---
# nocheck: playwright-service-flag — Tor Browser users need third-party assets
# served first-party; deploying tor therefore always deploys the mirror.
# nocheck: dynamic-flag — hard dependency: every tor deployment serves the mirror.
mirror:
bond: 1
enabled: true
shared: true
tor: # nocheck: category-modes
modes:
compose:
enabled: true
swarm:
enabled: true
# nocheck: default-placement-manager node onion ingress: host-published SOCKS/DNS/Trans ports and the HiddenService loopback forward must live on the stack host
placement: manager
bond: 0.5
enabled: true
shared: true
image: debian
version: 13.7-slim
custom: true
name: tor
node: ""
use_entry_guards: true
flavor: public
forwards:
ssh: true
http: true
egress:
enabled: true
timeout_multipliers:
chutney: 2
public: 5
ports:
local:
socks: 9050
trans: 9040
dns: 9053
onion:
# nocheck: onion-flag a SOCKS port anyone can reach is an open proxy, and SocksPolicy cannot refuse it because the forward arrives from the node's own address
socks: false
# nocheck: onion-flag the transparent port takes its destination from the caller's routing, which an onion client does not share
trans: false
# nocheck: onion-flag publishing the resolver would answer recursive queries for anyone holding the onion address
dns: false
min_storage: 100MB
cpus: "1.0"
mem_reservation: 128m
mem_limit: 256m
pids_limit: 128
lifecycle: beta
docs:
bond: 0.5
enabled: "{{ 'web-app-docs' in group_names }}"
shared: "{{ 'web-app-docs' in group_names }}"
