Guide to Self-Hosting a Website as a Tor Hidden Service

Tor Hidden Service Setup

The site is now available as a hidden service on the Tor network, using a .onion address. This setup means there is no certificate authority, DNS, or exposed IP address. The .onion address is derived from a public key, and Tor provides end-to-end encryption for the connection.

Tor routes traffic through thousands of volunteer-run servers, ensuring anonymity for users. Hidden services extend this anonymity to the server itself, preventing any single party from linking user identity to online activity. The Tor Project, a nonprofit, develops this technology to promote human rights and freedom from tracking, surveillance, and censorship.

Configuring Tor for a Hidden Service

To set up a hidden service, users need to install Tor and configure it to point to a local port. This involves editing the /etc/tor/torrc file to specify a HiddenServiceDir and HiddenServicePort. The directory for the hidden service must be a dedicated, Tor-owned path, not the web root, as Tor stores the service's private key and hostname there.

After configuring, restarting the Tor service will generate the .onion address, which can be found in the hostname file within the specified HiddenServiceDir. For example, the generated address might look like "dhevt6e4rtgbtr3jh53xrpwmgtilkah6nyjujocsspssrsexc7omxhid.onion".

Serving the Site with Nginx

Tor forwards traffic from port 80 of the .onion address to a local port, such as 127.0.0.1:8080. Therefore, the web server, like Nginx, needs to listen on this local port. An Nginx server block should be configured for the .onion address, without TLS, HTTP/2, or QUIC, as Tor handles the encryption and uses plain TCP.

The Nginx configuration specifies the listen address, server name (the .onion address), root directory for the site files, and index file. After reloading Nginx, the site becomes live on the Tor network.

Building for the Onion Address

For static sites, absolute links often embed the base URL. If a site is built for the clearnet, these links would redirect visitors back to the clearnet domain even when accessed via Tor. To prevent this, a separate build of the static site is required, using the .onion address as its base URL.

This can be achieved by running the static site generator (e.g., Hugo) with a specific baseURL parameter pointing to the .onion address. A deployment pipeline can automate this process, building the site once for the clearnet and once for Tor, and then synchronizing each version to its respective target.