docs: Tor relay mirror (configs/tor) and host index

Document KoopaRelay ORPort 8080 / ControlPort 9051; README + host/tor
pointer. torrc already matched live /etc/tor/torrc.

2026/2026-07-10.md

@@ -12,3 +12,4 @@
 - **admin-log origin** → Forgejo `hernani/koopa-admin-log` on git.hacktivism.ch (public; SSH :9200)
   → topic: `2026-07-10--admin-log-origin-forgejo.md`
 - admin-log: castopod/prime compose mirrors; firewalld list-all +9200; Caddyfile.taler-host marked legacy
+- admin-log: Tor relay mirror documented (`configs/tor/`, host/tor)

README.md

@@ -27,6 +27,7 @@ configs/                   # mirrored app configs (caddy, taler, forgejo, …)
   taler-exchange/          # overrides + coins
   forgejo/                 # rootless git.hacktivism.ch
   castopod/ bonfire/ prime/ # compose mirrors (no secret values)
+  tor/                     # KoopaRelay ORPort 8080
 scripts/                   # merchant, exchange, monitoring helpers
   taler-merchant/          # merchant-model start scripts
   taler-exchange/          # same model; archive/ = greenfield bootstrap

configs/tor/README.md

@@ -0,0 +1,34 @@
+# Tor relay — koopa
+
+Live: `/etc/tor/torrc` (package `tor`, `tor.service`).  
+Mirror: this directory (`torrc` = active config).
+
+| Setting | Value |
+|---------|--------|
+| Nickname | `KoopaRelay` |
+| ORPort | **8080** (public; VeciGate WAN DNAT → koopa:8080) |
+| ControlPort | **9051** (localhost only) |
+| ExitRelay | **0** (non-exit) |
+| SocksPort | **0** (no local SOCKS) |
+| MyFamily | fingerprint shared with related relays (e.g. firecuda) |
+| Bandwidth* | 2000 MBytes rate/burst |
+
+## Files
+
+| File | Role |
+|------|------|
+| `torrc` | Active config (mirror of `/etc/tor/torrc`) |
+| `torrc.minimal` | Distro minimal template |
+| `torrc.sample` | Distro full sample |
+
+## Ops
+
+```bash
+systemctl status tor
+ss -lntp | grep -E '8080|9051'
+sudo tail -f /var/log/tor/notices.log
+```
+
+Monitoring helpers: `scripts/monitoring/tor_*.sh`.  
+Firewall: `configs/firewalld/public-ports.md` (**8080/tcp**).  
+Router: `../vecigate-admin-log` (WAN :8080 → koopa).

host/overview/services.md

@@ -91,5 +91,6 @@ Full port notes: `configs/ports.md`.
 | Merchant container | `configs/taler-merchant/`, `scripts/taler-merchant/` |
 | Exchange container | `configs/taler-exchange/`, `scripts/taler-exchange/` |
 | **Forgejo rootless** | `configs/forgejo/`, `2026/2026-07-10--forgejo-rootless.md` |
+| Tor relay (`tor.service`) | `configs/tor/`, `host/tor/` |
 | Tor monitoring scripts | `scripts/monitoring/` |
 | VeciGate NAT | `../vecigate-admin-log/ip/firewall/nat/` |

host/tor/README.md

@@ -0,0 +1,4 @@
+# Tor (host service)
+
+Config mirror: **`configs/tor/`** (`torrc` = `/etc/tor/torrc`).  
+ORPort **8080**, ControlPort **9051** (loopback), non-exit.