From ec1d4d333f725a94b4e646c08598f7377196b763 Mon Sep 17 00:00:00 2001
From: Dmitry Ilvokhin <d@ilvokhin.com>
Date: Sat, 29 Jun 2024 21:03:10 +0100
Subject: Add wg-quick@wgtor0 as dependency to tor

Otherwise tor could not bind ports on wgtor0 ip addresses as it wasn't
up yet.
---
 roles/tor/files/tor.service | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 roles/tor/files/tor.service

(limited to 'roles/tor/files')

diff --git a/roles/tor/files/tor.service b/roles/tor/files/tor.service
new file mode 100644
index 0000000..d41767b
--- /dev/null
+++ b/roles/tor/files/tor.service
@@ -0,0 +1,29 @@
+[Unit]
+Description=Anonymizing overlay network for TCP
+After=network.target nss-lookup.target wg-quick@wgtor0.service
+
+[Service]
+Type=notify
+NotifyAccess=all
+ExecStartPre=/usr/bin/tor -f /etc/tor/torrc --verify-config
+ExecStart=/usr/bin/tor -f /etc/tor/torrc
+ExecReload=/bin/kill -HUP ${MAINPID}
+KillSignal=SIGINT
+TimeoutSec=60
+Restart=on-failure
+WatchdogSec=1m
+LimitNOFILE=32768
+
+# Hardening
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectHome=yes
+ProtectSystem=full
+ReadOnlyDirectories=/
+ReadWriteDirectories=-/var/lib/tor
+ReadWriteDirectories=-/var/log/tor
+NoNewPrivileges=yes
+CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH CAP_KILL
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.3-70-g09d2