So, it's no secret that the backbone of Internet as we know it is quite fragile. Love or hate Kiwi Farms, but the events happening around it show that even Tier 1 ISPs aren't safe from malicious actors willing to take down anything over personal disagreements without any court orders or other legal bindings. This could happen to *you* once they taste the blood. One man couldn't do much on their own, so rather than trying to change human nature, I think we should adopt technical solutions that eliminate that factor.
Here's where darknets come to play, namely Tor and I2P. Technical differences aside, both are rather effective at doing their job at hiding their user's and server's physical endpoints, and both can be integrated into fediverse in some capacity with relative ease thanks to the fact ActivityPub primarily federates through HTTP. As such, it is possible to create instances in Tor/I2P and make clearnet instances federate with former. The more instances there are that can federate with Tor, the more incentive for hosting Tor-only instances there is. And that's what I want to ask you.
Printed below is a short instruction on how to get your existing instance to federate with Tor without scarificing existing connectivity. It assumes you're running Debian-based distro; if you're running anything else, I expect you to know what init and package manager your distro uses and adjust the commands if necessary. Let's begin.
1. Install and enable Tor $ apt install tor $ systemctl enable tor $ systemctl start TorAfter that Tor should be running and accepting connections on 127.0.0.1:9050, similarly to what Tor Browser bundle already does, but without the browser. You won't become an exit node with default config, don't worry.
2. Install and configure Privoxy, this is proxy we're going to use to route *.onion traffic through Tor and everything else over regular connections $ apt install privoxyNext move or delete default config (/etc/privoxy/config) and make a new one consisting of following: user-manual /usr/share/doc/privoxy/user-manual confdir /etc/privoxy listen-address 127.0.0.1:8118 toggle 1 enable-remote-toggle 0 enable-edit-actions 0 enable-remote-http-toggle 0 max-client-connections 65535 buffer-limit 4096
logfile /dev/null
forward / . forward-socks5t .onion 127.0.0.1:9050 . Finally, enable and restart the service. $ systemctl enable privoxy $ systemctl start privoxyOptionally, you can test if the proxy is working with the following: $ http_proxy=http://127.0.0.1:8118 curl http://rawrxd4mden7rmbobaftao3qjyxbrvj4rrooehkqxlqcsdtnnn2hndid.onion/api/v1/instanceIf it returns a bunch of JSON, it should be good to go.
3. Locate your Pleroma's config file: /opt/pleroma/config/prod.secret.exs for source installs, /etc/pleroma/config for OTP. Then add the following to it: config :pleroma, :http, proxy_url: "127.0.0.1:8118" Optionally, it wouldn't hurt to increase timeouts, since Tor is rather slow and your instance might not catch up with default parameters. Replace Ю and Ъ with opening and closing square brackets, respectively; Pleroma bug with BBcode still isn't fixed and using Markup fucks up the whole list instead. config :pleroma, :hackney_pools, federation: Ю timeout: 300_000 Ъ config :pleroma, :pools, federation: Ю recv_timeout: 30_000 Ъ 4. Restart Pleroma, and you're good to go! Try to ping @mint, this is my alt on a Tor-only Pleroma instance that can federate with clearnet. Click "preview" a few times until the profile gets fetched and the ping link becomes clickable. That instance is hosted on a rather slow server and might take a while to catch up, but we with an operator will resolve that sometime in the future.
Feel free to ask me for additional support in case you're confused, as there might be a few caveats you could go through. I2P federation can be enabled similarly, and I'll provide the instructions if anyone is interested. random image from gelbooru with…
We already have static websites running on 2 servers, one being clearnet-only, and one being darknet-only, and the clearnet one will automatically redirect you to the .onion mirror if it detects you're browsing through Tor. For example, click this link while browsing over Tor, and notice the URL in the address bar once loaded: https://ryocafe.site
I'll translate and forward this to the instance owner, she too is very pro-darknet and clearnet-skeptic, so I expect to get an agreeing answer.
@mint@JapanAnon@PhenomX6@Tadano@cassidyclown@ne@neet@udon Oh yea, should add @digdeeper too, he's probably the most pro-Tor-only person I can think of. The reason why I didn't add loli frog is because of language barrier, so I'll translate and forward to her privately instead.
@shitpisscum@Tadano@cassidyclown@ne@neet@mint Might perhaps make a difference if you would swap out Pleroma for GNU Social, since the latter doesn't require SoyScript, and is more lightweight overall (and older, which contributes to it being more lightweight unless it went through a complete rewrite or a dependency hell, or both).
@mint@Tadano@cassidyclown@ne@neet@ryo Fun fact, I while ago I set up Tor on machine that runs spc social, turns out it has so much "power" it can't handle both Pleroma and Tor running at the same time lmao :bball: Anyway, if/when I funally set up that other instance I mentioned recently I'm definitely gonna try this. It should work the same for both stock Pleroma and Akkoma, right?
@ryo@Tadano@cassidyclown@ne@neet@shitpisscum The key is being able to provide your own upstream proxy, and I'm not sure GNUsoc supports that. Pleroma and Mastodon do for sure. Speaking of lightweigth, take a look at bloat if you aren't aware of it already, maybe even install it on your own premises. https://bloat.freesoftwareextremist.com
@ne@Tadano@cassidyclown@neet@mint@shitpisscum PHP isn't sluggish unless you use a framework and relying on other dependencies instead of coding everything from scratch, which is the case with 95% of the PHP projects in current year anyway, because current year "coders" don't know how to code.
@JapanAnon@Tadano@cassidyclown@PhenomX6@ne@neet@mint@udon The main goal is to replace the clearnet completely, yes. You can theoretically make it mirror to Tor, but I think loli frog told me she tried this once, and resulted in messages posted on this instance not being published on the clearnet at all.
@ryo@Tadano@cassidyclown@PhenomX6@ne@neet@mint@udon I haven't had time to read in detail yet, does this add Tor functionality on top of a clearnet instance, or does it replace the clearnet domain entirely? I was under the impression that a Pleroma domain became fixed after initial setup.
@mint@mint@Tadano@ne@neet@ryo thanks- pinged your onion account and it's letting me remotely preview your profile so I think it's working - you should get this added to the pleroma docs under the onion federation stuff. Are there any other onion-only instances I can test this with (have been wanting to federate with tor only instances for a while but I just don't know of any lol) > I2P federation can be enabled similarly, and I'll provide the instructions if anyone is interested. am interested- also would like to know what i2p-only instances are out there :hapyday:
@cassidyclown@mint@Tadano@ne@neet@ryo Yup, seems to work, my follow request went through. As for other instances, fedilist crawls onions, but most of them aren't too active. A bunch of mirrors ended up there as well, I removed them from the list. $ curl 'http://demo.fedilist.com/instance/csv' --silent | grep \.onion\, svfkzobwlzuxn46t4yfl5xolgh5gbi5hax5kfmfnzkz7a3fexw4jhfyd.onion,up,mastodon,0,0,8,1646252489 a232ncr7jexk2chvubaq2v6qdizbocllqap7mnn7w7vrdutyvu32jeyd.onion,up,mastodon,0,92,48,1644914514 64yuxt2vzvbfbcckwbyhagwgxtvvdc67ukfpvh6kjudow6jvgnhnlwyd.onion,up,mastodon,0,17,29,1645999447 liibeu7vlwaumwrstixzcpkqucdfln5m4sn5buciwkgbn6aet2xokzyd.onion,up,mastodon,2,21,64,1644914514 lm6qdqe5qbir26aqfsyogoo2mykxo4ff66ekfzpayflt6y5i7viiooid.onion,up,mastodon,0,73,59,1644914514 dq5dgaiq6cshrgyupj5yi3vzvipikpkopc6ht5kiiuikjngt74ybgqad.onion,up,mastodon,0,0,18,1644914515 fmxsd7f7qubflkkjb6ck4douwlckq5jf4b5x5fskpxik34hjfdtebead.onion,up,mastodon,0,7,40,1644914514 fbbtyosausdfn3ogl66spqj5prnu3tscokaijcimd3hwszoe5hc4r4yd.onion,up,mastodon,0,28,31,1644914515 zgz3oin6wbe7k37jokcaghd2bi3uezhuqdtac22hjlmhc4cgyw6s5yyd.onion,up,mastodon,1,29,59,1644914514 hqiww2qqev45zq3xadmwvegmq47hhi3a24ahnyed3ogadzdb5jl7m2qd.onion,up,mastodon,0,94,71,1644914514 p3dm56xwesyzqo7twt5v33t6qdm7aiapylfp7y5ioknkvarnfsovt2ad.onion,up,mastodon,1,127,40,1644914514 5z5ce433e2yp73jqm3yxmyh2yvcn33venhnm5trqde6uwjysxyy3gbad.onion,up,misskey,,,982,1644791248 rawrxd4mden7rmbobaftao3qjyxbrvj4rrooehkqxlqcsdtnnn2hndid.onion,up,pleroma,5,83,396,1658227745 chistqvhpsuxxxgccn3a7lqze24idsatjmkcqqqawwosflduy4utfyqd.onion,up,writefreely,25,225,,1644821564As for I2P, I know about pubsub.i2p (which only federates inside Tor and I2P, so no access to clearnet from their side) and iwojima's instance (which does federate with Tor and clearnet).
1. Install i2pd. Default version from repo has some segfault bug that makes it crash, so it's better to enable their official repo. $ wget https://repo.i2pd.xyz/.help/add_repo # Inspect the script before running it! There's nothing malicious, but some precaution would never hurt. $ sh ./add_repo $ apt update $ apt install i2pd2. Configure the speed and amount of transit traffic. It really depends on what kind of server you're running and whether you're willing to sacrifice some traffic to help the network grow. Locate /etc/i2pd/i2pd.conf and change a bunch of parameters there. bandwidth = LDepending on how beefy your server is, change that to O (256 KB/s) or P (2048 KB/s). Unlimited (X) is an overkill and might cause additinal CPU strain. share = 100 notransit = falseThis determines how much of traffic is going to be transit. As usual, make a decision yourself depending on your server hardware, traffic quotas and whether you want to participate. 25-50% shouldn't cause too much issues on moderate settings, but if you really can't delegate transit traffic, change it to 0% and set notransit to true.
Also make sure SOCKS proxy is enabled, it should be by default. ЮsocksproxyЪ address = 127.0.0.1 port = 44473. Enable and restart i2pd after your changes. $ systemctl enable i2pd $ systemctl restart i2pd4. Give it a few minutes to propagate, then test the connectivity. In I2P, the longer you're online, the better your integration into the network is. $ http_proxy=http://127.0.0.1:8118 curl http://reg.i2pAs usual, if it returns a bunch of HTML, it should be good to go.
5. Change Privoxy's config to allow it to access *.i2p domains over that proxy. Add a new line after onion forward: forward-socks5t .i2p 127.0.0.1:4447 .Then restart Privoxy just in case. $ systemctl restart privoxyI don't yet have accounts on instances that can federate with clearnet there, so ping @iwojima instead if you want to further test connectivity.
@JapanAnon@Tadano@cassidyclown@PhenomX6@ne@neet@ryo@udon >does this add Tor functionality on top of a clearnet instance This. Nothing should change for current domains, it simply allows for existing clearnet instances to federate with Tor ones.
@cassidyclown@Tadano@iwojima@mint@ne@neet@ryo Or not. Sadly, it doesn't help in case of mentions unless you merge it, which I explicitly mentioned in ther merge request. If you're running source install or self-built OTP, you can edit mix.exs and mix.lock to point to the forked version and then rebuild, otherwise gotta have to live with it for now.
Ill add this. Someone who made this tweet sent this to me and it really explains the overall amount of problems that are currently there for a connection between a conversation you and your friends. https://twitter.com/dscnode/status/1282459231065710593
Requires alot more time and thought to be considered. I'm completely familiar with the kiwifarms situation and also know one of the people who helped setup tor for kiwifarms. It might be in the cards in the future.
@pawlicker@mint@Tadano@cassidyclown@ne@neet@ryo Broken profile pic is normal if you aren't accessing it over Tor or proxy that selectively routes Tor. Mediaproxy is sadly broken, but it should redirect you anyway if redirect_on_failure is set to true. https://git.pleroma.social/pleroma/pleroma/-/issues/2861 If you don't use it, then CSP rules might be an issue. Hide them and override with modified ones in nginx. These are derived from default Pleroma ones, so don't worry much. add_header Content-Security-Policy "script-src 'self';connect-src 'self' blob: https://pawlicker.ddns.net wss://pawlicker.ddns.net;media-src 'self' https: http:;img-src 'self' data: blob: https: http:;default-src 'none';base-uri 'self';frame-ancestors 'none';style-src 'self' 'unsafe-inline';font-src 'self';manifest-src 'self'"; proxy_hide_header content-security-policy;
@mint@mint@Tadano@cassidyclown@ne@neet@ryo I don't have mediaproxy on. I'm literally hosting this instance on a Sun Ultra 45 in my basement since my goal was to have the "weirdest Pleroma setup known to man".
@PhenomX6@Tadano@cassidyclown@heyarnold@JapanAnon@ne@neet@mint@udon I've forwarded the whole concept of going to the darknet-only to some Eurofag, while he admitted that the clearnet is all the way destroyed, he's still not willing to even touch the darknet with a 1000 KM long stick because "MUH CHILD TRAFFICING, DRUGS SALES, AND GUN SALES!!", and because it's not government regulated at all.
I told him he doesn't have to have anything to do with those CIA operations (because 99% of them are glownigger ops), then he said that "the fact alone these things happen on there is enough for me to not use it".
OK, so if morality is what refrains you from gaining more freedom, enjoy being a digital slave then...
@mint@Tadano@cassidyclown@mint@ne@neet@ryo One more question do you have a guide on how to set up an instance over Tor itself or know any good resources on that? thanks.
@pawlicker@Tadano@cassidyclown@ne@neet@mint Basically the same way as you would on the clearnet, except the domain name is a .onion one, and no SSL certificate is necessary.
@pawlicker@Tadano@cassidyclown@mint@ne@neet Oh yea, and no need to host on a remote VPS or to have a dedicated IP address. You can, but you can as well just take out an old PC with an ethernet port and a Linux distro or BSD variant, and that's it. Even works fine if you have a dynamic IP address, which is the default for non-business ISP networks anyway.
@Tadano@cassidyclown@mint@ne@neet@ryo Meanwhile I’ve finally got mediaproxy to work. Turns out no changes to code are necessary, but the syntax wasn’t documented anywhere, so I was stuck with broken images when trying to get it working, until I took a closer look now.
This config should work and allow your instance to proxy media from Tor instances, making images and other stuff work without configuration on user’s side.
@mint@Tadano@cassidyclown@ne@neet@ryo this isn't going to work for instances on :p:'s shit list. He iptables blackholes you but pleroma still unendingly tries to fetch posts from instances that have been defederated. I can't get it to stop trying to get posts from spinster, poa.st, and fse. My logs just fill with failures, connection refused, and timeouts
@s8n@Tadano@cassidyclown@ne@neet@ryo Setting up an upstream proxy in the way I explained should simply allow your instance to see Tor instances without impacting existing clearnet connectivity in any capacity.
@s8n@Tadano@cassidyclown@ne@neet@ryo Yeah, I've simply copied config used on agency, which has a bunch of other stuff happening like signed fetches spoofing and selective routing of instances that block mine. Might revise it later.
@mint@Tadano@cassidyclown@ne@neet@ryo you increased the timeouts on the hackney pools to 10x their original value and increased the number of hackney runners which means busy instances like mine that have limited CPU availability would instantly hit 100% cpu and be stuck perpetually in iowait as all our hackney runners are waiting for fse to respond forever