Browse Source
- Spawn tor binary as subprocess instead of requiring external daemon - Auto-generate torrc in $ORLY_DATA_DIR/tor/ (userspace, no root) - Enable Tor by default; gracefully disable if tor binary not found - Add ORLY_TOR_BINARY and ORLY_TOR_SOCKS config options - Remove external Tor setup scripts and documentation Files modified: - app/config/config.go: New subprocess-based Tor config options - app/main.go: Updated Tor initialization for new config - pkg/tor/service.go: Rewritten for subprocess management - Removed: deploy/orly-tor.service, docs/TOR_SETUP.md, scripts/tor-*.sh 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>main
woikos
1 week ago
8 changed files with 233 additions and 835 deletions
@ -1,73 +0,0 @@ |
|||||||
# ORLY Relay with Tor Hidden Service - Systemd Unit |
|
||||||
# |
|
||||||
# This is an example systemd unit for running ORLY with Tor support. |
|
||||||
# Copy and customize for your deployment. |
|
||||||
# |
|
||||||
# Installation: |
|
||||||
# 1. Copy to /etc/systemd/system/orly-tor.service |
|
||||||
# 2. Edit paths and environment variables as needed |
|
||||||
# 3. sudo systemctl daemon-reload |
|
||||||
# 4. sudo systemctl enable orly-tor |
|
||||||
# 5. sudo systemctl start orly-tor |
|
||||||
# |
|
||||||
# Prerequisites: |
|
||||||
# - Tor daemon running (systemctl enable tor && systemctl start tor) |
|
||||||
# - Hidden service configured (run scripts/tor-setup.sh) |
|
||||||
|
|
||||||
[Unit] |
|
||||||
Description=ORLY Nostr Relay with Tor Hidden Service |
|
||||||
Documentation=https://git.mleku.dev/mleku/orly |
|
||||||
After=network.target tor.service |
|
||||||
Requires=tor.service |
|
||||||
Wants=tor.service |
|
||||||
|
|
||||||
[Service] |
|
||||||
Type=simple |
|
||||||
User=orly |
|
||||||
Group=orly |
|
||||||
|
|
||||||
# Working directory |
|
||||||
WorkingDirectory=/opt/orly |
|
||||||
|
|
||||||
# Main relay binary |
|
||||||
ExecStart=/opt/orly/orly |
|
||||||
|
|
||||||
# Environment configuration |
|
||||||
# Core settings |
|
||||||
Environment=ORLY_PORT=3334 |
|
||||||
Environment=ORLY_DATA_DIR=/var/lib/orly |
|
||||||
Environment=ORLY_LOG_LEVEL=info |
|
||||||
|
|
||||||
# Tor hidden service settings |
|
||||||
Environment=ORLY_TOR_ENABLED=true |
|
||||||
Environment=ORLY_TOR_PORT=3336 |
|
||||||
Environment=ORLY_TOR_HS_DIR=/var/lib/tor/orly-relay |
|
||||||
|
|
||||||
# ACL mode (choose one: none, follows, managed) |
|
||||||
Environment=ORLY_ACL_MODE=none |
|
||||||
|
|
||||||
# TLS (optional - uncomment and configure for production) |
|
||||||
# Environment=ORLY_TLS_DOMAINS=relay.example.com |
|
||||||
|
|
||||||
# Resource limits |
|
||||||
LimitNOFILE=65535 |
|
||||||
LimitNPROC=4096 |
|
||||||
|
|
||||||
# Restart policy |
|
||||||
Restart=always |
|
||||||
RestartSec=5 |
|
||||||
|
|
||||||
# Security hardening |
|
||||||
NoNewPrivileges=yes |
|
||||||
ProtectSystem=strict |
|
||||||
ProtectHome=yes |
|
||||||
ReadWritePaths=/var/lib/orly |
|
||||||
PrivateTmp=yes |
|
||||||
|
|
||||||
# Allow reading Tor hidden service directory |
|
||||||
# Note: The Tor user must grant read access to the orly user |
|
||||||
# Option 1: Add orly user to debian-tor group |
|
||||||
# Option 2: Use ACLs: setfacl -R -m u:orly:rx /var/lib/tor/orly-relay |
|
||||||
|
|
||||||
[Install] |
|
||||||
WantedBy=multi-user.target |
|
||||||
