docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable

configs/tor/README.md

@@ -0,0 +1,53 @@
+# Tor relay — koopa (`KoopaRelay`)
+
+Live: **podman** container **`koopa-tor-relay`** (rootless hernani, `--network host`).  
+Host layout: `~/koopa-tor-relay/{torrc,data,log,build}`.  
+Mirror in this repo: `configs/tor/`.
+
+| Setting | Value |
+|---------|--------|
+| Nickname | `KoopaRelay` |
+| Fingerprint | `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8` |
+| ORPort | **8080** (IPv4 + IPv6; VeciGate WAN DNAT → koopa:8080) |
+| ControlPort | **127.0.0.1:9051** |
+| ExitRelay | **0** (non-exit) |
+| SocksPort | **0** |
+| MyFamily | `52BB94DDC1292F950CF728708AC48523E018A718` |
+| Bandwidth* | 2000 MBytes rate/burst |
+| Image | `localhost/koopa-tor-relay:latest` (Debian bookworm + tor + nyx) |
+
+## Files
+
+| File | Role |
+|------|------|
+| `torrc` | Active policy (mounted read-only into container) |
+| `Containerfile` | Image build (tor, nyx, tor-geoipdb) |
+| `migrate-identity.sh` | One-shot copy of `/var/lib/tor` → container data (same identity) |
+| `container-koopa-tor-relay.service` | systemd --user unit template |
+| `torrc.minimal` / `torrc.sample` | Distro templates (reference) |
+
+## Ops
+
+```bash
+# status
+podman ps --filter name=koopa-tor-relay
+systemctl --user status container-koopa-tor-relay
+ss -lntp | grep -E '8080|9051'
+tail -f ~/koopa-tor-relay/log/notices.log
+
+# monitor
+podman exec -it koopa-tor-relay nyx
+```
+
+### Cutover (host package → container)
+
+1. `sudo systemctl stop tor && sudo systemctl disable tor` (prefer `mask` so it never returns)
+2. `sudo ~/koopa-tor-relay/migrate-identity.sh` (or copy of this script)
+3. `podman start koopa-tor-relay` / user unit enable
+4. Confirm fingerprint and ORPort reachability
+
+Do **not** run host `tor.service` and the container at the same time.
+
+Monitoring helpers: `scripts/monitoring/tor_*.sh`.  
+Firewall: `configs/firewalld/public-ports.md` (**8080/tcp**).  
+Router: `../vecigate-admin-log` (WAN :8080 → koopa).