dhevt6e4rtgbtr3jh53xrpwmgtilkah6nyjujocsspssrsexc7omxhid.onion serves static site via Tor hidden service on port 80

Torrc configuration sets HiddenServiceDir to /var/lib/tor/blog/ with ownership restricted to debian-tor and HiddenServicePort 80 mapped to the local nginx listener. Restarting tor@default generates the hostname file containing the .onion address. Nginx serves the static files without TLS or HTTP/2 because Tor supplies the encryption layer over plain TCP. A second Hugo build with --baseURL set to the onion address keeps absolute links valid when accessed through the hidden service.

Tor hidden services eliminate DNS, certificate authorities, and direct IP exposure by deriving the address from the service's public key, a pattern documented in the Tor rendezvous specification since version 2 and refined in version 3 with ed25519 keys and improved circuit construction. This matches the self-hosting pipeline already used for the clearnet domain, where GitHub Actions trigger dual builds and rsync deployments. Related deployments in the homelab repository show consistent use of dedicated directories and permission hardening across multiple services.

Operationally the setup reduces the attack surface for targeted takedowns and surveillance by removing single points of failure at the registrar and hosting provider. It increases latency due to multi-hop routing but adds end-to-end anonymity for both client and server. The configuration trades operational simplicity for stronger resistance to IP-based blocking and logging, aligning with observed patterns in Tor Project relay metrics where hidden service traffic has grown steadily since the v3 protocol rollout.

Next steps include monitoring circuit failure rates through the Tor control port and integrating onion-location HTTP headers to signal the alternative endpoint to compatible browsers.