@ -1,294 +0,0 @@ |
|||||||
# Tor Hidden Service Setup for ORLY Relay |
|
||||||
|
|
||||||
This guide explains how to configure ORLY to automatically mirror your relay as a Tor hidden service, making it accessible via a `.onion` address. |
|
||||||
|
|
||||||
## Overview |
|
||||||
|
|
||||||
When Tor support is enabled: |
|
||||||
1. ORLY listens on a dedicated internal port for Tor traffic |
|
||||||
2. The Tor daemon forwards `.onion` traffic to this port |
|
||||||
3. ORLY automatically detects the `.onion` address |
|
||||||
4. The `.onion` address is included in NIP-11 relay information |
|
||||||
|
|
||||||
## Quick Start |
|
||||||
|
|
||||||
### Development (Local Testing) |
|
||||||
|
|
||||||
```bash |
|
||||||
# One-time setup (requires Tor installed) |
|
||||||
./scripts/tor-dev-setup.sh |
|
||||||
|
|
||||||
# Start relay with Tor |
|
||||||
ORLY_TOR_ENABLED=true ORLY_TOR_HS_DIR=~/.tor/orly-dev/hidden_service ./orly |
|
||||||
``` |
|
||||||
|
|
||||||
### Production |
|
||||||
|
|
||||||
```bash |
|
||||||
# One-time setup (requires root) |
|
||||||
sudo ./scripts/tor-setup.sh |
|
||||||
|
|
||||||
# Start relay with Tor |
|
||||||
ORLY_TOR_ENABLED=true ORLY_TOR_HS_DIR=/var/lib/tor/orly-relay ./orly |
|
||||||
``` |
|
||||||
|
|
||||||
## Configuration |
|
||||||
|
|
||||||
### Environment Variables |
|
||||||
|
|
||||||
| Variable | Default | Description | |
|
||||||
|----------|---------|-------------| |
|
||||||
| `ORLY_TOR_ENABLED` | `false` | Enable Tor hidden service integration | |
|
||||||
| `ORLY_TOR_PORT` | `3336` | Internal port Tor forwards traffic to | |
|
||||||
| `ORLY_TOR_HS_DIR` | - | Path to Tor's HiddenServiceDir | |
|
||||||
| `ORLY_TOR_ONION_ADDRESS` | - | Manual `.onion` override (optional) | |
|
||||||
|
|
||||||
### Example Configurations |
|
||||||
|
|
||||||
**Basic Tor setup:** |
|
||||||
```bash |
|
||||||
export ORLY_TOR_ENABLED=true |
|
||||||
export ORLY_TOR_HS_DIR=/var/lib/tor/orly-relay |
|
||||||
./orly |
|
||||||
``` |
|
||||||
|
|
||||||
**Custom port:** |
|
||||||
```bash |
|
||||||
export ORLY_TOR_ENABLED=true |
|
||||||
export ORLY_TOR_PORT=3337 |
|
||||||
export ORLY_TOR_HS_DIR=/var/lib/tor/orly-relay |
|
||||||
./orly |
|
||||||
``` |
|
||||||
|
|
||||||
**Manual address (if auto-detection doesn't work):** |
|
||||||
```bash |
|
||||||
export ORLY_TOR_ENABLED=true |
|
||||||
export ORLY_TOR_ONION_ADDRESS=abc123xyz.onion |
|
||||||
./orly |
|
||||||
``` |
|
||||||
|
|
||||||
## How It Works |
|
||||||
|
|
||||||
### Architecture |
|
||||||
|
|
||||||
``` |
|
||||||
Internet Users Tor Users |
|
||||||
│ │ |
|
||||||
▼ ▼ |
|
||||||
┌──────────┐ ┌──────────────┐ |
|
||||||
│ Regular │ │ Tor │ |
|
||||||
│ Traffic │ │ Network │ |
|
||||||
│ (HTTPS) │ │ │ |
|
||||||
└────┬─────┘ └──────┬───────┘ |
|
||||||
│ │ |
|
||||||
│ Port 443 │ .onion:80 |
|
||||||
▼ ▼ |
|
||||||
┌─────────────────────────────────────┐ |
|
||||||
│ ORLY Relay │ |
|
||||||
│ │ |
|
||||||
│ ┌─────────────┐ ┌───────────────┐ │ |
|
||||||
│ │ Main Server │ │ Tor Service │ │ |
|
||||||
│ │ Port 3334 │ │ Port 3336 │ │ |
|
||||||
│ └──────┬──────┘ └───────┬───────┘ │ |
|
||||||
│ │ │ │ |
|
||||||
│ └────────┬────────┘ │ |
|
||||||
│ ▼ │ |
|
||||||
│ ┌────────────┐ │ |
|
||||||
│ │ Database │ │ |
|
||||||
│ └────────────┘ │ |
|
||||||
└─────────────────────────────────────┘ |
|
||||||
``` |
|
||||||
|
|
||||||
### Address Detection |
|
||||||
|
|
||||||
1. The Tor daemon creates a hidden service directory containing: |
|
||||||
- `hostname` - The `.onion` address |
|
||||||
- `hs_ed25519_secret_key` - Private key (persistent) |
|
||||||
- `hs_ed25519_public_key` - Public key |
|
||||||
|
|
||||||
2. ORLY watches the `hostname` file and automatically detects the address |
|
||||||
|
|
||||||
3. The address is included in NIP-11 relay information under the `addresses` field |
|
||||||
|
|
||||||
### NIP-11 Integration |
|
||||||
|
|
||||||
When Tor is enabled and the `.onion` address is detected, the NIP-11 relay info includes: |
|
||||||
|
|
||||||
```json |
|
||||||
{ |
|
||||||
"name": "ORLY", |
|
||||||
"description": "...", |
|
||||||
"pubkey": "...", |
|
||||||
"addresses": [ |
|
||||||
"wss://relay.example.com", |
|
||||||
"ws://abc123xyz.onion/" |
|
||||||
] |
|
||||||
} |
|
||||||
``` |
|
||||||
|
|
||||||
## Manual Tor Configuration |
|
||||||
|
|
||||||
If you prefer to configure Tor manually instead of using the setup scripts: |
|
||||||
|
|
||||||
### 1. Install Tor |
|
||||||
|
|
||||||
**Debian/Ubuntu:** |
|
||||||
```bash |
|
||||||
sudo apt update && sudo apt install tor |
|
||||||
``` |
|
||||||
|
|
||||||
**Arch Linux:** |
|
||||||
```bash |
|
||||||
sudo pacman -S tor |
|
||||||
``` |
|
||||||
|
|
||||||
**macOS:** |
|
||||||
```bash |
|
||||||
brew install tor |
|
||||||
``` |
|
||||||
|
|
||||||
### 2. Configure Hidden Service |
|
||||||
|
|
||||||
Add to `/etc/tor/torrc`: |
|
||||||
|
|
||||||
``` |
|
||||||
HiddenServiceDir /var/lib/tor/orly-relay/ |
|
||||||
HiddenServicePort 80 127.0.0.1:3336 |
|
||||||
``` |
|
||||||
|
|
||||||
### 3. Set Permissions |
|
||||||
|
|
||||||
```bash |
|
||||||
# Create directory |
|
||||||
sudo mkdir -p /var/lib/tor/orly-relay |
|
||||||
|
|
||||||
# Set ownership (Debian/Ubuntu) |
|
||||||
sudo chown debian-tor:debian-tor /var/lib/tor/orly-relay |
|
||||||
sudo chmod 700 /var/lib/tor/orly-relay |
|
||||||
|
|
||||||
# Or on other systems |
|
||||||
sudo chown tor:tor /var/lib/tor/orly-relay |
|
||||||
``` |
|
||||||
|
|
||||||
### 4. Restart Tor |
|
||||||
|
|
||||||
```bash |
|
||||||
sudo systemctl restart tor |
|
||||||
``` |
|
||||||
|
|
||||||
### 5. Verify |
|
||||||
|
|
||||||
```bash |
|
||||||
# Check the .onion address |
|
||||||
sudo cat /var/lib/tor/orly-relay/hostname |
|
||||||
``` |
|
||||||
|
|
||||||
## Systemd Service |
|
||||||
|
|
||||||
For production deployments, use the provided systemd unit: |
|
||||||
|
|
||||||
```bash |
|
||||||
# Copy unit file |
|
||||||
sudo cp deploy/orly-tor.service /etc/systemd/system/ |
|
||||||
|
|
||||||
# Edit configuration |
|
||||||
sudo nano /etc/systemd/system/orly-tor.service |
|
||||||
|
|
||||||
# Enable and start |
|
||||||
sudo systemctl daemon-reload |
|
||||||
sudo systemctl enable orly-tor |
|
||||||
sudo systemctl start orly-tor |
|
||||||
``` |
|
||||||
|
|
||||||
### Permissions for Hidden Service Directory |
|
||||||
|
|
||||||
The ORLY process needs read access to the Tor hidden service directory: |
|
||||||
|
|
||||||
**Option 1: Add user to Tor group** |
|
||||||
```bash |
|
||||||
sudo usermod -aG debian-tor orly |
|
||||||
``` |
|
||||||
|
|
||||||
**Option 2: Use ACLs** |
|
||||||
```bash |
|
||||||
sudo setfacl -R -m u:orly:rx /var/lib/tor/orly-relay |
|
||||||
``` |
|
||||||
|
|
||||||
## Troubleshooting |
|
||||||
|
|
||||||
### .onion address not appearing in NIP-11 |
|
||||||
|
|
||||||
1. Check if Tor is running: |
|
||||||
```bash |
|
||||||
systemctl status tor |
|
||||||
``` |
|
||||||
|
|
||||||
2. Check if hostname file exists: |
|
||||||
```bash |
|
||||||
cat /var/lib/tor/orly-relay/hostname |
|
||||||
``` |
|
||||||
|
|
||||||
3. Check ORLY logs for Tor-related messages |
|
||||||
|
|
||||||
4. Verify environment variables are set: |
|
||||||
```bash |
|
||||||
echo $ORLY_TOR_ENABLED |
|
||||||
echo $ORLY_TOR_HS_DIR |
|
||||||
``` |
|
||||||
|
|
||||||
### Permission denied errors |
|
||||||
|
|
||||||
Ensure ORLY can read the hidden service directory: |
|
||||||
```bash |
|
||||||
# Check permissions |
|
||||||
ls -la /var/lib/tor/orly-relay/ |
|
||||||
|
|
||||||
# Fix with ACL |
|
||||||
sudo setfacl -m u:$(whoami):rx /var/lib/tor/orly-relay |
|
||||||
``` |
|
||||||
|
|
||||||
### Tor connection timeouts |
|
||||||
|
|
||||||
1. Check Tor logs: |
|
||||||
```bash |
|
||||||
journalctl -u tor -f |
|
||||||
``` |
|
||||||
|
|
||||||
2. For development, check: |
|
||||||
```bash |
|
||||||
tail -f ~/.tor/orly-dev/tor.log |
|
||||||
``` |
|
||||||
|
|
||||||
3. Ensure Tor can reach the network (check firewall rules) |
|
||||||
|
|
||||||
### Different .onion address after restart |
|
||||||
|
|
||||||
This means the hidden service key was lost. The key is stored in: |
|
||||||
- Production: `/var/lib/tor/orly-relay/hs_ed25519_secret_key` |
|
||||||
- Development: `~/.tor/orly-dev/hidden_service/hs_ed25519_secret_key` |
|
||||||
|
|
||||||
To preserve your `.onion` address, back up the entire hidden service directory. |
|
||||||
|
|
||||||
## Security Considerations |
|
||||||
|
|
||||||
1. **Keep the hidden service key safe** - The `hs_ed25519_secret_key` file is your identity. If compromised, attackers can impersonate your relay. |
|
||||||
|
|
||||||
2. **Restrict file permissions** - Hidden service directories should be `chmod 700`. |
|
||||||
|
|
||||||
3. **Separate Tor traffic** - The dedicated Tor port (3336) keeps Tor traffic isolated from regular traffic. |
|
||||||
|
|
||||||
4. **Regular updates** - Keep Tor updated for security patches. |
|
||||||
|
|
||||||
## Testing with Tor Browser |
|
||||||
|
|
||||||
1. Download Tor Browser from https://www.torproject.org/ |
|
||||||
|
|
||||||
2. Navigate to your `.onion` address: |
|
||||||
``` |
|
||||||
ws://your-address.onion/ |
|
||||||
``` |
|
||||||
|
|
||||||
3. Or test with curl over Tor: |
|
||||||
```bash |
|
||||||
curl --socks5-hostname localhost:9050 -H "Accept: application/nostr+json" http://your-address.onion/ |
|
||||||
``` |
|
||||||
@ -1,217 +0,0 @@ |
|||||||
#!/bin/bash |
|
||||||
# tor-dev-setup.sh - Development Tor hidden service setup for ORLY relay |
|
||||||
# |
|
||||||
# This script sets up a user-space Tor hidden service for local development. |
|
||||||
# No root privileges required (except for initial Tor installation). |
|
||||||
# |
|
||||||
# Usage: ./scripts/tor-dev-setup.sh [port] |
|
||||||
# port: internal port ORLY listens on for Tor traffic (default: 3336) |
|
||||||
# |
|
||||||
# After running this script: |
|
||||||
# 1. Start ORLY with: ORLY_TOR_ENABLED=true ORLY_TOR_HS_DIR=~/.tor/orly-dev ./orly |
|
||||||
