Developer Publishes His Personal Blog as a Tor Hidden Service

Software developer David Alvarez Rosa has made his personal website reachable over the Tor anonymity network, and published a short technical account of the setup on his blog. The site is now served from a .onion address that resolves only inside Tor, alongside its ordinary clearnet copy.

What a hidden service actually is

In his write-up, Alvarez Rosa notes that a hidden service needs no certificate authority, no DNS record and no exposed IP address. The address is derived directly from a public key, and Tor encrypts the connection end to end. Traffic passes through thousands of volunteer-run relays, so no single party can link a visitor to what they are reading. The anonymity covers the server as well as the client. Tor is developed by the Tor Project, a nonprofit that builds free software for privacy and human rights, and against censorship.

Two lines in torrc

The configuration itself is minimal: in /etc/tor/torrc a HiddenServiceDir parameter points at a dedicated directory, and HiddenServicePort forwards the hidden service's port 80 to 127.0.0.1:8080. Alvarez Rosa stresses that this directory must belong to Tor and not to the website's files, because Tor stores the service's private key and hostname file there and refuses to start if permissions are wrong. After restarting the tor@default service, the generated address can be read from the hostname file.

Serving the site, and building it twice

On the web server side, an nginx server block listens on 127.0.0.1:8080 with no TLS, HTTP/2 or QUIC, since Tor carries plain TCP and provides its own encryption layer. One problem remains: a static site bakes its base URL into absolute links, so a clearnet build would send visitors back to the clearnet domain even when they arrived over Tor. The fix is to build a second copy of the site with the onion address as its base URL. His deployment pipeline does that automatically, building the site once per target and syncing each version to its own web root, so the clearnet and Tor copies stay in step without manual work.