With Add v0.4.6, I’ve implemented messaging over the Tor network. This offers major advantages, especially if your ISP monitors your P2P connections and tries to track the IP addresses you communicate with, as Tor makes such tracking (almost) impossible. Please note that this is only relevant if you run your own bootstrap or relay server.
As always, this is not just a proof of concept and has undergone third-party auditing feel free to investigate the source code yourself. For instance, if you dig deeper, you’ll discover that while people commonly believe Signal uses post-quantum (PQ) cryptography to encrypt their user messages, they actually only use PQ for session key establishment, not for end-to-end message encryption…
Here’s the practical process to set up Tor hidden services for your existing bootstrap and relay servers:
Prerequisites
On each server (bootstrap + relays)
apt-get install tor
systemctl enable --now tor
Step 1: Configure Tor Hidden Service
On each server, edit /etc/tor/torrc:
Relay server (port 8765)
HiddenServiceDir /var/lib/tor/hidden_service_relay/
HiddenServicePort 8765 127.0.0.1:8765Bootstrap server (port 9001)
HiddenServiceDir /var/lib/tor/hidden_service_bootstrap/
HiddenServicePort 9001 127.0.0.1:9001
Restart Tor:
systemctl restart tor
Step 2: Get the .onion Addresses
On relay server
cat /var/lib/tor/hidden_service_relay/hostname
Output: abc123def456ghij.onionOn bootstrap server
cat /var/lib/tor/hidden_service_bootstrap/hostname
Output: xyz789uvw012rstu.onion
Step 3: Start Servers with .onion Advertised URLs
Relay:
add-relay
–host 127.0.0.1
–port 8765
–advertised-url wss://abc123def456ghij.onion/ws
–tls-cert /path/cert.pem
–tls-key /path/key.pem
Bootstrap:
add-bootstrap
–host 127.0.0.1
–port 9001
–advertised-url wss://xyz789uvw012rstu.onion/ws
–tls-cert /path/cert.pem
–tls-key /path/key.pem
Step 4: Update Client Configuration
Clients need the .onion addresses. Options:
A: Environment Variables (recommended)
export ADD_BOOTSTRAP=“wss://xyz789uvw012rstu.onion/ws”
export ADD_RELAY=“wss://abc123def456ghij.onion/ws”
add --tor send “message”
B: CLI Flags
add --tor --tor-socks-host 127.0.0.1 --tor-socks-port 9050
–seed wss://xyz789uvw012rstu.onion/ws
–relay wss://abc123def456ghij.onion/ws
send “message”
Important Notes
| Issue | Solution |
|---|---|
| TLS certs for .onion | Use self-signed certs; clients must disable cert verification or pin the self-signed cert |
| SRV records don’t work | DNS SRV (_add-relay._tcp) only returns clearnet; .onion must be via config/env |
| Mixed mode | Run both clearnet + .onion simultaneously: keep existing wss:// for non-Tor clients |
| Key persistence | Backup /var/lib/tor/hidden_service_*/private_key - losing it = new .onion address |
Quick Backup Script
bash
#!/bin/bash
Run on each server to backup hidden service keys
tar -czf tor-keys-backup-$(date +%Y%m%d).tar.gz
/var/lib/tor/hidden_service_/private_key
/var/lib/tor/hidden_service_/hostname
Client-Side TLS Verification for .onion
Since .onion addresses use self-signed certs, clients connecting via Tor need to either:
- Disable cert verification (not recommended for production)
- Pin the self-signed cert via TOFU (first connect pins it)
The existing tls_pin_cache.json mechanism handles this automatically on first connect.
Summary: Set up Tor hidden service on each server → get .onion hostname → restart server with --advertised-url wss:///ws → configure clients with the .onion addresses via env vars or flags.