tor: CachyOS CTR CookieAuth same FP (TODO=704)

configs/systemd/user/container-koopa-tor-relay.service

@@ -0,0 +1,21 @@
+# container-koopa-tor-relay.service — regenerated by tor.sh 2026-10-24T21:47:24+02:00
+# Prefer simple over podman-generate-systemd forking+PIDFile (stale CID storm).
+
+[Unit]
+Description=Podman koopa-tor-relay
+Wants=network-online.target
+After=network-online.target
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=always
+RestartSec=5
+TimeoutStartSec=120
+TimeoutStopSec=70
+ExecStart=/usr/bin/podman start --attach koopa-tor-relay
+ExecStop=/usr/bin/podman stop -t 10 koopa-tor-relay
+Type=simple
+
+[Install]
+WantedBy=default.target

configs/tor/build/Containerfile

@@ -0,0 +1,24 @@
+# koopa-tor-relay — Tor non-exit relay on CachyOS (Arch extra/tor)
+# Same pattern as koopa-meet-web:cachyos. Rootless: tor user -> uid/gid 1000.
+# Recreate: --user 1000:1000 --userns=keep-id  (see README / tor.sh)
+ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
+FROM ${CACHYOS_IMAGE}
+ENV TZ=Europe/Zurich
+RUN pacman -Syu --noconfirm --needed tor nyx ca-certificates \
+ && pacman -Scc --noconfirm \
+ && rm -rf /var/cache/pacman/pkg/* /tmp/* \
+ && mkdir -p /var/lib/tor /var/log/tor \
+ && if id tor >/dev/null 2>&1; then \
+      groupmod -g 1000 tor 2>/dev/null || true; \
+      usermod -u 1000 -g 1000 tor 2>/dev/null || true; \
+    elif id debian-tor >/dev/null 2>&1; then \
+      groupmod -g 1000 debian-tor; usermod -u 1000 -g 1000 debian-tor; \
+    else \
+      groupadd -g 1000 tor; useradd -u 1000 -g 1000 -d /var/lib/tor -s /usr/bin/nologin tor; \
+    fi \
+ && chown -R 1000:1000 /var/lib/tor /var/log/tor \
+ && chmod 700 /var/lib/tor
+EXPOSE 8080 9051
+USER 1000:1000
+ENTRYPOINT ["/usr/bin/tor"]
+CMD ["-f", "/etc/tor/torrc", "--runasdaemon", "0"]

configs/tor/torrc

@@ -0,0 +1,18 @@
+# KoopaRelay — same policy as live /etc/tor/torrc + admin-log configs/tor/torrc
+# Identity: keys in DataDirectory (migrate from host /var/lib/tor)
+Log notice file /var/log/tor/notices.log
+Nickname    KoopaRelay
+ContactInfo info+koopa@hacktivism.ch
+# dual-stack: bind all addresses on 8080 (IPv4 + IPv6), same as host tor
+ORPort      8080
+ControlPort 127.0.0.1:9051
+CookieAuthentication 1
+CookieAuthFile /var/lib/tor/control_auth_cookie
+ExitRelay   0
+SocksPort   0
+MyFamily    52BB94DDC1292F950CF728708AC48523E018A718
+BandwidthRate 2000 MBytes
+BandwidthBurst 2000 MBytes
+RelayBandwidthRate 2000 MBytes
+RelayBandwidthBurst 2000 MBytes
+DataDirectory /var/lib/tor