# Tor on koopa

**Runtime:** podman **`koopa-tor-relay`** (not host `tor.service`).  
**Config mirror:** `configs/tor/` (`torrc`, Containerfile, migrate script, user unit).  
**Data/identity:** `~/koopa-tor-relay/data` (same keys as former `/var/lib/tor`).

| Port | Bind | Role |
|------|------|------|
| **8080** | `0.0.0.0` + `[::]` | ORPort (dual-stack) |
| **9051** | `127.0.0.1` | ControlPort (nyx / stem) |

Non-exit relay (`ExitRelay 0`, `SocksPort 0`).

### Root checklist

```bash
sudo systemctl disable --now tor
sudo systemctl mask tor
# linger already required for rootless user units:
# sudo loginctl enable-linger hernani
```

### User unit

```bash
systemctl --user enable --now container-koopa-tor-relay.service
```