torrc-related server scripts

Author: pastly

README.txt

@@ -25,10 +25,11 @@ Alliuminated domain.webm
   its README for more information. SAT domains used to be called "Alliuminated"
   domains.
 
-nginx.conf.tmpl
+server-scripts/
 
-  The starting point for an nginx config file. When parsed, it configures nginx
-  to add the necessary HTTP headers to its responses for our extension to work.
+  Scripts and config templates useful for the managing the server-side. This
+  includes an nginx config template and update script, as well as a torrc
+  config template and update script.
 
 tor/
 
@@ -41,10 +42,6 @@ tor.selfauth-sig-0.3.5.7.tar.xz
   The Tor code as of my branch selfauth-sig-0.3.5.7 in case this is easier for
   you than a submodule.
 
-update-satis-sig-nginx-conf.sh
-
-  Take the signatures generated by Tor, combine them with the nginx config
-  template, and outputs the final nginx template.
 
                 Setting Up Client Side (Easy mode)
                 ----------------------------------
@@ -145,10 +142,12 @@ work.
   Tor has generated its signature over the appropriate data in
   data/hs/satis_sig.
 
-  I use nginx and (at the time of writing) the included nginx.conf.tmpl and
-  update-satis-sig-nginx-conf.sh to get this data into my nginx config. These
-  are a little more complex than would be necessary for other people,
-  especially if you don't want to use the purposefully bad signatures too.
+  I use nginx and (at the time of writing) the included
+  server-scripts/nginx.conf.tmpl and
+  server-scripts/update-satis-sig-nginx-conf.sh to get this data into my nginx
+  config. These are a little more complex than would be necessary for other
+  people, especially if you don't want to use the purposefully bad signatures
+  too.
 
   To encoded the file in base 64, do something like this:
 

server-scripts/torrc.tmpl

@@ -0,0 +1,17 @@
+# This is a torrc fragment that can be %include-d in a fuller torrc.
+# For example:
+#     SocksPort 0
+#     DataDirectory data
+#     Log notice file data/notice.log
+#     PidFile data/tor.pid
+#     # ... more torrc options you may have ...
+#     %include foo.com.torrc
+#     %include bar.com.torrc
+#     # ... more torrc options you may have ...
+HiddenServiceDir data/hs
+HiddenServicePort 443
+HiddenServiceVersion 3
+HiddenServiceSatisSig 1
+HiddenServiceSatisDomain M4_TRAD_DOMAIN
+HiddenServiceSatisFingerprint M4_TLS_FP
+HiddenServiceSatisSigInterval 86400

server-scripts/update-torrc.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -e
+
+# Variables
+####################################
+cert_fname="/etc/letsencrypt/live/satis.system33.pw/fullchain.pem"
+traditional_domain_name="satis.system33.pw"
+torrc_tmpl_fname="torrc.tmpl"
+torrc_out_fname="/home/satis/src/tor/satis.system33.pw.torrc"
+reload_tor_command="cat /home/satis/src/tor/data/tor.pid | xargs kill -HUP"
+
+# Useful functions
+####################################
+function fail {
+	echo $1 >&2
+	exit 1
+}
+
+function get_cert_fp {
+	# Use openssl to get the given certificate's SHA256 fingerprint
+	fname="$1"
+	[ "$fname" != "" ] || fail "Must pass a filename to get_cert_fp"
+	[ -f "$fname" ] || fail "$fname does not exist"
+	openssl x509 -in "$fname" -noout -fingerprint -sha256 |\
+		cut -d '=' -f 2 | tr -d ':'
+}
+
+# Check that we are root, because we probably need to be
+####################################
+[ "$EUID" == "0" ] || fail "$0 should be run as root"
+
+# Check that needed programs exist
+####################################
+which openssl &>/dev/null || fail "Missing required program openssl"
+which m4 &>/dev/null || fail "Missing required program m4"
+which cut &>/dev/null || fail "Missing required program cut"
+which tr &>/dev/null || fail "Missing required program tr"
+
+# Check that needed files exist
+####################################
+[ -f "$cert_fname" ] || fail "$cert_fname must exist"
+
+# Begin program
+####################################
+fp="$(get_cert_fp "$cert_fname")"
+m4 \
+	-DM4_TRAD_DOMAIN="$traditional_domain_name"\
+	-DM4_TLS_FP="$fp" \
+	"$torrc_tmpl_fname" > "$torrc_out_fname"
+
+eval "$reload_tor_command"