Merge 929f3b8d44 into 759c0e8bbd
This commit is contained in:
Andy Piper
GitHub
commit
6e70625888
|
|
@ -11,25 +11,7 @@ Mastodon can be served through Tor as an onion service. This will give you a `*.
|
|||
|
||||
## Installing Tor {#install}
|
||||
|
||||
First Tor’s Debian archive needs to be added to apt.
|
||||
|
||||
```text
|
||||
deb https://deb.torproject.org/torproject.org stretch main
|
||||
deb-src https://deb.torproject.org/torproject.org stretch main
|
||||
```
|
||||
|
||||
Next add the gpg key.
|
||||
|
||||
```bash
|
||||
curl https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import
|
||||
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -
|
||||
```
|
||||
|
||||
Finally install the required packages.
|
||||
|
||||
```bash
|
||||
apt install tor deb.torproject.org-keyring
|
||||
```
|
||||
See the instructions provided by the Tor Project [here](https://support.torproject.org/apt/tor-deb-repo/).
|
||||
|
||||
## Configure Tor {#configure}
|
||||
|
||||
|
|
@ -37,26 +19,28 @@ Edit the file at `/etc/tor/torrc` and add the following configuration.
|
|||
|
||||
```text
|
||||
HiddenServiceDir /var/lib/tor/onion_service/
|
||||
HiddenServiceVersion 3
|
||||
HiddenServiceSingleHopMode 1
|
||||
HiddenServiceNonAnonymousMode 1
|
||||
HiddenServicePort 80 127.0.0.1:80
|
||||
```
|
||||
|
||||
Restart tor.
|
||||
Restart Tor.
|
||||
|
||||
```bash
|
||||
sudo service tor restart
|
||||
```
|
||||
|
||||
Your tor hostname can now be found at `/var/lib/tor/onion_service/hostname`.
|
||||
Your Tor hostname can now be found at `/var/lib/tor/onion_service/hostname`.
|
||||
|
||||
## Move your Mastodon configuration {#nginx}
|
||||
|
||||
We will need to tell Nginx about your Mastodon configuration twice. To keep things [DRY](https://en.wikipedia.org/wiki/Don%27t_repeat_yourself) we need to move the Mastodon configuration into its own file that can be referenced.
|
||||
|
||||
Create a new file at `/etc/nginx/snippets/mastodon.conf`. Put all of your Mastodon configuration parameters in this file with the exception of the `listen`, `server_name`, `include` and all of the SSL options. Your new file may look something like this.
|
||||
Create a new file at `/etc/nginx/snippets/mastodon.conf`. Put all of your Mastodon configuration parameters in this file with the exception of the `listen`, `server_name`, `include` and all of the SSL options. Include an `Onion-Location` header to let supporting browsers know that this service is also accessible from Tor. Your new file may look something like this.
|
||||
|
||||
```nginx
|
||||
add_header Referrer-Policy "same-origin";
|
||||
add_header Onion-Location mastodon.qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7.onion$request_uri;
|
||||
|
||||
keepalive_timeout 70;
|
||||
sendfile on;
|
||||
|
|
@ -79,7 +63,7 @@ Your Nginx configuration file will be left looking something like this.
|
|||
```nginx
|
||||
server {
|
||||
listen 80;
|
||||
server_name mastodon.myhosting.com;
|
||||
server_name mastodon.example.com;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
|
|
@ -91,19 +75,21 @@ map $http_upgrade $connection_upgrade {
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
list [::]:443 ssl http2;
|
||||
server_name mastodon.myhosting.com;
|
||||
server_name mastodon.example.com;
|
||||
include /etc/nginx/snippets/mastodon.conf;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/mastodon.myhosting.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mastodon.myhosting.com/privkey.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/mastodon.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mastodon.example.com/privkey.pem;
|
||||
}
|
||||
```
|
||||
|
||||
## Serve Tor over http {#http}
|
||||
## Serve Tor over HTTP {#http}
|
||||
|
||||
While it may be tempting to serve your Tor version of Mastodon over https it is not a good idea for most people. See [this](https://blog.torproject.org/facebook-hidden-services-and-https-certs) blog post from the Tor Project about why https certificates do not add value. Since you cannot get an SSL cert for an onion domain, you will also be plagued with certificate errors when trying to use your Mastodon instance. A Tor developer has more recently spelled out the reasons why serving a Tor service over https is not beneficial for most use cases [here](https://matt.traudt.xyz/posts/2017-12-02-dont-https-your-onions/).
