Hosting a Tor Onion Service (v3) on a VPS

How an onion service works, why the backend never needs a public IP reputation, and the setup path for a v3 hidden service on your own KVM.

Полный текст статьи на английском. Шапка, каталог и оплата переведены.

What an onion service actually is

An onion service publishes a .onion address instead of serving on the public internet. Clients reach it through Tor circuits; your server's IP stays out of DNS entirely. The service itself runs on localhost — Tor tunnels requests in. Middle relays and exits are a different animal (see the Tor relay playbook).

Setup path

1. Provision a plain VPS — any location; the .onion does not care about geography, pick by your admin latency.
2. Install Tor from the Tor Project repository, declare a HiddenServiceDir and HiddenServicePort 80 127.0.0.1:8080.
3. Tor writes the .onion hostname into the service directory — that is your address; back the private key up.
4. Bind your app to 127.0.0.1 only. Configure Onion-Location headers if you also serve clearnet.

Operational notes

• Keep the v3 key safe: lose it and the address is gone; leak it and the address can be cloned.
• Onions are DDoS-resilient by architecture — there is no public IP to flood.
• Legal content only: the AUP applies to onion services exactly as to clearnet sites.