}
              fi
              '')
            ""
            (builtins.getAttr user cfg.access)
          }
        '')
      ""
      (builtins.attrNames cfg.access)
    }
  '';
in {
  options.services.onion-chef = {
    enable = mkOption {
      type = types.bool;
      default = false;
      description = ''
        If enabled, the onion-chef service will be installed.
      '';
    };
    access = mkOption {
      type = types.attrs;
      default = {};
      description = ''
        This option controls who is allowed to access onion hostnames.  For
        example the following allows the user operator to access the bitcoind
        and clightning onion.
        {
          "operator" = [ "bitcoind" "clightning" ];
        };
        The onion hostnames can then be read from
        /var/lib/onion-chef/<user>.
      '';
    };
  };

  config = mkIf cfg.enable {
    systemd.tmpfiles.rules = [
      "d '${dataDir}' 0755 root root - -"
    ];

    systemd.services.onion-chef = {
      description = "Run onion-chef";
      wantedBy = [ "tor.service" ];
      bindsTo = [ "tor.service" ];
      after = [ "tor.service" ];
      serviceConfig = nix-bitcoin-services.defaultHardening // {
        ExecStart = "${pkgs.bash}/bin/bash ${onion-chef-script}";
        Type = "oneshot";
        RemainAfterExit = true;
        PrivateNetwork = "true"; # This service needs no network access
        PrivateUsers = "false";
        ReadWritePaths = "${dataDir}";
        CapabilityBoundingSet = "CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER";
      };
    };
  };
}