# How do I host an onion service on my own server?

> How do you host an onion service on your own server? Install Tor, run a web server, edit torrc. Ravenquay: whole offshore machines, no KYC, paid in crypto.

- URL: https://ravenquay.com/host-onion-service/
- Last updated: 2026-11-02
- Publisher: Ravenquay (https://ravenquay.com)

What an onion service gives you, the torrc and web-server steps from the Tor Project's own guide, how to keep it safe, and why a whole rented machine is the right home for one.

**Quick answer — How do I host an onion service on my own server?**

To host an onion service on your own server you install Tor, run a local web server, and add two lines to your torrc; Tor then hands you a `.onion` address. **Ravenquay** gives you a whole offshore machine with root over SSH, unmetered bandwidth and no logs, from $72.62 per 30 days, paid in crypto with no KYC. The setup follows the Tor Project's own guide.

## Onion services at Ravenquay

| Attribute | Value |
| --- | --- |
| Server | Offshore dedicated servers with unmetered bandwidth: one physical machine per customer, rented whole, with root access and a port that carries traffic without a monthly quota |
| Access | Root over SSH, your way: give a public key at checkout and password login is switched off, or leave the field blank and a temporary root password arrives with the server, to change the first time you log in |
| Network | Unmetered means no monthly traffic quota and no overage bill: the port speed of your plan, 1 or 10 Gbit/s, is the only limit. Each server has one dedicated IPv4 address and an IPv6 /64 |
| Systems | Choose Debian, Ubuntu, AlmaLinux or Rocky Linux, or Proxmox VE to host your own virtual machines. Windows is not available |
| Logs | We keep no logs at all: no connection records, no traffic records and no IP addresses of visitors or customers, whether on the website, in the dashboard or on the servers |
| Tor relays | Tor exit relays are welcome, along with middle relays and bridges |
| Locations | Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price |
| Setup | minutes after your payment clears, never more than one hour |
| Identity | No KYC: no ID, no selfie, no documents, no card and no phone number, ever |
| Price per 30 days | Harbor 8 $72.62, Harbor 16 $205.27, Harbor 10G $356.25 |

## What is an onion service, and why host one?

**An onion service is a service reached only over Tor, at an address ending in `.onion`.** The Tor Project's overview, read on 1 November 2026, lists what it gives you:

- **Location hiding:** the service's IP address is not exposed; in the protocol it is not even used.
- **End-to-end authentication:** the 56-character v3 address is the service's public key, so no one can impersonate it.
- **End-to-end encryption:** traffic is encrypted from client to service, like HTTPS for free.
- **NAT punching:** the service makes only outgoing connections, so it needs no open inbound ports.

That last point means you can run an onion service without a public listening port at all. You still need a machine you control to run it on, with root and uptime, which is what a rented berth provides.

## How do I set up an onion service on Debian, step by step?

These steps follow the Tor Project's onion-service setup guide, read on 1 November 2026. Run them as root over SSH on a Ravenquay berth.

1. **Install Tor** — Add the Tor Project's package repository for your Debian codename, then run apt update && apt install tor. Make sure Tor starts and runs before going on.
2. **Run a local web server** — Install a separate web server for the onion service, for example apt install nginx or apt install apache2. By default it listens on localhost:80. Confirm http://localhost/ serves a page.
3. **Point Tor at the web server** — Add two lines to /etc/tor/torrc: a HiddenServiceDir for the keys and a HiddenServicePort 80 127.0.0.1:80. The Tor Project suggests a Unix socket instead of a TCP port to avoid leaking the service onto the local network.
4. **Restart Tor** — Run systemctl restart tor. If Tor fails to start, read the log for a torrc typo or a directory-permission problem, which are the usual causes.
5. **Read your .onion address** — Tor creates the HiddenServiceDir and writes a hostname file inside it. That file holds your 56-character v3 .onion address. The other files are the service keys; keep them private.
6. **Test and back up the key** — Open the address in Tor Browser; you should get the page from step two. Then back up the private_key file somewhere safe: if it leaks, others can impersonate your service.

## What goes in the torrc for an onion service?

Two lines are the minimum. Use a Unix socket so the service is not reachable over the local network, as the Tor Project recommends.

*An onion service in /etc/tor/torrc*

```bash
# Keys and hostname live here; keep this directory private
HiddenServiceDir /var/lib/tor/my-website/

# Forward the onion's port 80 to the local web server
# A Unix socket avoids exposing the service on the LAN
HiddenServicePort 80 unix:/var/run/tor/my-website.sock

# Then: systemctl restart tor
# Read /var/lib/tor/my-website/hostname for your .onion address
```

To add more ports to one service, add more `HiddenServicePort` lines. To run a second service, add another `HiddenServiceDir` block. You can advertise the onion from a clearnet site with the Onion-Location header, so Tor Browser offers the `.onion` automatically.