|
||||
This section assumes that you want to expose your instance on both Tor and the public Internet *simultaneously*.
|
||||
|
||||
The solution is to serve your Mastodon instance over http, but only for Tor. This can be added by prepending an additional configuration to your Nginx configuration.
|
||||
While it may be tempting to serve your Tor version of Mastodon over HTTPS, it isn't always ideal. This option is mostly useful for large companies that can produce their own certificates with their own company information. There is no Certificate Authority (CA) that provides them [for free](https://community.torproject.org/onion-services/advanced/https/), and there is also [a blog post from the Tor Project](https://blog.torproject.org/facebook-hidden-services-and-https-certs) that explains why HTTPS certificates are not really beneficial for security. On the other hand, Mastodon uses a lot of redirects to the HTTPS version of your site, where the presence of a validated certificate may make it easier for your users to use your instance on Tor without having to manually remove the `https://` prefix in URLs.
|
||||
|
||||
In this section, we will go over how to serve your Mastodon instance over HTTP, but for Tor **only**. This can be added by prepending an additional configuration to your existing Nginx configuration.
|
||||
|
||||
```nginx
|
||||
server {
|
||||
|
|
@ -114,7 +100,7 @@ server {
|
|||
|
||||
server {
|
||||
listen 80;
|
||||
server_name mastodon.myhosting.com;
|
||||
server_name mastodon.example.com;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
|
|
@ -126,19 +112,25 @@ map $http_upgrade $connection_upgrade {
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
list [::]:443 ssl http2;
|
||||
server_name mastodon.myhosting.com;
|
||||
server_name mastodon.example.com;
|
||||
include /etc/nginx/snippets/mastodon.conf;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/mastodon.myhosting.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mastodon.myhosting.com/privkey.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/mastodon.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mastodon.example.com/privkey.pem;
|
||||
}
|
||||
```
|
||||
|
||||
Replace the long hash provided here with your Tor domain located in the file at `/var/lib/tor/onion_service/hostname`.
|
||||
Also update `.env.production`:
|
||||
|
||||
Note that the onion hostname has been prefixed with “mastodon.”. Your Tor address acts as a wildcard domain. All subdomains will be routed through, and you can configure Nginx to respond to any subdomain you wish. If you do not wish to host any other services on your tor address you can omit the subdomain, or choose a different subdomain.
|
||||
```text
|
||||
ALTERNATE_DOMAINS=mastodon.qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7.onion
|
||||
```
|
||||
|
||||
Here you can see the payoff of moving your mastodon configurations to a different file. Without this, all of your configurations would have to be copied to both places. Any change to your configuration would have to be made in both places.
|
||||
Replace the long hash provided here with your Tor domain located in the file at `/var/lib/tor/onion_service/hostname`. This should also be reflected in the `Onion-Location` header in the snippets file.
|
||||
|
||||
Note that the onion hostname has been prefixed with “mastodon.”. Your Tor address acts as a wildcard domain. All subdomains will be routed through this, and you can configure Nginx to respond to any subdomain you wish. If you do not wish to host any other services on your Tor address you can omit the subdomain, or choose a different subdomain.
|
||||
|
||||
Here you can see the payoff of moving your Mastodon configurations to a different file. Without this, all of your configurations would have to be copied to both places. Any change to your configuration would have to be made in both places.
|
||||
|
||||
Restart your web server.
|
||||
|
||||
|
|
@ -148,7 +140,7 @@ service nginx restart
|
|||
|
||||
## Gotchas {#gotchas}
|
||||
|
||||
There are a few things you will need to be aware of. Certain redirects will push your users to https. They will have to manually replace the URL with http to continue.
|
||||
|
||||
Various resources, such as images, will still be offered through your regular non-Tor domain. How much of a problem this is will depend greatly on your user’s level of caution.
|
||||
There are a few things you will need to understand.
|
||||
|
||||
- As mentioned earlier, certain URLs in the Mastodon frontend will force your users to a HTTPS URL. They will have to manually replace the URL with HTTP to continue.
|
||||
- Various resources, such as images, will **still** be offered through your regular clearnet domain. This could possibly be a problem, depending on how cautious your users want, try or need to be.
