I am planning on creating a new Tor service. It will be a website made in PHP/Laravel/Symfony, a database like MySQL and there will be a payment system for Monero transactions.

I'm already familiar on how to host a website and how to deploy it as a onion service. The question I have is if the measurements I will be taking are sufficient to hide my identity.

The laptop

I will buy a dedicated laptop and install Linux on it together with the required development tools. After that the system proxy will be configured to run through Tor by default. So all connections are going through Tor.

However, the laptop will be airgapped the whole time during development. If I need to go online to e.g deploy it, everything will go over Tor. I will never use this laptop for anything personal or login to a personal account.

When the service is deployed. The laptop will be destroyed and thrown away.

Cleaning the project files

I will remove the meta-data from all files and images including in the project using exiftool.

Purchasing the VPS

To put the project online I will search for a off-shore VPS-company which accept Bitcoin. To avoid monthly transactions I will buy the VPS for a long amount of time. I will download the required Bitcoin on the dedicated laptop and delete it again when the transaction for the VPS is done.

Purchasing the VPS will be done using Tor and of course with a temporary-email.

Handling Monero

My service will accept Monero transactions. I will download a Monero wallet on my dedicated wallet and memorize the 25 word-seed by memory before deleting the wallet again. I will receive transactions in my wallet but will not access the wallet for a long time.

My service also needs to use Monero's JSON-RPC to validate a transaction. Is it okay to call JSON-RPC directly from my VPS?

Maintaining and administrating the service My intention is to publish the service on my VPS and to not access it again. The laptop used for development will be destroyed immediately after deployment. So if in a worst-case scenario a update is required, I will buy a new laptop, download the files from the VPS, update them and upload it back to the VPS.

Some administration/support must be delivered on the service. However, I will log in as few times as possible and the only support I will deliver is by answering basic chat messages. No files or URLs allowed in the chat.

Is this sufficient? Are these measurements sufficient to hide my identity to deploy a Tor Service anonymously? Are there other things I should consider?

1 Answer 1


Looks sufficient, and you should run a minimal Monero node on your VPS to fire the JSON-RPC requests locally for increased anonymity

  • Thanks for your answer. And running the Monero node on the same VPS as my Tor service won't result in the Monero node/transactions broadcasting the public IP of my Tor service? And should my own Monero wallet also be hosted on that VPS?
    – beghui
    Commented Dec 7, 2023 at 2:26
  • no it won't, because the transaction can be signed anywhere in a globe and broadcasted into the blockchain network via any node. Also there's no information about the node that has actually broadcasted the transaction
    – Alexey Vesnin
    Commented Dec 8, 2023 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .