Web

Introduction These are the 101 - bare basics for accessing that sketchy link you don’t want tied to you (i.e. .cn, .ru). They key is understanding your threat model. Are you concerned about your activity being monitored? -> VPN Are you concerned about being attributed to you? -> TOR Are you concerned about infecting your system? -> VM/Container Resources PrivacyGuides Docker Desktop TOR Project Terms DNS: Domain Name Service VPN: Virtual Private Network TOR: The Onion Router VM: Virtual Machine How do you connect? The basic model of an internet connect is: ...

Introduction This post should be short and sweet - the goal is to get this: in the Tor browser. References TOR.org TOR.onion (hint: it’s the same page) Implementation The first step is to set up a Tor site. After that, everything is easy. Nginx Add this line to your site’s .conf file: add_header Onion-Location http://<your-onion-address>.onion$request_uri; Folder Structure ├──your-project-folder │ ├──Dockerfile │ ├──your-website-contents-folder │ │ └──[CONTENTS] └──└──nginx.conf Nginx Contain in Docker This configuration assumes you’re building your own docker container, and probably getting a custom url. ...

Introduction I wanted to see how to route my network traffic over tor. Would it be too slow? Would it even work? TBH, the load times have been a bit worse, but yes - it works, and the load times aren’t even that bad. The directory structure will end up looking like this: ├──tor-proxy │ ├──compose.yaml └──└──torrc NOTE: I used Google’s Gemini, and a locally hosted gemma 4 model to build this. There are likely multiple resources that aren’t properly recorded. ...

Introduction This guide is meant to be a top level overview on how to get a Hugo based static site set up on both the clear-web, and the dark-web. Both sites will host the exact same content, have custom URLs, and will be publically accessible. The intent is to string together some prior posts into a cohesive walkthrough, with less detail than the individual guides linked below. Install Docker -> Hugo Setup -> Tor & Cloudflare Tunnel ...

What’s the Point of This? Recently, schools across the US were hit by a breach of the education software Canvas by the ShinyHunters. The group’s ransom note included an interesting .onion url: Normally a .onion address is randomly generated characters with no meaning. The site’s name being tied to the keys generated when the node joins the network. However, ShinyHunters and the CIA have been able to generate custom TOR keys to at least get a partially human readable url. ...

Hugo Site Example: Introduction This guide is not all inclusive (RTFM). Hugo is a static site generator, converting your .md text files, and a chosen theme into a modern looking website (like this one). There are a staggering number of themes to give you the look and feel that your site needs. Everything Up Front It all starts with the hugo.yaml file (you can use .toml too), consult the hugo documentation. Here is the configuration for this site: ...

References AdGuardHome Download AdGuardHome Fix systemd-resolved Why AdGuardHome? AdGuard has become a key service in my homelab. I’m so used to having ads blocked across my network, it’s a surprise loading a site away from home and seeing the broken hellscape of ads everywhere. Get a network level adblocker and learn how to use it. The less tech savvy folks in your home will thank you. Installation Download the latest version of AdGuardHome Extract using tar -xf AdGuardHome_linux_amd64.tar.gz Move the folder to the destination: mv AdGuardHome [DESTINATION] Fedora: /usr/local/bin/ Ubuntu: /opt/ Install using sudo ./AdGuardHome -s install Set up your account at http://ADGUARD-SERVER:3000 Set your router’s DNS server to point at your AdGuardHome server (steps will vary by router) Set your AdGuard Block Lists Upstream Providers DNS Rewrites Allow Lists Custom Rules Back up you AdGuardHome.yaml Deploy with Docker Compose: services: adguardhome: image: adguard/adguardhome container_name: adguardhome volumes: #place AdGuardHome.yaml here if you already have a configured instance - [map to your /conf directory]:/opt/adguardhome/conf - [map to your /work directory]:/opt/adguardhome/work deploy: mode: global ports: - "53:53/udp" # <Host Port>:<Container Port> - "53:53/tcp" - "67:67/udp" # - "68:68/udp" - "80:80/tcp" - "443:443/tcp" - "443:443/udp" - "3000:3000/tcp" - "853:853/tcp" - "853:853/udp" - "8853:8853/udp" - "784:784/udp" - "5443:5443/tcp" - "5443:5443/udp" restart: unless-stopped Troubleshooting Systemd-Resolved Reference: Fix systemd-resolved Us these steps when systemd is using port 53: ...

