64 lines
2.5 KiB
Markdown
64 lines
2.5 KiB
Markdown
# Tor relay — koopa (`KoopaRelay`)
|
|
|
|
Live: **podman** container **`koopa-tor-relay`** (rootless hernani, `--network host`).
|
|
Host layout: `~/koopa-tor-relay/{torrc,data,log,build}`.
|
|
Mirror in this repo: `configs/tor/`.
|
|
|
|
| Setting | Value |
|
|
|---------|--------|
|
|
| Nickname | `KoopaRelay` |
|
|
| Fingerprint | `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8` |
|
|
| ORPort | **8080** (IPv4 + IPv6; VeciGate WAN DNAT → koopa:8080) |
|
|
| ControlPort | **127.0.0.1:9051** |
|
|
| ExitRelay | **0** (non-exit) |
|
|
| SocksPort | **0** |
|
|
| MyFamily | `52BB94DDC1292F950CF728708AC48523E018A718` |
|
|
| Bandwidth* | 2000 MBytes rate/burst |
|
|
| Image | `localhost/koopa-tor-relay:latest` (Debian bookworm + tor + nyx) |
|
|
| Process user | **non-root** `debian-tor` remapped to **uid/gid 1000** (`USER` in image) |
|
|
| Rootless note | recreate with `--user 1000:1000 --userns=keep-id` so `~/koopa-tor-relay/data` (hernani) stays writable |
|
|
|
|
## Files
|
|
|
|
| File | Role |
|
|
|------|------|
|
|
| `torrc` | Active policy (mounted read-only into container) |
|
|
| `Containerfile` | Image build (tor, nyx, tor-geoipdb); **not** root process |
|
|
| `create-container.sh` | Recreate container non-root + host net + volume mounts |
|
|
| `migrate-identity.sh` | One-shot copy of `/var/lib/tor` → container data (same identity) |
|
|
| `container-koopa-tor-relay.service` | systemd --user unit template |
|
|
| `torrc.minimal` / `torrc.sample` | Distro templates (reference) |
|
|
|
|
## Ops
|
|
|
|
```bash
|
|
# build image + recreate non-root container (as hernani)
|
|
cd ~/koopa-tor-relay/build # or configs/tor mirror
|
|
podman build -t localhost/koopa-tor-relay:latest -f Containerfile .
|
|
./create-container.sh # or: bash configs/tor/create-container.sh
|
|
podman start koopa-tor-relay
|
|
systemctl --user enable --now container-koopa-tor-relay.service
|
|
|
|
# status
|
|
podman ps --filter name=koopa-tor-relay
|
|
podman exec koopa-tor-relay id # expect uid=1000(debian-tor)
|
|
systemctl --user status container-koopa-tor-relay
|
|
ss -lntp | grep -E '8080|9051'
|
|
tail -f ~/koopa-tor-relay/log/notices.log
|
|
|
|
# monitor
|
|
podman exec -it koopa-tor-relay nyx
|
|
```
|
|
|
|
### Cutover (host package → container)
|
|
|
|
1. `sudo systemctl stop tor && sudo systemctl disable tor` (prefer `mask` so it never returns)
|
|
2. `sudo ~/koopa-tor-relay/migrate-identity.sh` (or copy of this script)
|
|
3. `podman start koopa-tor-relay` / user unit enable
|
|
4. Confirm fingerprint and ORPort reachability
|
|
|
|
Do **not** run host `tor.service` and the container at the same time.
|
|
|
|
Monitoring helpers: `scripts/monitoring/tor_*.sh`.
|
|
Firewall: `configs/firewalld/public-ports.md` (**8080/tcp**).
|
|
Router: `../vecigate-admin-log` (WAN :8080 → koopa).
|