Hosting a Tor hidden service
Run a v3 onion service on NoctisNode with a locked-down Nginx and a fail-closed firewall that survives reboots.
Tor relays and onion services are allowed and welcomed on NoctisNode. A v3 hidden service hides both your server's IP and your visitors' — the service is only reachable through .onion.
Install Tor
apt install -y tor nginx
systemctl enable torConfigure the service
Restart Tor and read your new address: cat /var/lib/tor/hidden/hostname. Point Nginx at port 8080 with a server block for your .onion host. Never expose 8080 publicly.
# /etc/tor/torrc
HiddenServiceDir /var/lib/tor/hidden/
HiddenServicePort 80 127.0.0.1:8080Fail-closed firewall
A hidden service only needs outbound Tor ports. Denying everything else means a compromised web app cannot phone home. ufw rules persist across reboots.
ufw default deny outgoing
ufw default deny incoming
ufw allow out 9001/tcp
ufw allow out 9030/tcp
ufw allow OpenSSH
ufw enableOperational notes
- ▹Keep the private key off-site — losing it loses the address.
- ▹Consider a client-authorized onion (HiddenServiceAuthorizeClient) for private services.
- ▹Back up /var/lib/tor/hidden with the rest of your server; see the restic guide.