Build and Secure Your Own Onion Service

Onion services are not just for secrecy. News organizations, search engines, software projects and whistleblowing platforms publish their sites over Tor to resist censorship, give readers end-to-end authenticity without relying on certificate authorities, and keep reader metadata off the open internet. This advanced course shows developers and sysadmins how to do the same, correctly and responsibly.

You will build a Linux lab, install tor from the Tor Project's official repository, publish a static site through nginx bound to localhost, and learn exactly what the v3 keys, descriptors, introduction points and rendezvous circuits are doing. From there you harden everything: secure key backups, vanity prefixes, Onion-Location, HTTPS options, leak-free server configuration, client authorization, proof-of-work and rate-limit defenses, Onionbalance, log minimization and privacy-safe monitoring.

We also cover the responsibilities that come with operating a service: the law still applies, content and abuse need clear processes, and promises to readers must match your configuration. You finish with a reusable launch checklist for real deployments.

Deploy a hardened onion mirror of a small static website in a lab VM and document it as if handing it to a new operator.

• Publish the site via nginx on a Unix socket or localhost, with no public listeners.
• Create and test an encrypted backup and restore of the service keys.
• Apply security headers, remove external resources, and minimize logs.
• Enable PoW and intro-point DoS defenses, and add a private staff service using client authorization.
• Submit your completed launch checklist and a short operator policy.