#!/bin/mkpkg
# description: Anonymous communication network - core daemon
# url: https://www.torproject.org/

name=tor
version=0.4.9.13
release=2
depends=(libressl libevent zlib)
groups=(tor:user:tor:/var/lib/tor:700:903:903)
services=(tor)
permissions=(
    /etc/tor:root:tor:750
    /usr/bin/tor:root:tor:750
    /usr/bin/tor-resolve:root:tor:750
    /usr/bin/tor-gencert:root:tor:750
    /usr/bin/tor-print-ed-signing-cert:root:tor:750
    /etc/tor/torrc:root:tor:640
)
source=(https://dist.torproject.org/$name-$version.tar.gz)
sha256sums=(
    "5e748d3272cdf44a7d7741173f371c8def3d96eecb77e93c89c50663ce9cc792"
)

build() {
    cd $name-$version
    ./configure \
        --prefix=/usr \
        --sysconfdir=/etc \
        --localstatedir=/var \
        --disable-systemd \
        --disable-lzma \
        --disable-zstd \
        --disable-asciidoc \
        --disable-html-manual \
        --disable-manpage \
        --disable-unittests \
        --enable-pic \
        --with-tor-user=tor \
        --with-tor-group=tor \
        --with-openssl-dir=/ \
        --with-libevent-dir=/usr
    make
    make DESTDIR=$PKG install

    # Remove docs
    rm -rf $PKG/usr/share/doc

    # Config directory
    install -d -m 750 $PKG/etc/tor

    # Hardened torrc
    printf '%s\n' \
        '## rawnix Tor configuration' \
        '## See tor(1) for options' \
        '' \
        'DataDirectory /var/lib/tor' \
        'PidFile /run/tor/tor.pid' \
        '' \
        '# Logging' \
        'Log notice stderr' \
        '' \
        '# SOCKS port for local applications (e.g. browser)' \
        'SocksPort 9050 IsolateDestAddr IsolateDestPort' \
        '' \
        '# DNS resolution through Tor' \
        'DNSPort 5353' \
        'AutomapHostsOnResolve 1' \
        'VirtualAddrNetworkIPv4 10.192.0.0/10' \
        '' \
        '# Transparent proxy port' \
        'TransPort 9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort' \
        '' \
        '# Hardening' \
        'Sandbox 0' \
        'NoExec 1' \
        'SafeLogging 1' \
        '' \
        '# Disable relay/exit functionality' \
        'ClientOnly 1' \
        '' \
        '# Connection padding to resist traffic analysis' \
        'ConnectionPadding 1' \
        '' \
        '# Reject plaintext on SOCKS' \
        'WarnPlaintextPorts 23,109,110,143' \
        'RejectPlaintextPorts 23,109,110,143' \
        > $PKG/etc/tor/torrc

    # Data directory
    install -d -m 700 $PKG/var/lib/tor
}

post_build() {
    # runit service - touch down file so tor does not auto-start
    install -d $PKG/etc/sv/tor/log

    printf '%s\n' \
        '#!/bin/sh' \
        'exec 2>&1' \
        '' \
        '# Prepare runtime directories' \
        'install -d -m 750 -o tor -g tor /run/tor' \
        'install -d -m 700 -o tor -g tor /var/lib/tor' \
        '' \
        '# Verify config before starting' \
        'chpst -u tor:tor tor --verify-config -f /etc/tor/torrc || exit 1' \
        '' \
        '# Start tor in foreground' \
        'exec chpst -u tor:tor tor -f /etc/tor/torrc --RunAsDaemon 0' \
        > $PKG/etc/sv/tor/run

    printf '%s\n' \
        '#!/bin/sh' \
        'rm -rf /run/tor' \
        > $PKG/etc/sv/tor/finish

    printf '%s\n' \
        '#!/bin/sh' \
        'mkdir -p /var/log/tor' \
        'exec svlogd -tt /var/log/tor' \
        > $PKG/etc/sv/tor/log/run

    chmod 755 $PKG/etc/sv/tor/run
    chmod 755 $PKG/etc/sv/tor/finish
    chmod 755 $PKG/etc/sv/tor/log/run

    # Service disabled by default - must explicitly: rm /etc/sv/tor/down
    touch $PKG/etc/sv/tor/down
}

signify() {
    untrusted comment: public key
    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}

# vim: filetype=sh