# How do I host an onion site on a VPS?

> Host an onion site on a VPS with 2 torrc lines and nginx on Debian 13 or Ubuntu 24.04. Dusk, 2 GB RAM, costs $5.25 a month on 12 months.

- URL: https://gloamport.com/guides/how-to-host-an-onion-site/
- Last updated: 2026-11-10
- Publisher: Gloamport (https://gloamport.com)

An onion service needs no open web port and no domain name. Tor creates the address from a key stored on your VPS.

**Quick answer — How do I host an onion site on a VPS?**

To host an onion site on a VPS, install tor and a web server, add HiddenServiceDir and HiddenServicePort lines to /etc/tor/torrc, restart tor, and read your address in the hostname file. A Gloamport Dusk plan, 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic, runs it for $5.25 a month on 12 months.

## What are the parts of an onion site on a VPS?

| Part | Value in this guide |
| --- | --- |
| Plan | Dusk: 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic |
| Price | $5.25 a month on 12 months, $10.50 on 1 month |
| Packages | `tor` and `nginx` (Apache works the same way) |
| Key directory | `/var/lib/tor/my-website/` |
| Torrc keys | `HiddenServiceDir`, `HiddenServicePort` |
| Address file | `/var/lib/tor/my-website/hostname` |
| Backend | nginx on 127.0.0.1, port 80 |

*Prices checked on November 10, 2026.*

Config keys from the Tor Project onion service setup guide and the Tor manual.

## What is an onion service, and why host one?

An onion service is a website that is reachable only through Tor and whose address is derived from its own key. Visitors reach it without a domain registrar or a public IP, and the traffic is encrypted end to end. For the full definition see [What is an onion service, and how does it work?](https://gloamport.com/what-is-an-onion-service/ "What is an onion service, and how does it work?").

According to Gloamport's survey of 10 November 2026, 10 of the 49 hosting entries we read offer an onion address of their own. A VPS lets you run one for your own project instead.

## Which Gloamport plan hosts an onion site?

Dusk is a fit: Gloamport lists it for "A VPN plus a Tor relay or an onion site". A small static site or a light app runs well on 1 vCPU and 2 GB of RAM, with 40 GB NVMe of storage. Linux only: Debian, Ubuntu, AlmaLinux and Rocky Linux images. No Windows.

The order takes a plan, a coin and an optional email: An order asks for three things: a plan, a coin and, only if you want one, an email address. There is no name field, no postal address, no phone number, no card and no identity document anywhere in the process. The wider case for hosting without handing over identity documents is in [Where can I buy a VPS with no KYC?](https://gloamport.com/vps-no-kyc/ "Where can I buy a VPS with no KYC?").

## How do I host an onion site on a VPS, step by step?

Six steps from a blank server to an address you can open in Tor Browser.

1. **Install tor and a web server** — Run apt update, then apt install tor nginx. Confirm that http://localhost/ serves a page from the VPS.
2. **Bind the web server to localhost** — Make nginx listen on 127.0.0.1 only, so the site is reached through Tor and not through the public IP.
3. **Add the onion service to the torrc** — Add a HiddenServiceDir and a HiddenServicePort line to /etc/tor/torrc.
4. **Restart tor** — Run systemctl restart tor. Tor creates the directory on startup if it does not exist.
5. **Read your address** — Print the hostname file in the HiddenServiceDir. Add http:// in front and open it in Tor Browser.
6. **Back up the key** — The other files in that directory are your keys. Keep them private, and copy the private key somewhere safe if the address matters.

## How do I configure tor to publish the site?

Two torrc lines publish the site. `HiddenServiceDir` names the directory where Tor stores the keys and the `hostname` file, and `HiddenServicePort` maps a virtual port to a local target. The Tor manual says each hidden service must have its own directory and that, by default, a port maps to the same port on 127.0.0.1 over TCP.

*Install and check the web server*

```bash
apt update
apt install tor nginx
curl -I http://localhost/
```

*Lines to add to /etc/tor/torrc*

```text
HiddenServiceDir /var/lib/tor/my-website/
HiddenServicePort 80 127.0.0.1:80
```

*Restart and read the address*

```bash
systemctl restart tor
cat /var/lib/tor/my-website/hostname
```

## Should I use a Unix socket instead of a TCP port?

A Unix socket is safer, because the backend then never listens on a network port at all. The Tor Project guide recommends it to avoid exposing the service on your local network. The manual lists `unix:` followed by a path as an accepted target.

*torrc with a Unix socket target*

```text
HiddenServiceDir /var/lib/tor/my-website/
HiddenServicePort 80 unix:/var/run/tor/my-website.sock
```

> **Guard the key directory** The HiddenServiceDir must be readable and writeable by the user that runs Tor. Anyone who obtains the key files can impersonate your service, so never copy them into a public repository or a ticket.

## How do I know the onion site works?

Open the address from the `hostname` file in Tor Browser. If tor fails to start, the Tor Project names typos in the torrc and wrong directory permissions as the usual causes; read the log with `journalctl -u tor`.

Then secure the machine behind it. [How do I harden SSH on a new VPS?](https://gloamport.com/guides/how-to-harden-ssh-on-a-vps/ "How do I harden SSH on a new VPS?") comes first, and [How do I run a Tor relay on a VPS?](https://gloamport.com/guides/how-to-run-a-tor-relay-on-a-vps/ "How do I run a Tor relay on a VPS?") is a good second project on the same Dusk, priced on [the pricing page](https://gloamport.com/pricing/ "How much does a Gloamport VPS cost?"). A v3 address stays the same as long as you keep the key files, even if you reinstall the web server.

**In summary**

- Install `tor` and `nginx`, then confirm the local page loads.
- `HiddenServiceDir` stores the keys and the `hostname` file.
- `HiddenServicePort 80 127.0.0.1:80` forwards onion port 80 to the local server.
- A Unix socket target avoids exposing the backend on the local network.
- The key files let anyone impersonate the site: keep them private and backed up.
- Dusk (1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic) costs $5.25 a month on 12 months.

## Hosting an onion site on a VPS: common questions

### Do I need a domain name for an onion site?

No. The address comes from the key Tor creates in the HiddenServiceDir and is written to the hostname file.

### Which onion version does Tor use?

The Tor manual says versions 2 and 3 are supported and that the default is 3. Version 3 is the one the Tor Project guide describes.

### Can I run more than one onion site?

Yes. Add another HiddenServiceDir line for each new service; its HiddenServicePort lines apply to the most recent HiddenServiceDir above them.

### What if I lose the key files?

The address is gone with them. The Tor Project suggests keeping a copy of the private key file in a safe place for any long-lived service.

### Is Dusk big enough?

Gloamport describes Dusk as fitting "A VPN plus a Tor relay or an onion site". For a static site, 2 GB of RAM is ample.

## Sources

1. [Set up your own Onion Service](https://community.torproject.org/onion-services/setup/) — The Tor Project (checked 2026-11-10)
2. [Tor manual (HiddenServiceDir, HiddenServicePort, HiddenServiceVersion)](https://2019.www.torproject.org/docs/tor-manual.html.en) — The Tor Project (checked 2026-11-10)

---

Gloamport: Gloamport is a VPS provider that sells Linux KVM servers with no KYC, ordered with an account number and paid in crypto, Monero first; it is operated by DomaineGoat LLC, a Panama-registered company. An order asks for a plan, a coin and, only if you want one, an email address: no name, no postal address, no phone and no identity document. On the 12-month term, each plan is priced at least 25% under a named comparable plan from a survey of 38 no-KYC crypto VPS hosts read on 10 November 2026.