# Tor on koopa

**Runtime:** podman **`koopa-tor-relay`** (not host `tor.service`).  
**Config mirror:** `configs/tor/` (`torrc`, Containerfile, migrate script, `create-container.sh`, user unit).  
**Data/identity:** `~/koopa-tor-relay/data` (same keys as former `/var/lib/tor`).  
**Process:** non-root **uid 1000** (`debian-tor`); recreate via `configs/tor/create-container.sh` after image rebuild.

| Port | Bind | Role |
|------|------|------|
| **8080** | `0.0.0.0` + `[::]` | ORPort (dual-stack) |
| **9051** | `127.0.0.1` | ControlPort (nyx / stem) |

Non-exit relay (`ExitRelay 0`, `SocksPort 0`).

### Root checklist

```bash
sudo systemctl disable --now tor
sudo systemctl mask tor
# linger already required for rootless user units:
# sudo loginctl enable-linger hernani
```

### User unit

```bash
systemctl --user enable --now container-koopa-tor-relay.service
```
