1 files changed, 136 insertions, 0 deletions
diff --git a/opt/tor/MAKEPKG b/opt/tor/MAKEPKG
new file mode 100644
index 0000000..4722926
--- /dev/null
+++ b/opt/tor/MAKEPKG
@@ -0,0 +1,136 @@
+#!/bin/mkpkg
+# description: Anonymous communication network - core daemon
+# url: https://www.torproject.org/
+
+name=tor
+version=0.4.9.13
+release=2
+depends=(libressl libevent zlib)
+groups=(tor:user:tor:/var/lib/tor:700:903:903)
+services=(tor)
+permissions=(
+    /etc/tor:root:tor:750
+    /usr/bin/tor:root:tor:750
+    /usr/bin/tor-resolve:root:tor:750
+    /usr/bin/tor-gencert:root:tor:750
+    /usr/bin/tor-print-ed-signing-cert:root:tor:750
+    /etc/tor/torrc:root:tor:640
+)
+source=(https://dist.torproject.org/$name-$version.tar.gz)
+sha256sums=(
+    "5e748d3272cdf44a7d7741173f371c8def3d96eecb77e93c89c50663ce9cc792"
+)
+
+build() {
+    cd $name-$version
+    ./configure \
+        --prefix=/usr \
+        --sysconfdir=/etc \
+        --localstatedir=/var \
+        --disable-systemd \
+        --disable-lzma \
+        --disable-zstd \
+        --disable-asciidoc \
+        --disable-html-manual \
+        --disable-manpage \
+        --disable-unittests \
+        --enable-pic \
+        --with-tor-user=tor \
+        --with-tor-group=tor \
+        --with-openssl-dir=/ \
+        --with-libevent-dir=/usr
+    make
+    make DESTDIR=$PKG install
+
+    # Remove docs
+    rm -rf $PKG/usr/share/doc
+
+    # Config directory
+    install -d -m 750 $PKG/etc/tor
+
+    # Hardened torrc
+    printf '%s\n' \
+        '## rawnix Tor configuration' \
+        '## See tor(1) for options' \
+        '' \
+        'DataDirectory /var/lib/tor' \
+        'PidFile /run/tor/tor.pid' \
+        '' \
+        '# Logging' \
+        'Log notice stderr' \
+        '' \
+        '# SOCKS port for local applications (e.g. browser)' \
+        'SocksPort 9050 IsolateDestAddr IsolateDestPort' \
+        '' \
+        '# DNS resolution through Tor' \
+        'DNSPort 5353' \
+        'AutomapHostsOnResolve 1' \
+        'VirtualAddrNetworkIPv4 10.192.0.0/10' \
+        '' \
+        '# Transparent proxy port' \
+        'TransPort 9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort' \
+        '' \
+        '# Hardening' \
+        'Sandbox 0' \
+        'NoExec 1' \
+        'SafeLogging 1' \
+        '' \
+        '# Disable relay/exit functionality' \
+        'ClientOnly 1' \
+        '' \
+        '# Connection padding to resist traffic analysis' \
+        'ConnectionPadding 1' \
+        '' \
+        '# Reject plaintext on SOCKS' \
+        'WarnPlaintextPorts 23,109,110,143' \
+        'RejectPlaintextPorts 23,109,110,143' \
+        > $PKG/etc/tor/torrc
+
+    # Data directory
+    install -d -m 700 $PKG/var/lib/tor
+}
+
+post_build() {
+    # runit service - touch down file so tor does not auto-start
+    install -d $PKG/etc/sv/tor/log
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'exec 2>&1' \
+        '' \
+        '# Prepare runtime directories' \
+        'install -d -m 750 -o tor -g tor /run/tor' \
+        'install -d -m 700 -o tor -g tor /var/lib/tor' \
+        '' \
+        '# Verify config before starting' \
+        'chpst -u tor:tor tor --verify-config -f /etc/tor/torrc || exit 1' \
+        '' \
+        '# Start tor in foreground' \
+        'exec chpst -u tor:tor tor -f /etc/tor/torrc --RunAsDaemon 0' \
+        > $PKG/etc/sv/tor/run
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'rm -rf /run/tor' \
+        > $PKG/etc/sv/tor/finish
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'mkdir -p /var/log/tor' \
+        'exec svlogd -tt /var/log/tor' \
+        > $PKG/etc/sv/tor/log/run
+
+    chmod 755 $PKG/etc/sv/tor/run
+    chmod 755 $PKG/etc/sv/tor/finish
+    chmod 755 $PKG/etc/sv/tor/log/run
+
+    # Service disabled by default - must explicitly: rm /etc/sv/tor/down
+    touch $PKG/etc/sv/tor/down
+}
+
+signify() {
+    untrusted comment: public key
+    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
+}
+
+# vim: filetype=sh