# 2. Connect via Tor Browser to the .onion address |
|
||||||
|
|
||||||
set -e |
|
||||||
|
|
||||||
# Configuration |
|
||||||
TOR_PORT="${1:-3336}" |
|
||||||
TOR_DATA_DIR="${HOME}/.tor/orly-dev" |
|
||||||
TOR_CONFIG="${TOR_DATA_DIR}/torrc" |
|
||||||
TOR_PID_FILE="${TOR_DATA_DIR}/tor.pid" |
|
||||||
|
|
||||||
# Colors for output |
|
||||||
RED='\033[0;31m' |
|
||||||
GREEN='\033[0;32m' |
|
||||||
YELLOW='\033[1;33m' |
|
||||||
BLUE='\033[0;34m' |
|
||||||
NC='\033[0m' # No Color |
|
||||||
|
|
||||||
info() { echo -e "${GREEN}[INFO]${NC} $1"; } |
|
||||||
warn() { echo -e "${YELLOW}[WARN]${NC} $1"; } |
|
||||||
error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; } |
|
||||||
debug() { echo -e "${BLUE}[DEBUG]${NC} $1"; } |
|
||||||
|
|
||||||
# Check if Tor is installed |
|
||||||
check_tor() { |
|
||||||
if ! command -v tor &> /dev/null; then |
|
||||||
error "Tor is not installed. Please install it first: |
|
||||||
Debian/Ubuntu: sudo apt install tor |
|
||||||
Arch: sudo pacman -S tor |
|
||||||
macOS: brew install tor |
|
||||||
Fedora: sudo dnf install tor" |
|
||||||
fi |
|
||||||
info "Tor is installed: $(tor --version | head -1)" |
|
||||||
} |
|
||||||
|
|
||||||
# Create directory structure |
|
||||||
setup_dirs() { |
|
||||||
info "Creating directory structure..." |
|
||||||
|
|
||||||
mkdir -p "${TOR_DATA_DIR}" |
|
||||||
mkdir -p "${TOR_DATA_DIR}/hidden_service" |
|
||||||
chmod 700 "${TOR_DATA_DIR}" |
|
||||||
chmod 700 "${TOR_DATA_DIR}/hidden_service" |
|
||||||
|
|
||||||
info "Directory created: ${TOR_DATA_DIR}" |
|
||||||
} |
|
||||||
|
|
||||||
# Create Tor configuration |
|
||||||
create_config() { |
|
||||||
info "Creating Tor configuration..." |
|
||||||
|
|
||||||
cat > "$TOR_CONFIG" << EOF |
|
||||||
# ORLY Development Tor Configuration |
|
||||||
# Generated by tor-dev-setup.sh on $(date) |
|
||||||
|
|
||||||
# Data directory |
|
||||||
DataDirectory ${TOR_DATA_DIR}/data |
|
||||||
|
|
||||||
# Run in background |
|
||||||
RunAsDaemon 1 |
|
||||||
PidFile ${TOR_PID_FILE} |
|
||||||
|
|
||||||
# SOCKS proxy for outgoing connections (optional, for testing) |
|
||||||
SocksPort 9150 |
|
||||||
|
|
||||||
# Hidden service for ORLY relay |
|
||||||
HiddenServiceDir ${TOR_DATA_DIR}/hidden_service/ |
|
||||||
HiddenServicePort 80 127.0.0.1:${TOR_PORT} |
|
||||||
|
|
||||||
# Logging |
|
||||||
Log notice file ${TOR_DATA_DIR}/tor.log |
|
||||||
EOF |
|
||||||
|
|
||||||
chmod 600 "$TOR_CONFIG" |
|
||||||
info "Configuration created: ${TOR_CONFIG}" |
|
||||||
} |
|
||||||
|
|
||||||
# Stop existing Tor instance |
|
||||||
stop_tor() { |
|
||||||
if [ -f "$TOR_PID_FILE" ]; then |
|
||||||
PID=$(cat "$TOR_PID_FILE" 2>/dev/null) |
|
||||||
if [ -n "$PID" ] && kill -0 "$PID" 2>/dev/null; then |
|
||||||
info "Stopping existing Tor instance (PID: $PID)..." |
|
||||||
kill "$PID" 2>/dev/null || true |
|
||||||
sleep 2 |
|
||||||
fi |
|
||||||
rm -f "$TOR_PID_FILE" |
|
||||||
fi |
|
||||||
} |
|
||||||
|
|
||||||
# Start Tor |
|
||||||
start_tor() { |
|
||||||
info "Starting Tor..." |
|
||||||
|
|
||||||
# Ensure data directory exists |
|
||||||
mkdir -p "${TOR_DATA_DIR}/data" |
|
||||||
|
|
||||||
# Start Tor with our config |
|
||||||
tor -f "$TOR_CONFIG" 2>&1 | head -20 & |
|
||||||
|
|
||||||
# Wait for Tor to bootstrap |
|
||||||
info "Waiting for Tor to connect to the network..." |
|
||||||
|
|
