i'm trying to set up a hidden service for an existing webserver that is behind a reverse proxy and i'm unable to get it work. i had no problems creating hidden services on servers with no reverse proxy so i thought that could be the issue. the reverse proxy mainly just takes care of https redirect.

following the tor project instructions: http://3gldbgtv5e4god56.onion/onion-services/setup/

torsocks curl http://3gldbgtv5e4god56.onion from the server works, so tor is working.

i tried letting tor connect to either the reverse proxy or the backend, matching the torrc HiddenServicePort entry to a virtual host on either server. when i load the onion address in a browser, i get this error:

Invalid Onionsite Address

[x] Browser | Network | Onionsite

The provided onionsite address is invalid. Please check that you entered it correctly.

Details: 0xF6 — The provided .onion address is invalid. This error is returned due to one of the following reasons: the address checksum doesn't match, the ed25519 public key is invalid, or the encoding is invalid.

in the tor/notices.log i see this error:

[warn] Could not mmap file "/var/lib/tor/cached-microdescs": Permission denied

[err] Couldn't map file that we just wrote to /var/lib/tor/cached-microdescs

right after Bootstrapped 0%: Starting, but then it finishes bootstrapping with no further problems.

i'm not sure if either error message is reliably pointing to my issue.


  • can i test my new address any other way? [surely its fine?]

  • can i test that tor is able to receive incoming connections?

  • wd this error maybe show up if the address was ok but not correctly configured to connect to a service?

  • are any extra steps involved when configuring a hidden service with a reverse proxy?

  • could it be a ports issue if my server is already running a clearnet service?

  • is there a likely 'translation' of this error message?

i also just tried setting up a new hidden service from scratch, and then a new server block on the reverse proxy server, but now just pointing to a new webroot with a dummy index.html (which i can access locally with, and i still get the same error.


  • i'm installing LTS tor from debian stable. after installing i have enabled/run/restarted it with systemctl. i've not set 'run as daemon'

  • permissions on /var/lib/tor are drwx--S--- 4 debian-tor debian-tor, and on the cached-microdescs they are -rw------- 1 debian-tor debian-tor

EDIT 2 as per steve's request for more detail:

  • i'm not running tor from the commandline, no. just systemctl enable/restart

  • i'm not in a container. i am on an arm box, no vm.

  • torrc looks like

Log notice file /var/log/tor/notices.log
HiddenServiceDir /var/lib/tor/onion/
HiddenServicePort 80
  • the server block i set up looks like
server {
    server_name xyxyxyxzzzz.onion;
    root /var/www/onion;
    access_log off;

    index index.html index.html index.nginx-debian.html;    
  • i got my onion address as recommended by the docs: sudo cat /var/lib/tor/onion/hostname.

  • i don't actually know what mmapping a file is. the permissions for dirs + files are defaults on fresh tor install.


  • Tor version
  • an onion my tor created (random/not configured in the webserver): uj23izqtsljsbsqrn2qfyvxl6t22az5nthhneufwjnutajd4pe2c43yd.onion
  • also, if i create a random onion with no webserver config on a different box, i don't get the same error. if the torrc conf is for an open port (eg 80), i get a 404, and if i put a dead/closed port in the torrc file, i get the standard firefox "Unable to connect" error.
  • Deleted my answer since it doesn't seem relevant anymore. So there still isn't enough information here for me to understand what's going wrong. Why can't you mmap a file, are you run in a container or restricted environment? You're not running tor on the command line right, only through the systemd service? Can you post all uncommented lines in your torrc file? Can you post the server block you're using on your reverse proxy? Where are you getting the onion URL from? The Tor Browser says it's not in the correct format.
    – Steve
    Jun 12, 2020 at 21:39
  • re the mmap error, system logs reported apparmor was blocking tor from doing what it wanted. i disabled apparmor, restarted tor, got no log errors, but still no dice w the hidden service.
    – mooseface
    Jun 12, 2020 at 23:20
  • I'm pretty sure you're doing everything right, so I'm not sure what's going wrong. There are no other errors/warnings in the log? What's the output of tor --version? And can you post an onion address (either the one you're trying to set up or a new one) that causes the browser to give the "Invalid Onionsite Address" error?
    – Steve
    Jun 13, 2020 at 4:02
  • i suspect i have something v basic messed up, which will be embarrassing when i find out. but it is also v helpful to confirm that i'm at least try to set it more or less in the right way. @Steve
    – mooseface
    Jun 13, 2020 at 19:24
  • So your onion address is not a valid onion address. I made a small python script you can test here if you'd like. If you comment out your address, you can see that the example address works fine. I'm really not sure why tor would give you an invalid address. Maybe try deleting your onion service (delete the keys from your hidden service directory) and let tor choose new ones? If the new one is also incorrect, then this problem is very strange.
    – Steve
    Jun 13, 2020 at 23:48


You must log in to answer this question.

Browse other questions tagged .