fix(tor): publish a node's inbound onion only while that node is local (#103)#759
Merged
Merged
Conversation
#103) With monero.mode or tari.mode set to remote the bundled node container never starts, but torrc still defined its inbound hidden service — so Tor published an onion address that accepted connections into nothing. Each node's HiddenService block moves out of the template and into the tor entrypoint, appended only when that node's compose profile is active. The gate is the profile list itself, passed through to the tor container from pithead's rendered .env, so it cannot drift from which nodes actually run. P2Pool's onion stays unconditional — p2pool always runs. pithead follows suit: provision_tor waits only for the onions that will exist, doctor reports a remote node's missing address as expected rather than a warning, and the "fully provisioned" guard keys off P2Pool's onion instead of Monero's. A stack first set up in remote mode has no address for that node, so provision_node_onions mints and captures it on the apply/upgrade that makes the node local — before the node container starts against it, since monerod templates anonymous-inbound from that value. Covered at tier 1 (torrc gating, provisioning by mode, doctor's report), tier 2 (the profile list reaches the tor service), and tier 3 (the live torrc matches the node mode). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…okup Ponytail review: same behaviour, half the lines. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Both callers take the default; speculative flexibility, cut on the ponytail pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
With
monero.modeortari.modeset toremote, the bundled node container never starts — butbuild/tor/torrc.templatestill defined that node's inbound hidden service, so Tor published an onion address that accepted connections into nothing.Each node's
HiddenServiceblock moves out of the template and intobuild/tor/entrypoint.sh, appended only when that node's compose profile is active. The gate is the profile list itself, passed to the tor container from pithead's rendered.env, so it cannot drift from which nodes actually run. P2Pool's onion stays unconditional — p2pool always runs.pithead side
provision_torwaits only for the onions that will exist (a remote node's hostname would never appear — 60s timeout, then a fatal error).doctorreports a remote node's missing address as expected, not a warning telling the operator to re-runsetup.provision_node_onionscovers the remote → local switch: a stack first set up in remote mode has no address for that node, so apply/upgrade recreate tor against the committed profiles, capture the freshly minted hostname, and re-render.envbefore the node container starts against it (monerod templatesanonymous-inboundfrom that value).Testing
tests/stack/run.sh): torrc gating on/off via theTORRC_TEMPLATEseam;provision_tor/provision_node_onionsby node mode; doctor's onion report in both modes. 1674 pass, 0 fail.tests/stack/test_compose.sh): the active profile list reaches the tor service, so the gate matches the running nodes. 73 pass.tests/integration/run.sh): the live torrc carries the Monero hidden service only in local mode — reads the torrc, not the hostname file, since a key minted by an earlier local scenario stays on disk.Docs
docs/configuration.md(both remote-node sections — the "inert leftover" sentence is gone, since it isn't one any more),docs/privacy.mdinbound section, CHANGELOG.make lintgreen (lint-protoneeds a Docker daemon, unavailable locally — CI covers it).🤖 Generated with Claude Code