21 Nov 2022 [CT] [guides]

CT-006: Setting up a public Onion Service

This is the 6th report in the new Cypherpunk Transmission series.


Onion Services offer solid privacy and security benefits to Tor users: the traffic is E2E encrypted and TLS is unnecessary, IP addresses are irrelevant, open ports are not required, and impersonation is impossible.

Despite the stigma associated with their previous name, Hidden Services can indeed be used for publically offered services, which are not intended to be hidden.

This guide shows how easy it actually is to, permissionlessly, set up an Onion Service for a website.


1. Install Tor

SSH into your server and updgrade the packages first:

sudo apt update && sudo apt upgrade -y

Verify the CPU architecture with:

sudo dpkg --print-architecture

If the ouptut is amd64, arm64, or i386, proceed. Otherwise, you probably need to build Tor from source2.

Install apt-transport-https:

sudo apt install apt-transport-https

Create a new file tor.list in /etc/apt/sources.list.d/ by running:

sudo nano /etc/apt/sources.list.d/tor.list

Check your OS codename:

lsb_release -c

Paste these two lines inside the new file to add the most stable packages:

deb [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org <DISTRIBUTION> main
deb-src [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org <DISTRIBUTION> main

Replace <DISTRIBUTION> with your OS codename (ie. bullseye).

Add the GPG key that was used to sign the packages:

wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null

It is time to install tor and the tor Debian keyring package:

sudo apt update && sudo apt install tor deb.torproject.org-keyring

Note: if you don’t have nano or wget, install them with sudo apt install nano wget.

Finally, make sure tor is up and running correctly:

sudo systemctl status tor

If the tor.service status is active, we are good to go.

2. Install a web server

You can choose any web server, but I will use Nginx:

sudo apt install nginx -y

Check the status with sudo systemctl status nginx and point a browser to your VPS IP address.

If the Welcome to Nginx page doesn’t load, try checking your firewall settings and allow the default 80 port (ie. sudo ufw allow 80).

By default, Nginx should serve the website from /var/www/html. Feel free to edit the index.html or index.nginx-debian.html.

You can restart the web server with:

sudo sytemctl restart nginx

3. Configure the Onion Service

Open the torrc config file:

sudo nano /etc/tor/torrc

Uncomment the following two lines under the This section is just for location-hidden services by removing the # sign:

HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80

Replace hidden_service with your hidden service name (ie. my-onion-blog) and restart Tor:

sudo systemctl restart tor.service

4. Access and backup the Onion Service

Display your onion v3 service hostname with:

cat /var/lib/tor/hidden_service/hostname

You should now be able to access the .onion with the Tor browser.

Make a backup of the /var/lib/tor/hidden_service directory containing hostname and private_key. That’s all you need to move the Onion Service to a new server.


Done. You are now in full control of your own domain, which is invulnerable to malicious takeovers from any authority.


Let me know if you find this helpful and, depending on interest, I will do my best to post a new Cypherpunk Transmission report every (other?) Monday.

Questions, edits and suggestions are always appreciated @ /about/.


Credit goes to gnuteardrops from monero.graphics for the amazing xkcd graphic. Work and xkcd Script font licensed under CC BY-NC 3.0.

  1. /cypherpunk-transmission-003-basic-server-security/ 

  2. https://community.torproject.org/onion-services/setup/install/#installing-tor-from-source/ 

  3. https://community.torproject.org/onion-services/advanced/vanity-addresses/ 

  4. https://community.torproject.org/onion-services/advanced/onion-location/ 

  5. https://github.com/mikeperry-tor/vanguards/ 

  6. https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt/