A Tor hidden service makes a website accessible only inside the Tor network using a .onion address that is derived directly from a public key, requiring no traditional DNS, certificate authority, or exposed IP address; the connection itself is end‑to‑end encrypted by Tor, so visitors and the site operator remain anonymous to each other. (source: primary)
This image supports the article's explanation of how a Tor hidden service allows anonymous website publishing without traditional DNS or exposed IP address.
To create the service, you install Tor, edit /etc/tor/torrc to set a HiddenServiceDir (e.g., /var/lib/tor/blog/) and a HiddenServicePort mapping the onion’s port 80 to a local web server port (for example, 127.0.0.1:8080), ensure the directory is owned by the debian‑tor user with chmod 700, restart Tor, then read the generated hostname file to obtain the .onion address such as dhevt6e4rtgbtr3jh53xrpwmgtilkah6nyjujocsspssrsexc7omxhid.onion. The web server (e.g., nginx) is configured to listen only on the specified localhost port, with a server_name matching the onion address, and no TLS, HTTP/2, or QUIC settings are needed because Tor already handles encryption. (source: primary)
Because static site generators often bake the base URL into absolute links, a clearnet build would cause links to point back to the regular domain even when served over Tor. The solution is to build a second copy of the site with the onion address as the base URL (using a command like hugo --minify --baseURL='http://<onion>/'). The author’s deployment pipeline automates this by building both the clearnet and Tor versions on each push and rsyncing each to its own web root, keeping the two versions in sync without manual work. (source: primary)