cli.administration.inventory.onion package

Module contents

Node Tor v3 onion identity for the harness.

ensure_node_onion() pre-mints (or reuses) the node’s onion and returns its address, storing the authoritative hidden-service key files at the repo root. The svc-net-tor role copies those keys into the running daemon so it serves exactly that address; the inventory provisioner writes the address into applications.svc-net-tor.services.tor.node. The onion is a deploy-time input; there is no in-deploy minting (a random mint would not match the provisioned node).

cli.administration.inventory.onion.ensure_node_onion(base_dir: str | Path) → str

Mint (or reuse) the node onion identity and return its .onion address.

Dual-stack model: the node keeps its clearnet DOMAIN_PRIMARY; the node onion is an ADDITIVE address opted-in apps (services.tor.enabled) are also reachable under as <sub>.<node-onion> over Tor. Idempotent: an existing key at <base_dir>/.onion-identity/hs is reused so the address is stable across runs. The key files are the single source of truth — the svc-net-tor role copies them into the daemon so it serves exactly this address, and the inventory provisioner writes the returned address into applications.svc-net-tor.services.tor.node (no env indirection).

cli.administration.inventory.onion.identity_hs_dir(base_dir: str | Path) → Path

Authoritative hidden-service key dir (<base_dir>/.onion-identity/hs).

Single source of truth for the node’s onion identity: ensure_node_onion mints/reuses the key files here and the svc-net-tor role copies them into the running daemon. Lives outside anything the deploy regenerates and is mounted into the DiD at {playbook_dir}/.onion-identity/hs.