You should have all your dot-onions to be forward-and-back resolvable via DNS/resolver on your NGinx machine. Use
/etc/hosts and 127.0.0.[2-xxx] addresses for it on dedicated localhost/loopback interfaces. It's simple, secure and very fuckup-proof. I can provide you with configs if you need.
UPDATE: config files and HOWTO
/etc/network/interfaces you should replace
lo loopback string with this block:
auto lo lo:0 lo:1 lo:2
iface lo inet loopback
iface lo:0 inet static
iface lo:1 inet static
iface lo:2 inet static
you can add more if you wish. Next, in
/etc/hosts use :
and use your webserver to bind by-ip and by dedicated-per-vhost user your HS virtual hosts. In firewall use any kind of stuff you prefer to block by IP and by user any communications except 127.0.0.1 <-> 127.0.0.X to prevent any network leaks possible.
If you're using non-local HS setup - it's OK and it's quite obvious in case of opening "an entry point" for existing server in Tor network(like Facebook did it for it's website) - then you can consider using local ISC Bind setup with reverse and forward lookups. The purpose is *to make sure that hs1.onion resolves via system libs, not the cmdline tools you're used to lookup, because they're using DNS queries explicitly. The desired result is like this:
perl -MSocket -le '$a=shift; $x=gethostbyname $a; print inet_ntoa($x);' hs1.onion into 127.0.0.2
perl -MSocket -le '$a=inet_aton(shift); $_=gethostbyaddr $a, AF_INET; print' 127.0.0.2 returns ns1.onion.
Some checklist for localhost-names:
- Check NSS switch like this:
cat /etc/nsswitch.conf | grep "^hosts:" and make sure
files is set first. If not, edit it and in line starting with "hosts:" put it on a first place.
- Fix/check host.conf like this
cat /etc/host.conf and add string
order hosts,bind if missing or put
hosts at the first place right after the
order. It's one string too.