Configuration for ProPublica’s Tor hidden service proxy.

Note (December 16, 2021): These example files haven't been updated since 2016. In either 2019 or 2020, our onion domain was changed to a longer v3 onion address (p53lf57qovyuvwsc6xnrppyply3vtqm7l6pcobkmyqsiofyeznfu5uqd.onion). The examples below don't reflect this, but the configuration portions remain accurate regarding how we currently serve the onion site. (Tor Browser dropped support for v2 addresses, such as propub3r6espa33w.onion, in the second half of 2021.)

---

These files contain the base configuration for ProPublica’s Tor hidden service mirror.

Of note:

• We're using the nginx "subs_filter" and "headers more" modules to allow us to rewrite content and update headers, so that we can convert clearnet links into onion links, where possible.

• Based on feedback we've received, we're using Unix sockets (instead of a 127.0.0.1:___ TCP port) where nginx listens internally for the inbound connection from Tor. This ensures that a firewall misconfiguration can't expose the site running in nginx, which is likely overkill for an already-public (clearnet) website; this may also slightly improve performance and reduce socket overhead, however.

  If you try doing this and have issues using sudo service nginx restart due to leftover connections using the socket, you may have to nuke the previous sockets before starting a new nginx process:

  sudo service nginx stop && sudo rm /var/run/nginx-pponion-*.sock && sudo service nginx start)

Read our post for more details, including an extended tutorial about running a hidden service:
https://www.propublica.org/nerds/item/a-more-secure-and-anonymous-propublica-using-tor-hidden-services