Create your own Onion site accessible via Tor

Install Tor

Install the Tor service on your Linux machine.

# Debian
sudo apt install tor -y
 
# Arch
sudo pacman -S tor

Configure the Tor Onion Service

Next step is opening the config file of Tor (torrc) and doing the appropriate configurations to setup an Onion Service.

Open the file with root privileges:

sudo nano /etc/tor/torrc

You will need to add the following two lines to your torrc file:

HiddenServiceDir /var/lib/tor/my_website/
HiddenServicePort 80 127.0.0.1:3000

• The HiddenServiceDir line specifies the directory which should contain information and cryptographic keys for your Onion Service.
• The HiddenServicePort line specifies a virtual port (that is, the port that people visiting your Onion Service will be using). In the above case, it says that any traffic incoming to port 80 of your Onion Service should be redirected to 127.0.0.1:3000 (which is where your Next.js app or Docker container is listening).

Secure your Docker Container / Localhost rule

When running deploying website via Docker on a vServer, make sure your container is only accessible locally. If you bind it to 0.0.0.0, anyone could access your site via your server’s public IP, destroying the idea of your Tor Service and your anonymity.

Correct Binding:

# In your deploy script or docker run command
docker run -p 127.0.0.1:3000:3000 ...

Update Next.js Middleware

Since your site is now accessed via an .onion domain, you must update your middleware.ts (when hosting Next.js sites) to allow this host, otherwise, Next.js will block the request with a “Bad Host Header” error.

// Inside your middleware security check:
const allowedDomains = [
    '<domain1>',
    'localhost',
    '<subdomain1>.localhost'
];
 
const isAllowedHost = 
    allowedDomains.includes(currentHost) || 
    currentHost.endsWith('.<domain1>') ||
    currentHost.endsWith('.onion'); // <-- Allow all .onion addresses
 
if (!isAllowedHost) {
    return new NextResponse('Bad Host Header', { status: 400 });
}

Restart Tor and get your Onion Address

Restart Tor to apply the configuration. Tor will automatically generate the directory and your keys.

sudo systemctl restart tor

Now, retrieve your newly generated Onion address:

sudo cat /var/lib/tor/my_website/hostname

Copy this address into your Tor Browser to test your live website. It might take 1-2 minutes for the network to fully propagate your new address.