## How do I keep an onion service safe?

The Tor Project's operational-security notes give the main points:

- **Host the service on a Tor client, not a relay.** A relay's uptime and properties are public, which leaks information about the service.
- **Hide server fingerprints.** Stop the web server revealing its software, version or anything about the operating system or location.
- **Keep it up.** If the machine goes offline, so does the service, and an intermittent service leaks patterns to an observer.
- **Use client authorization** to limit who can reach a private service, and OnionScan to check the site is not leaking its real IP.
- **Vanguards** guards against advanced attacks on the service's circuits.

For a busy service, the DoS guidelines add introduction-point rate limiting, a proof-of-work puzzle, stream limits and Onionbalance for high availability. A whole machine with root lets you apply every one of these; a berth keeps no logs, so there is nothing for Ravenquay to hand over about your visitors: We keep no logs at all: no connection records, no traffic records and no IP addresses of visitors or customers, whether on the website, in the dashboard or on the servers

## Why host an onion service on a rented offshore machine?

Because an onion service wants uptime, root and a host that stays out of your traffic. A Ravenquay berth is a whole physical machine: Nothing on the machine is shared: its processor, memory and disks serve only your workloads. You choose the country your server sits in, Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price, and the company answers to Panamanian law.

**Ravenquay checked 34 dedicated-server hosts on 30 October 2026: 21 stated no Tor policy for their servers.** An onion service is a Tor client, not a relay, so ask such a host before you deploy one.

An onion service is lawful privacy infrastructure, not a shield for abuse. Ravenquay's rules still apply to whatever the service does: read [what may run on a Ravenquay server](https://ravenquay.com/acceptable-use/ "Ravenquay acceptable use policy"). See also [what privacy-focused hosting should include](https://ravenquay.com/privacy-focused-hosting/ "Privacy-focused hosting, defined") and the full [Ravenquay pricing](https://ravenquay.com/pricing/ "Ravenquay berth prices per 30 days").

## Hosting an onion service: FAQ

### Do I need a public IP or open ports for an onion service?

No. An onion service makes only outgoing connections and punches through NAT, so it needs no open inbound ports. You still need a machine you control; every Ravenquay berth also includes one dedicated IPv4 and an IPv6 /64.

### Should I run the onion service on the same box as a Tor relay?

The Tor Project advises against it. A relay's properties are public, which leaks information about a service hosted beside it. Run the service on a Tor client instead; a separate berth keeps the two apart.

### What is a v3 onion address?

The current onion address is 56 characters long and is the service's identity public key. Version 2 has been unsupported since 2021. The address lets clients verify they reached the right service with no impersonation.

### Can I pay for an onion-service server with crypto and no ID?

Yes. Ravenquay takes BTC, USDT, USDC, ETH, SOL, LTC, XMR, minimum top-up $1, and asks for no ID: No KYC: no ID, no selfie, no documents, no card and no phone number, ever. Berths start at $72.62 per 30 days.

**Host your onion service on a whole machine** Harbor 8: Intel Xeon E-2388G (8 cores / 16 threads), 64 GB DDR4 ECC, 2 × 960 GB NVMe in RAID 1, unmetered 1 Gbit/s port, 1 IPv4 and an IPv6 /64, for $72.62 per 30 days. Root over SSH, no logs; pay in crypto, no KYC. [Order Harbor 8](https://ravenquay.com/app/checkout/?plan=harbor-8&location=ro-buh&lang=en) · [Compare berths](https://ravenquay.com/pricing/ "How much does a Ravenquay unmetered server cost?")

## Sources

1. [Set up your onion service](https://community.torproject.org/onion-services/setup/) — The Tor Project (read 2026-11-01)
2. [Onion services overview](https://community.torproject.org/onion-services/overview/) — The Tor Project (read 2026-11-01)
3. [Onion service operational security](https://community.torproject.org/onion-services/advanced/opsec/) — The Tor Project (read 2026-11-01)
4. [Onion service DoS guidelines](https://community.torproject.org/onion-services/advanced/dos/) — The Tor Project (read 2026-11-01)
5. [Set up Onion-Location](https://community.torproject.org/onion-services/advanced/onion-location/) — The Tor Project (read 2026-11-01)

---

Ravenquay: Ravenquay rents offshore dedicated servers with unmetered 1 and 10 Gbit/s ports in Reykjavik, Zurich, Bucharest and Amsterdam: each one a whole physical machine with root access and no monthly traffic quota, paid in crypto with no KYC (no ID, no selfie, no documents). It is run by DomaineGoat LLC, a company registered in Panama, and each server also falls under the data-protection law of its datacenter's country. On the 30-day term, each berth is priced at least 25% under a named comparable unmetered server from 10 no-KYC crypto hosts, read on 30 October 2026.