Hosting a Site as a Tor Hidden Service

A hidden service is the easiest way to make a local site reachable from anywhere. You need no public address and no router configuration: Tor builds the path, and the address is the public half of a key pair that Tor generates for you. The other side of that coin is that it is only reachable through Tor.

The five steps

1. Install Tor.

   apt install tor          # Debian, Ubuntu
   pacman -S tor            # Arch
   xbps-install -S tor      # Void

2. Open /etc/tor/torrc in an editor, as root.

3. Uncomment these two lines:

   HiddenServiceDir /var/lib/tor/hidden_service/
   HiddenServicePort 80 127.0.0.1:80

   The first is where Tor keeps the service's keys and address. The second maps a port: connections to port 80 on the onion address are forwarded to 127.0.0.1:80 on this machine. The left number is the port visitors use, the right one is where your site already listens — so this works just as well for a service on 8080 or 3000, and you can add more HiddenServicePort lines for more ports.

4. Restart Tor, so it reads the new configuration:

   systemctl restart tor      # Debian, Ubuntu, Arch
   sv restart tor             # runit
   rc-service tor restart     # OpenRC

5. Read your address:

   sudo cat /var/lib/tor/hidden_service/hostname

   A 56-character .onion name. That is your site. Open it in the Tor Browser (with any other browser it will not resolve).

Notes worth knowing

• sudo is not optional in step 5. Tor creates the service directory with mode 0700, owned by its own user. A normal user gets "Permission denied" on a file that plainly exists.
• The address is a key pair. Alongside hostname sits private_key. The address is the public key, so copying that directory to another machine moves the service with its name; losing it loses the address for good, and leaking it hands the address to someone else. Back the directory up, and keep it out of any web root.
• Anything on your local port becomes public — including whatever else your web server serves. If that matters, point HiddenServicePort at a separate port with its own virtual host, or run a second server for it.
• Nothing else opens up. Your firewall stays as it is, no inbound port is needed, and the machine can sit behind NAT the whole time.
• It is not a mirror. The .onion address serves your site over Tor; your clearnet address, if you have one, is untouched.

Sources

• community.torproject.org/onion-services/setup — the project's own walkthrough of setting up an onion service, of which the five steps above are the short version.
• …/setup/install — installing Tor itself, per platform.
• torrc(5) — every directive in torrc, including the HiddenService* family and what the port mapping really means.
• tb-manual.torproject.org — the Tor Browser manual: how to reach an .onion address at all.