||||||
for i in {1..60}; do |
|
||||||
if [ -f "${TOR_DATA_DIR}/hidden_service/hostname" ]; then |
|
||||||
ONION_ADDR=$(cat "${TOR_DATA_DIR}/hidden_service/hostname") |
|
||||||
if [ -n "$ONION_ADDR" ]; then |
|
||||||
break |
|
||||||
fi |
|
||||||
fi |
|
||||||
|
|
||||||
# Check if Tor is still running |
|
||||||
if [ -f "$TOR_PID_FILE" ]; then |
|
||||||
PID=$(cat "$TOR_PID_FILE") |
|
||||||
if ! kill -0 "$PID" 2>/dev/null; then |
|
||||||
error "Tor process died. Check ${TOR_DATA_DIR}/tor.log" |
|
||||||
fi |
|
||||||
fi |
|
||||||
|
|
||||||
sleep 1 |
|
||||||
echo -n "." |
|
||||||
done |
|
||||||
echo "" |
|
||||||
|
|
||||||
if [ -f "${TOR_DATA_DIR}/hidden_service/hostname" ]; then |
|
||||||
ONION_ADDR=$(cat "${TOR_DATA_DIR}/hidden_service/hostname") |
|
||||||
info "Tor started successfully" |
|
||||||
echo "" |
|
||||||
echo -e "${GREEN}======================================${NC}" |
|
||||||
echo -e "${GREEN}Hidden Service Address:${NC}" |
|
||||||
echo -e "${YELLOW}${ONION_ADDR}${NC}" |
|
||||||
echo -e "${GREEN}======================================${NC}" |
|
||||||
echo "" |
|
||||||
else |
|
||||||
warn "Tor started but hidden service not ready yet" |
|
||||||
warn "Check: tail -f ${TOR_DATA_DIR}/tor.log" |
|
||||||
fi |
|
||||||
} |
|
||||||
|
|
||||||
# Print usage instructions |
|
||||||
print_instructions() { |
|
||||||
echo "" |
|
||||||
info "Development Tor setup complete!" |
|
||||||
echo "" |
|
||||||
echo " To start ORLY with Tor:" |
|
||||||
echo -e " ${BLUE}ORLY_TOR_ENABLED=true ORLY_TOR_HS_DIR=${TOR_DATA_DIR}/hidden_service ./orly${NC}" |
|
||||||
echo "" |
|
||||||
echo " To view the .onion address:" |
|
||||||
echo -e " ${BLUE}cat ${TOR_DATA_DIR}/hidden_service/hostname${NC}" |
|
||||||
echo "" |
|
||||||
echo " To view Tor logs:" |
|
||||||
echo -e " ${BLUE}tail -f ${TOR_DATA_DIR}/tor.log${NC}" |
|
||||||
echo "" |
|
||||||
echo " To stop Tor:" |
|
||||||
echo -e " ${BLUE}kill \$(cat ${TOR_PID_FILE})${NC}" |
|
||||||
echo "" |
|
||||||
echo " To restart Tor:" |
|
||||||
echo -e " ${BLUE}./scripts/tor-dev-setup.sh${NC}" |
|
||||||
echo "" |
|
||||||
} |
|
||||||
|
|
||||||
# Status command |
|
||||||
status() { |
|
||||||
if [ -f "$TOR_PID_FILE" ]; then |
|
||||||
PID=$(cat "$TOR_PID_FILE") |
|
||||||
if kill -0 "$PID" 2>/dev/null; then |
|
||||||
info "Tor is running (PID: $PID)" |
|
||||||
if [ -f "${TOR_DATA_DIR}/hidden_service/hostname" ]; then |
|
||||||
ONION_ADDR=$(cat "${TOR_DATA_DIR}/hidden_service/hostname") |
|
||||||
echo -e " Address: ${YELLOW}${ONION_ADDR}${NC}" |
|
||||||
fi |
|
||||||
return 0 |
|
||||||
fi |
|
||||||
fi |
|
||||||
warn "Tor is not running" |
|
||||||
return 1 |
|
||||||
} |
|
||||||
|
|
||||||
# Main |
|
||||||
main() { |
|
||||||
case "${1:-}" in |
|
||||||
status) |
|
||||||
status |
|
||||||
exit $? |
|
||||||
;; |
|
||||||
stop) |
|
||||||
stop_tor |
|
||||||
info "Tor stopped" |
|
||||||
exit 0 |
|
||||||
;; |
|
||||||
*) |
|
||||||
;; |
|
||||||
esac |
|
||||||
|
|
||||||
info "ORLY Development Tor Setup" |
|
||||||
info "Internal port: ${TOR_PORT}" |
|
||||||
echo "" |
|
||||||
|
|
||||||
check_tor |
|
||||||
setup_dirs |
|
||||||
stop_tor |
|
||||||
create_config |
|
||||||
start_tor |
|
||||||
print_instructions |
|
||||||
} |
|
||||||
|
|
||||||
main "$@" |
|
||||||
@ -1,197 +0,0 @@ |
|||||||
#!/bin/bash |
|
||||||
# tor-setup.sh - Production Tor hidden service setup for ORLY relay |
|
||||||
# |
|
||||||
# This script installs Tor and configures a hidden service for the relay. |
|
||||||
# The .onion address will be automatically detected by ORLY. |
|
||||||
# |
|
||||||
# Usage: sudo ./scripts/tor-setup.sh [port] |
|
||||||
# port: internal port ORLY listens on for Tor traffic (default: 3336) |
|
||||||
# |
|
||||||
# Requirements: |
|
||||||
# - Root privileges (for installing packages and configuring Tor) |
|
||||||
# - Systemd-based Linux distribution |
|
||||||
# |
|
||||||
# After running this script: |
|
||||||
# 1. Start ORLY with: ORLY_TOR_ENABLED=true ORLY_TOR_HS_DIR=/var/lib/tor/orly-relay ./orly |
|
||||||
# 2. The .onion address will appear in logs and NIP-11 |
|
||||||
|
|
||||||
set -e |
|
||||||
|
|
||||||
# Configuration |
|
||||||
TOR_PORT="${1:-3336}" |
|
||||||
HS_NAME="orly-relay" |
|
||||||
HS_DIR="/var/lib/tor/${HS_NAME}" |
|
||||||
|
|
||||||
# Colors for output |
|
||||||
RED='\033[0;31m' |
|
||||||
GREEN='\033[0;32m' |
|
||||||
YELLOW='\033[1;33m' |
|
||||||
NC='\033[0m' # No Color |
|
||||||
|
|
||||||
info() { echo -e "${GREEN}[INFO]${NC} $1"; } |
|
||||||
warn() { echo -e "${YELLOW}[WARN]${NC} $1"; } |
|
||||||
error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; } |
|
||||||
|
|
||||||
# Check if running as root |
|
||||||
if [ "$EUID" -ne 0 ]; then |
|
||||||
error "Please run as root: sudo $0" |
|
||||||
fi |
|
||||||
|
|
||||||
# Detect package manager and install Tor |
|
||||||
install_tor() { |
|
||||||
info "Installing Tor..." |
|
||||||
|
|
||||||
if command -v apt-get &> /dev/null; then |
|
||||||
# Debian/Ubuntu |
|
||||||
apt-get update |
|
||||||
apt-get install -y tor |
|
||||||
elif command -v dnf &> /dev/null; then |
|
||||||
# Fedora/RHEL |
|
||||||
dnf install -y tor |
|
||||||
elif command -v pacman &> /dev/null; then |
|
||||||
# Arch Linux |
|
||||||
pacman -Sy --noconfirm tor |
|
||||||
elif command -v apk &> /dev/null; then |
|
||||||
# Alpine |
|
||||||
apk add tor |
|
||||||
elif command -v brew &> /dev/null; then |
|
||||||
# macOS (run as user, not root) |
|
||||||
brew install tor |
|
||||||
else |
|
||||||
error "Unsupported package manager. Please install Tor manually." |
|
||||||
fi |
|
||||||
|
|
||||||
info "Tor installed successfully" |
|
||||||
} |
|
||||||
|
|
||||||
# Configure hidden service |
|
||||||
configure_tor() { |
|
||||||
info "Configuring Tor hidden service..." |
|
||||||
|
|
||||||
TORRC="/etc/tor/torrc" |
|
||||||
|
|
||||||
# Check if hidden service already configured |
|
||||||
if grep -q "HiddenServiceDir ${HS_DIR}" "$TORRC" 2>/dev/null; then |
|
||||||
warn "Hidden service already configured in ${TORRC}" |
|
||||||
return 0 |
|
||||||
fi |
|
||||||
|
|
||||||
# Backup original torrc |
|
||||||
if [ -f "$TORRC" ]; then |
|
||||||
cp "$TORRC" "${TORRC}.backup.$(date +%Y%m%d%H%M%S)" |
|
||||||
info "Backed up original torrc" |
|
||||||
fi |
|
||||||
|
|
||||||
# Add hidden service configuration |
|
||||||
cat >> "$TORRC" << EOF |
|
||||||
|
|
||||||
# ORLY Relay Hidden Service |
|
||||||
# Added by tor-setup.sh on $(date) |
|
||||||
HiddenServiceDir ${HS_DIR}/ |
|
||||||
HiddenServicePort 80 127.0.0.1:${TOR_PORT} |
|
||||||
EOF |
|
||||||
|
|
||||||
info "Hidden service configured: ${HS_DIR}" |
|
||||||
} |
|
||||||
|
|
||||||
