No Description

dependabot[bot] c3d3976dd2 build(deps): bump docker/setup-buildx-action from 1.5.1 to 1.6.0 1 month ago
.github c3d3976dd2 build(deps): bump docker/setup-buildx-action from 1.5.1 to 1.6.0 1 month ago
CHANGELOG.md 2daab42c07 release v3.1.0 6 months ago
Dockerfile ef2e9c7967 build(deps): bump alpine from 3.14.1 to 3.14.2 1 month ago
Makefile e8dfe51bb8 makefile: fix incomplete list of phony targets; rename variable for consistency 8 months ago
README.md 14f8bdb506 added option to enable non-anonymous single hop mode 1 year ago
ansible-playbook.yml b5f31829c8 ansible playbook: upgrade image 1 year ago
docker-compose.yml 14f8bdb506 added option to enable non-anonymous single hop mode 1 year ago
entrypoint.sh 869b5f4d10 fill torrc template with envsubst 1 year ago
tor-changelog.url 0599554fd6 upgrade tor package v0.4.4.6-r1 -> v0.4.4.7r1 8 months ago
tor-package-log.url eac4c484c2 upgrade alpine base image v3.12.3->v3.13.0 including upgrade of tor v0.4.3.7-r0->v0.4.4.6-r1 (diff links below) 9 months ago
torrc.template 14f8bdb506 added option to enable non-anonymous single hop mode 1 year ago

README.md

docker: hidden tor .onion service 🐳

repo: https://github.com/fphammerle/docker-onion-service

docker hub: https://hub.docker.com/r/fphammerle/onion-service/tags

signed tags: https://github.com/fphammerle/docker-onion-service/tags

defaults to creating a v3 service

example 1

$ sudo docker run --name onion_service \
    -e VIRTUAL_PORT=80 -e TARGET=1.2.3.4:8080 \
    fphammerle/onion-service

example 2

$ sudo docker create --name onion_service \
    --env VERSION=3 \
    --env VIRTUAL_PORT=80 \
    --env TARGET=1.2.3.4:8080 \
    --volume onion-key:/onion-service \
    --restart unless-stopped \
    --cap-drop all --security-opt no-new-privileges \
    fphammerle/onion-service:latest

$ sudo docker start onion_service

optionally add --read-only --tmpfs /tmp:rw,size=4k to make the container's root filesystem read only

retrieve hostname

$ sudo docker exec onion_service cat /onion-service/hostname
abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrst.onion

single-hop mode

in single-hop mode connections from the onion service to introduction & rendezvous points will be direct and thus no longer anonymous:

$ sudo docker run -e NON_ANONYMOUS_SINGLE_HOP_MODE=1 …

useful to reduce latency (e.g. clearnet http servers setting alt-svc header)

show circuits

$ sudo docker exec onion_service \
    sh -c 'printf "AUTHENTICATE\nGETINFO circuit-status\nQUIT\n" | nc localhost 9051'

relay search: https://metrics.torproject.org/rs.html

docker-compose 🐙

  1. git clone https://github.com/fphammerle/docker-onion-service
  2. edit docker-compose.yml
  3. sudo docker-compose up --build

further reading

onion service protocol overview

operational security

http

ways to publish onion services: