I'm currently running a clearweb service accessible at https://www.mydomain.com.
The site links to content, both static (e.g. images, jquery libraries), and dynamic (e.g. ajax calls) on other servers in the same domain. So, for example, the site may retrieve data from:
ajax.mydomain.com static.mydomain.com etc.
It's become apparent that for my own protection, and the protection of my users, we'd be better served if the site were made available via Tor as a .onion site instead of hosting it on the clearweb.
Here's the issue though:
It appears that the Tor protocol has no concept of a "subdomain" -- which leaves me with a couple of options for handling the multi-server access issue:
(1) Use three private keys
In this scheme, I'd have three private keys and hostnames:
abcd.onion (formerly www.mydomain.com)
efgh.onion (formerly ajax.mydomain.com)
ijkj.onion (formerly static.mydomain.com)
I could make this work but I do have a couple of concerns:
First off, Tor has no way of knowing that these three domains are owned by the same entity so presumably cookie sharing between domains would be an issue, since a cookie from abcd.onion would be treated as "third party" to efgh.onion.
Also, wouldn't Tor have to spin up a totally different route for each of the .onion domains? If so, wouldn't this significantly increase load time ?
(2) Use one domain, but three separate ports
In this scheme, I'd have only one domain but three ports:
abcd.onion:80 (formerly www.mydomain.com)
abcd.onion:81 (formerly ajax.mydomain.com)
abcd.onion:82 (formerly static.mydomain.com)
tor.exe and torrc file would be housed on a single/dedicated VM and configured to route ports 80, 81, and 82 to the appropriate servers on the VLAN.
I'm leaning toward option #2 since there's only one private key to deal with but is that the optimal solution for a single website that requires access to multiple .onion servers ?