# Set permissions |
|
||||||
set_permissions() { |
|
||||||
info "Setting directory permissions..." |
|
||||||
|
|
||||||
# Create hidden service directory if it doesn't exist |
|
||||||
mkdir -p "$HS_DIR" |
|
||||||
|
|
||||||
# Set correct ownership (debian-tor on Debian/Ubuntu, tor on others) |
|
||||||
if id "debian-tor" &>/dev/null; then |
|
||||||
chown -R debian-tor:debian-tor "$HS_DIR" |
|
||||||
elif id "tor" &>/dev/null; then |
|
||||||
chown -R tor:tor "$HS_DIR" |
|
||||||
fi |
|
||||||
|
|
||||||
chmod 700 "$HS_DIR" |
|
||||||
|
|
||||||
info "Permissions set" |
|
||||||
} |
|
||||||
|
|
||||||
# Restart Tor service |
|
||||||
restart_tor() { |
|
||||||
info "Restarting Tor service..." |
|
||||||
|
|
||||||
if command -v systemctl &> /dev/null; then |
|
||||||
systemctl enable tor |
|
||||||
systemctl restart tor |
|
||||||
elif command -v service &> /dev/null; then |
|
||||||
service tor restart |
|
||||||
else |
|
||||||
warn "Could not restart Tor. Please restart manually." |
|
||||||
return 1 |
|
||||||
fi |
|
||||||
|
|
||||||
# Wait for Tor to create the hostname file |
|
||||||
info "Waiting for hidden service to initialize..." |
|
||||||
for i in {1..30}; do |
|
||||||
if [ -f "${HS_DIR}/hostname" ]; then |
|
||||||
break |
|
||||||
fi |
|
||||||
sleep 1 |
|
||||||
done |
|
||||||
|
|
||||||
if [ -f "${HS_DIR}/hostname" ]; then |
|
||||||
ONION_ADDR=$(cat "${HS_DIR}/hostname") |
|
||||||
info "Tor service started successfully" |
|
||||||
echo "" |
|
||||||
echo -e "${GREEN}======================================${NC}" |
|
||||||
echo -e "${GREEN}Hidden Service Address:${NC}" |
|
||||||
echo -e "${YELLOW}${ONION_ADDR}${NC}" |
|
||||||
echo -e "${GREEN}======================================${NC}" |
|
||||||
echo "" |
|
||||||
else |
|
||||||
warn "Tor started but hostname file not yet created" |
|
||||||
warn "Check: ls -la ${HS_DIR}/" |
|
||||||
fi |
|
||||||
} |
|
||||||
|
|
||||||
# Print usage instructions |
|
||||||
print_instructions() { |
|
||||||
echo "" |
|
||||||
info "Setup complete! To enable Tor in ORLY:" |
|
||||||
echo "" |
|
||||||
echo " Option 1 - Environment variables:" |
|
||||||
echo " export ORLY_TOR_ENABLED=true" |
|
||||||
echo " export ORLY_TOR_HS_DIR=${HS_DIR}" |
|
||||||
echo " export ORLY_TOR_PORT=${TOR_PORT}" |
|
||||||
echo " ./orly" |
|
||||||
echo "" |
|
||||||
echo " Option 2 - Command line:" |
|
||||||
echo " ORLY_TOR_ENABLED=true ORLY_TOR_HS_DIR=${HS_DIR} ./orly" |
|
||||||
echo "" |
|
||||||
echo " The .onion address will automatically appear in NIP-11 relay info." |
|
||||||
echo "" |
|
||||||
echo " To view the .onion address:" |
|
||||||
echo " cat ${HS_DIR}/hostname" |
|
||||||
echo "" |
|
||||||
echo " To check Tor status:" |
|
||||||
echo " systemctl status tor" |
|
||||||
echo "" |
|
||||||
} |
|
||||||
|
|
||||||
# Main |
|
||||||
main() { |
|
||||||
info "ORLY Tor Hidden Service Setup" |
|
||||||
info "Internal port: ${TOR_PORT}" |
|
||||||
echo "" |
|
||||||
|
|
||||||
# Check if Tor is already installed |
|
||||||
if ! command -v tor &> /dev/null; then |
|
||||||
install_tor |
|
||||||
else |
|
||||||
info "Tor is already installed" |
|
||||||
fi |
|
||||||
|
|
||||||
configure_tor |
|
||||||
set_permissions |
|
||||||
restart_tor |
|
||||||
print_instructions |
|
||||||
} |
|
||||||
|
|
||||||
main |
|
||||||
Loading…
Reference in new issue