# Tor relay — koopa (`KoopaRelay`)

Live: **podman** container **`koopa-tor-relay`** (rootless hernani, `--network host`).  
Host layout: `~/koopa-tor-relay/{torrc,data,log,build}`.  
Mirror in this repo: `configs/tor/`.

| Setting | Value |
|---------|--------|
| Nickname | `KoopaRelay` |
| Fingerprint | `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8` |
| ORPort | **8080** (IPv4 + IPv6; VeciGate WAN DNAT → koopa:8080) |
| ControlPort | **127.0.0.1:9051** |
| ExitRelay | **0** (non-exit) |
| SocksPort | **0** |
| MyFamily | `52BB94DDC1292F950CF728708AC48523E018A718` |
| Bandwidth* | 2000 MBytes rate/burst |
| Image | `localhost/koopa-tor-relay:latest` (Debian bookworm + tor + nyx) |

## Files

| File | Role |
|------|------|
| `torrc` | Active policy (mounted read-only into container) |
| `Containerfile` | Image build (tor, nyx, tor-geoipdb) |
| `migrate-identity.sh` | One-shot copy of `/var/lib/tor` → container data (same identity) |
| `container-koopa-tor-relay.service` | systemd --user unit template |
| `torrc.minimal` / `torrc.sample` | Distro templates (reference) |

## Ops

```bash
# status
podman ps --filter name=koopa-tor-relay
systemctl --user status container-koopa-tor-relay
ss -lntp | grep -E '8080|9051'
tail -f ~/koopa-tor-relay/log/notices.log

# monitor
podman exec -it koopa-tor-relay nyx
```

### Cutover (host package → container)

1. `sudo systemctl stop tor && sudo systemctl disable tor` (prefer `mask` so it never returns)
2. `sudo ~/koopa-tor-relay/migrate-identity.sh` (or copy of this script)
3. `podman start koopa-tor-relay` / user unit enable
4. Confirm fingerprint and ORPort reachability

Do **not** run host `tor.service` and the container at the same time.

Monitoring helpers: `scripts/monitoring/tor_*.sh`.  
Firewall: `configs/firewalld/public-ports.md` (**8080/tcp**).  
Router: `../vecigate-admin-log` (WAN :8080 → koopa).