Directory Setup Set up the files and directories: mkdir -p tor-site/keys tor-site/html tor-site/logs touch tor-site/torrc Set permissions: chmod 700 tor-site/keys sudo chown root:root tor-site/keys tor-site/logs Content Setup Add the files for your website into the tor-site/html folder: example: <!DOCTYPE html> <html> <body> <h1>Hello from the Onion Router!</h1> <p>This site is hosted inside Docker.</p> </body> </html> Docker Setup Install Docker Docker Compose File compose.yaml services: nginx: container_name: nginx image: nginx cap_drop: - ALL cap_add: - CHOWN - SETGID - SETUID volumes: - ./html:/usr/share/nginx/html:ro - ./logs:/var/log/nginx networks: - tor_network tor: container_name: tor volumes: - ./torrc:/etc/tor/torrc:ro - ./keys:/var/lib/tor/hidden_service/ image: alpine:latest entrypoint: sh -c "apk add --no-cache tor && tor -f /etc/tor/torrc" security_opt: - no-new-privileges:true cap_drop: - ALL cap_add: - NET_BIND_SERVICE networks: - tor_network depends_on: - nginx networks: tor_network: nginx is the name of your web server container - this is important for the torrc file. :ro sets the volume to read only networks: tor_network means all the traffic stays inside the tor network security_opt: - no-new-privileges:true prevents the user from running as root through setuid or setgid cap_drop: -All removes all default Linux capabilities granted to a container cap_add: - NET_BIND_SERVICE will allow tor to work with only the necessary capabilities networks ensures that all traffic stays inside the docker network with a custom bridge tor_network to access the tor relays See Docker Permissions Create torrc: # Standard Tor config DataDirectory /var/lib/tor # Define the Hidden Service HiddenServiceDir /var/lib/tor/hidden_service/ HiddenServicePort 80 nginx:80 note: the name nginx should be the same as you name your web server container in the compose.yaml (see [[#Docker Setup]]). Notes: Did you know you can make a custom tor site name? See the Named Tor Site. The docker service setup: Dockhand Portainer services: nginx: container_name: nginx image: nginx volumes: - {$PWD}/html:/usr/share/nginx/html:ro networks: - tor_network tor: container_name: tor volumes: - {$PWD}/torrc:/etc/tor/torrc:ro - {$PWD}/keys:/var/lib/tor/hidden_service/ image: alpine:latest entrypoint: sh -c "apk add --no-cache tor && tor -f /etc/tor/torrc" security_opt: - no-new-privileges:true cap_drop: - ALL cap_add: - NET_BIND_SERVICE networks: - tor_network depends_on: - nginx networks: tor_network: References: hundehausen oneuptime.com randywestergren.com bobcrutchley tgeek77 Jon Goldman

Links dash.cloudflare.com one.dash.cloudflare.com Installing the service Ubuntu curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb && sudo dpkg -i cloudflared.deb && sudo cloudflared service install [TUNNEL KEY] Red Hat curl -L --output cloudflared.rpm https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm && sudo yum localinstall -y cloudflared.rpm && sudo cloudflared service install [TUNNEL KEY] Docker docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token [TUNNEL KEY] Docker Compose services: cloudflared: image: cloudflare/cloudflared:latest restart: unless-stopped command: tunnel run network_mode: host environment: - "TUNNEL_TOKEN=[TUNNEL KEY]" deploy: mode: global placement: constraints: [node.platform.os == linux] Cloudflare as a Docker Sidecar Cloudflare can serve ports from other docker containers without actually exposing the container ports on the host device. See the compose example below: ...