hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
koopa-admin-log/configs/tor
History
Hernâni Marques 85d4e05ef0 tor: container create helper and relay docs. 
Document ORPort layout and host vs container tor coexistence.
2026-07-17 00:30:13 +02:00
..
container-koopa-tor-relay.service docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable 2026-07-13 10:12:00 +02:00
Containerfile tor: container create helper and relay docs. 2026-07-17 00:30:13 +02:00
create-container.sh tor: container create helper and relay docs. 2026-07-17 00:30:13 +02:00
migrate-identity.sh docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable 2026-07-13 10:12:00 +02:00
README.md tor: container create helper and relay docs. 2026-07-17 00:30:13 +02:00
torrc docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable 2026-07-13 10:12:00 +02:00
torrc.minimal docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable 2026-07-13 10:12:00 +02:00
torrc.sample docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable 2026-07-13 10:12:00 +02:00

README.md

Tor relay — koopa (KoopaRelay)

Live: podman container koopa-tor-relay (rootless hernani, --network host).
Host layout: ~/koopa-tor-relay/{torrc,data,log,build}.
Mirror in this repo: configs/tor/.

Setting Value
Nickname KoopaRelay
Fingerprint 02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8
ORPort 8080 (IPv4 + IPv6; VeciGate WAN DNAT → koopa:8080)
ControlPort 127.0.0.1:9051
ExitRelay 0 (non-exit)
SocksPort 0
MyFamily 52BB94DDC1292F950CF728708AC48523E018A718
Bandwidth* 2000 MBytes rate/burst
Image localhost/koopa-tor-relay:latest (Debian bookworm + tor + nyx)
Process user non-root debian-tor remapped to uid/gid 1000 (USER in image)
Rootless note recreate with --user 1000:1000 --userns=keep-id so ~/koopa-tor-relay/data (hernani) stays writable

Files

File Role
torrc Active policy (mounted read-only into container)
Containerfile Image build (tor, nyx, tor-geoipdb); not root process
create-container.sh Recreate container non-root + host net + volume mounts
migrate-identity.sh One-shot copy of /var/lib/tor → container data (same identity)
container-koopa-tor-relay.service systemd --user unit template
torrc.minimal / torrc.sample Distro templates (reference)

Ops

# build image + recreate non-root container (as hernani)
cd ~/koopa-tor-relay/build   # or configs/tor mirror
podman build -t localhost/koopa-tor-relay:latest -f Containerfile .
./create-container.sh        # or: bash configs/tor/create-container.sh
podman start koopa-tor-relay
systemctl --user enable --now container-koopa-tor-relay.service

# status
podman ps --filter name=koopa-tor-relay
podman exec koopa-tor-relay id   # expect uid=1000(debian-tor)
systemctl --user status container-koopa-tor-relay
ss -lntp | grep -E '8080|9051'
tail -f ~/koopa-tor-relay/log/notices.log

# monitor
podman exec -it koopa-tor-relay nyx

Cutover (host package → container)

  1. sudo systemctl stop tor && sudo systemctl disable tor (prefer mask so it never returns)
  2. sudo ~/koopa-tor-relay/migrate-identity.sh (or copy of this script)
  3. podman start koopa-tor-relay / user unit enable
  4. Confirm fingerprint and ORPort reachability

Do not run host tor.service and the container at the same time.

Monitoring helpers: scripts/monitoring/tor_*.sh.
Firewall: configs/firewalld/public-ports.md (8080/tcp).
Router: ../vecigate-admin-log (WAN :8080 → koopa).