#!/usr/bin/env bash # setup-onion.sh — Tor Hidden Service lab (ch.10) # --------------------------------------------------------------------------- # Publishes a hardened v3 .onion in front of a local Nginx, configured so the # box does not leak: Nginx binds 127.0.0.1 ONLY, access logs off, no version # string; Tor runs onion-only (no SOCKS, no relay) with scrubbed logging. # Run as root: ./setup-onion.sh [local_port] # --------------------------------------------------------------------------- set -uo pipefail RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m' print_header(){ echo -e "\n${GREEN}=== $1 ===${NC}"; } die(){ echo -e "${RED}[x] $1${NC}"; exit 1; } [[ ${EUID:-$(id -u)} -eq 0 ]] || die "Run as root." export DEBIAN_FRONTEND=noninteractive PORT="${1:-8080}" HS_DIR="/var/lib/tor/lab_hs" print_header "Installing Tor + Nginx" apt-get update -qq apt-get install -y tor nginx curl || die "package install failed" print_header "Local site on 127.0.0.1:${PORT} (never the clearnet)" install -d /var/www/onion echo "onion

Served over Tor.

" > /var/www/onion/index.html cat > /etc/nginx/sites-available/onion <