0

For a number of reasons not critical to my question, I've decided that my website, currently on the clear web, would serve my users more effectively as an .onion site.

I'm still researching Tor basics and how to bring this to fruition. But there's one aspect I can't seem to wrap my head around:

Q. In the Tor model, what plays the role of CDN (content delivery network, e.g. Cloudlare) ?

My website has a fairly large amount of static HTML/CSS/JS/PNG files. They rarely change. The script embedded in the .js files makes AJAX calls to the site to retrieve data and update the DOM. So the caching of static elements is pretty crucial. I'm using Cloudflare for that task right now.

In the Tor model, what layer/entity would do the caching of static content? I can tell from the explanatory diagrams, that there's an ultimate 'exit node' that would contact my site on port 443 (https). But would it contact my origin server directly without going through a caching layer? If so, presumably I could add additional IIS servers to pick up the load but even then, is there a way to load balance it? In other words, is there a way to point MyDomain.onion to an array of servers instead of just one?

I'm confused as to how to distribute the load if there's no CDN in place. Please enlighten me.

Thanks,

Festus

Improve this question
4
  • If you’re running a hidden service, there is no exit relay that makes requests to your http server (which would go against the idea of a “hidden” service). Instead the tor process running on your server tunnels requests from Tor clients to your http server. Since you’re using Cloudflare, you must not need anonymity for your server, so there are some optimizations you can make. It might be helpful to look into how Facebook and other large sites run their hidden services.
    – Steve
    Mar 21, 2019 at 4:09
  • That's correct. For the server that hosts the static HTML/CSS/JS/PNG files, no anonymity is needed. I usually host these on low end rented servers overseas, paid for with Bitcoin. I'd like to be able to cache this static content. Now, the AJAX servers, on the other hand, host critical data and I'd like to anonymize their location using Tor. Caching/Cloudflare isn't necessary here. On a related note: Does the last Tor link in the chain (i.e. the 'exit node') know that it's the exit node? Does the operator of that machine know that it's relaying to the ultimate origin server of the content?
    – Festus Martingale
    Mar 21, 2019 at 15:07
  • When accessing a non-onion website, the exit relay knows it’s an exit and what final server it’s connecting to. This isn’t the case for onion services since there is no exit relay. Can you just keep your static content at the domain it is now, but only move the critical data to the onion service? Then your webpages on your onion service will make third-party requests to your static content?
    – Steve
    Mar 21, 2019 at 15:23
  • That's an intriguing suggestion. It makes sense and I'll have to think about that more. If there's no exit relay for .onion services, how is it that the gov't keeps shutting down and seizing servers for Tor sites (AlphaBay / Silk Road comes to mind but there have been others). I had always assumed this was possible due to some weakness at that last hop (exit node) to the origin server where the site is hosted. But you're saying there is no exit node for a hidden service?
    – Festus Martingale
    Mar 21, 2019 at 15:51

1 Answer 1

Reset to default
1

I came with the similar question. For your case you can just tune caching right but even without this the Cache Validation with ETag is already enabled in any modern web server. But if you want to use CDN for public libraries like jquery then the https://jsdelivr.net/ from CloudFlare already supports onion network. You need to include the script or style tag as usual but when you open the site on the TorBrowser each file in a response will have a header:

alt-svc: h2="cflar....onion:443"; ma=86400; persist=1

And the TorBrowser will establish a connection over a Tor network but using 4 hops instead of 6 (Single Onion Service). This is described in the Introducing the Cloudflare Onion Service.

Please note that for a better security you must include script with integrity attribute.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .