Hosting a Tor Onion Service (v3) on a VPS

A v3 onion needs no public IP, no DNS record and no open port. The setup path on a root KVM, and the operational limits worth knowing first.

Der Artikeltext ist auf Englisch. Header, Katalog und Kasse sind übersetzt.

What an onion service actually is

An onion service publishes a .onion address instead of a socket on the public internet. Clients build Tor circuits to reach it; the server's IPv4 never appears in DNS, never binds a public port, and never accumulates the reputation record that clearnet hosting creates. The application itself listens on localhost, and Tor tunnels requests in to it. Running middle relays or exits is a different workload with different exposure — that playbook lives with the relay documentation, not here.

Setup path

1. Provision a plain VPS in any location — geography is irrelevant to a .onion, so pick by your admin latency or by jurisdiction posture; one list price covers all twenty-one sites.
2. Install Tor from the Tor Project repository, then declare a HiddenServiceDir with HiddenServicePort 80 127.0.0.1:8080 in torrc.
3. Tor generates the v3 keypair and writes the hostname into the service directory. That string is your address — back the private key up, because there is no recovery.
4. Bind the application to 127.0.0.1 only, and publish Onion-Location headers if a clearnet mirror exists.

Operational notes

• The v3 key is the address: lose it and the service is gone; leak it and anyone can clone the .onion byte for byte.
• Flood attacks find little to hit — with no public IP, volumetric DDoS has no target, which is a structural property, not a filtering product.
• The AUP applies to hidden services exactly as to clearnet ones: legal content, no CSAM, no phishing, no attacks. Onion does not change the policy layer.