services.tor.relay.onionServices ‐ NixOS ‐ Searchix

services.tor.relay.onionServices

Because tor.service runs in its own RootDirectory=, when using a onion service to reverse-proxy to a Unix socket, you need to make that Unix socket available within the mount namespace of tor.service.

When you can configure your service to create its socket in /tmp, this can be done with:

systemd.services.${your-service} = {
  unitConfig.JoinsNamespaceOf = [ "tor.service" ];`
  serviceConfig.PrivateTmp = true;
};

Otherwise, you can use:

systemd.services.tor.serviceConfig.BindPaths = [ "/path/to/your-service/socket/directory" ];

but you have to be sure that /path/to/socket/directory exists before tor.service is started and is not deleted and recreated between restarts of your-service, or you'll need to restart tor.service to refresh the BindPaths=.

Type

attribute set of (submodule)

Default

{ }

Example

{
  "example.org/www" = {
    authorizedClients = [
      "descriptor:x25519:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
    ];
    map = [
      80
    ];
  };
}

Declared