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
---
|
||||
title: 匿名服务
|
||||
description: 通过TOR的匿名服务来访问Mastodon。
|
||||
description: 通过Tor的匿名服务来访问Mastodon。
|
||||
menu:
|
||||
docs:
|
||||
weight: 20
|
||||
parent: admin-optional
|
||||
---
|
||||
|
||||
可以通过TOR的匿名服务来访问Mastodon。这将给你一个只能通过 TOR 网络连接的 *.onion 地址。
|
||||
可以通过Tor的匿名服务来访问Mastodon。这将给你一个只能通过 Tor 网络连接的 \*.onion 地址。
|
||||
|
||||
## 安装 Tor {#install}
|
||||
|
||||
|
|
@ -41,13 +41,13 @@ HiddenServiceVersion 3
|
|||
HiddenServicePort 80 127.0.0.1:80
|
||||
```
|
||||
|
||||
重启 tor。
|
||||
重启 Tor。
|
||||
|
||||
```bash
|
||||
sudo service tor restart
|
||||
```
|
||||
|
||||
现在，你的tor域名可以在 `/var/lib/tor/hidden_service/hostname` 找到。
|
||||
现在，你的Tor域名可以在 `/var/lib/tor/onion_service/hostname` 找到。
|
||||
|
||||
## 移动你的Mastodon配置 {#nginx}
|
||||
|
||||
|
|
@ -77,7 +77,7 @@ error_log /var/log/nginx/mastodon_error.log warn;
|
|||
```text
|
||||
server {
|
||||
listen 80;
|
||||
server_name mastodon.myhosting.com;
|
||||
server_name mastodon.example.com;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
|
|
@ -89,11 +89,11 @@ map $http_upgrade $connection_upgrade {
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
list [::]:443 ssl http2;
|
||||
server_name mastodon.myhosting.com;
|
||||
server_name mastodon.example.com;
|
||||
include /etc/nginx/snippets/mastodon.conf;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/mastodon.myhosting.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mastodon.myhosting.com/privkey.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/mastodon.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mastodon.example.com/privkey.pem;
|
||||
}
|
||||
```
|
||||
|
||||
|
|
@ -112,7 +112,7 @@ server {
|
|||
|
||||
server {
|
||||
listen 80;
|
||||
server_name mastodon.myhosting.com;
|
||||
server_name mastodon.example.com;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
|
|
@ -124,11 +124,11 @@ map $http_upgrade $connection_upgrade {
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
list [::]:443 ssl http2;
|
||||
server_name mastodon.myhosting.com;
|
||||
server_name mastodon.example.com;
|
||||
include /etc/nginx/snippets/mastodon.conf;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/mastodon.myhosting.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mastodon.myhosting.com/privkey.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/mastodon.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mastodon.example.com/privkey.pem;
|
||||
}
|
||||
```
|
||||
|
||||
|
|
@ -150,4 +150,4 @@ service nginx restart
|
|||
|
||||
许多的资源，诸如图片，将仍然从常规非Tor域名加载。问题的严重性很大程度上取决于用户的谨慎程度。
|
||||
|
||||
{{< translation-status-zh-cn raw_title="Hidden services" raw_link="/admin/optional/tor/" last_tranlation_time="2020-05-04" raw_commit="ad1ef20f171c9f61439f32168987b0b4f9abd74b">}}
|
||||
{{< translation-status-zh-cn raw_title="Onion services" raw_link="/admin/optional/tor/" last_tranlation_time="2020-05-04" raw_commit="ad1ef20f171c9f61439f32168987b0b4f9abd74b">}}
|
||||
|
|
|
|||
Loading…
Reference in New Issue