# Tor on koopa

**Runtime:** rootless podman container **`koopa-tor-relay`** (CachyOS base, Arch `extra/tor`), managed by user unit **`container-koopa-tor-relay.service`** (`Type=simple`, `podman start --attach`).  
**Host `tor.service`:** disabled / must stay off (port clash on ORPort 8080 + ControlPort 9051).  
**Ports:** ORPort **8080** · ControlPort **127.0.0.1:9051** (CookieAuthentication + CookieAuthFile).  
**Non-exit** relay (`ExitRelay 0`). Nickname **KoopaRelay**.  
**Fingerprint (stable keys under `~/koopa-tor-relay/data/keys/`):** `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8`  
**Family:** firecuda FireCudaRelay `52BB94DDC1292F950CF728708AC48523E018A718`

Live tree: `~/koopa-tor-relay/` (`torrc`, `data/`, `log/`, `build/Containerfile`).  
Mirrors in this repo: `configs/tor/torrc`, `configs/tor/build/Containerfile`, `configs/systemd/user/container-koopa-tor-relay.service`.

```bash
# status
systemctl --user status container-koopa-tor-relay.service
podman ps --filter name=koopa-tor-relay
# ControlPort cookie auth (hex)
COOKIE=$(xxd -p -c 256 ~/koopa-tor-relay/data/control_auth_cookie)
printf 'AUTHENTICATE %s\r\nGETINFO fingerprint\r\nGETINFO status/circuit-established\r\nQUIT\r\n' "$COOKIE" | nc -w 3 127.0.0.1 9051
```

Apply / recreate (after host tor off):

```bash
sudo APPLY=1 /tmp/tor.sh
# later upgrades:
~/upgrade-containers.sh --apply --rebuild-local --only koopa-tor-relay
```

login-health: expect user unit active + CTR Up; host `tor.service` inactive. Parent TODO=704.