Replace remote with local repo

2026-04-26 22:28:40 -07:00
parent 04d64fb993
commit e7c9da944e
57 changed files with 3658 additions and 3971 deletions
--- a/scripts/generate-onion-config.cjs
+++ b/scripts/generate-onion-config.cjs
@@ -3,7 +3,6 @@
 * Reads scripts/onion-nodes.json and writes:
 *   lib/onionRoutes.generated.ts
 *   tor/cyberlux-nodes.conf
- *   nginx/cyberlux-onion-servers.inc
 *   scripts/generated/tor-dirs.txt
 *   scripts/generated/onion-labels.tsv
 *   scripts/generated/onion-port-range.txt
@@ -17,231 +16,63 @@ const REPO = path.join(__dirname, "..");
 const jsonPath = path.join(__dirname, "onion-nodes.json");
 const data = JSON.parse(fs.readFileSync(jsonPath, "utf8"));
 const nodes = data.nodes;
-
-function dedicatedNginx(port, entry) {
-  const h = JSON.stringify(entry);
-  return `
-# ${entry} @ ${port}
-server {
-    listen 127.0.0.1:${port};
-    server_name _;
-
-    include /etc/nginx/cyberlux-server-common.inc;
-    proxy_hide_header X-Powered-By;
-
-    client_max_body_size 25m;
-
-    location /checkout {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header X-Cyberlux-Node ${h};
-    }
-    location /api/ {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header X-Cyberlux-Node ${h};
-    }
-    location /forum {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header X-Cyberlux-Node ${h};
-    }
-    location /exchange {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header X-Cyberlux-Node ${h};
-    }
-
-    location / {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header X-Cyberlux-Node ${h};
-        proxy_read_timeout 86400;
-    }
-}
-`;
-}
-
-function wikiNginx(port) {
-  return `
-# wiki @ ${port}
-server {
-    listen 127.0.0.1:${port};
-    server_name _;
-
-    include /etc/nginx/cyberlux-server-common.inc;
-    proxy_hide_header X-Powered-By;
-
-    client_max_body_size 25m;
-
-    location /checkout {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header X-Cyberlux-Node "wiki";
-    }
-    location /api/ {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header X-Cyberlux-Node "wiki";
-    }
-    location /forum {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header X-Cyberlux-Node "wiki";
-    }
-    location /exchange {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header X-Cyberlux-Node "wiki";
-    }
-
-    location / {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header X-Cyberlux-Node "wiki";
-        proxy_read_timeout 86400;
-    }
-}
-`;
-}
-
-function wNginx(port) {
-  return `
-# shadow nodes (/w/[slug]) @ ${port}
-server {
-    listen 127.0.0.1:${port};
-    server_name _;
-
-    include /etc/nginx/cyberlux-server-common.inc;
-    proxy_hide_header X-Powered-By;
-
-    client_max_body_size 25m;
-
-    location /checkout {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header X-Cyberlux-Node "w";
-    }
-    location /api/ {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header X-Cyberlux-Node "w";
-    }
-    location /forum {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header X-Cyberlux-Node "w";
-    }
-    location /exchange {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header X-Cyberlux-Node "w";
-    }
-
-    location / {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto http;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header X-Cyberlux-Node "w";
-        proxy_read_timeout 86400;
-    }
-}
-`;
-}
+const TOR_INTRO_DOS_RATE_PER_SEC = 12;
+const TOR_INTRO_DOS_BURST_PER_SEC = 80;
+const KNOWN_APP_ENTRIES = [
+  "hub",
+  "wiki",
+  "w",
+  "account",
+  "arb-academy",
+  "awards",
+  "barter",
+  "chatter",
+  "checkout",
+  "comparison",
+  "conspiracies",
+  "darknet-atlas",
+  "dashboard",
+  "directory",
+  "drop-box",
+  "drops",
+  "easter-eggs",
+  "exchange",
+  "forum",
+  "game",
+  "hidden-wiki",
+  "inner-circle",
+  "links",
+  "market",
+  "messages",
+  "mixer",
+  "presswire",
+  "raffle",
+  "red-room",
+  "reviews",
+  "sanctuary",
+  "search",
+  "secret-layer",
+  "security-analysis",
+  "sign-in",
+  "sign-up",
+  "support",
+  "syndicate",
+  "testimonials",
+  "trees",
+  "trust",
+  "vault",
+  "vendors",
+  "wallets",
+  "webring",
+];

 function torBlock(dir, port) {
  return `
 HiddenServiceDir /var/lib/tor/${dir}
 HiddenServicePort 80 127.0.0.1:${port}
 HiddenServiceEnableIntroDoSDefense 1
-HiddenServiceEnableIntroDoSRatePerSec 25
-HiddenServiceEnableIntroDoSBurstPerSec 200`;
+HiddenServiceEnableIntroDoSRatePerSec ${TOR_INTRO_DOS_RATE_PER_SEC}
+HiddenServiceEnableIntroDoSBurstPerSec ${TOR_INTRO_DOS_BURST_PER_SEC}`;
 }

 const ports = nodes.map((n) => n.port);
@@ -253,7 +84,11 @@ for (const n of nodes) {
  if (n.kind === "dedicated") dedicated[n.entry] = n.path;
 }

-const uniqueEntries = ["hub", "wiki", "w", ...Object.keys(dedicated).sort()];
+const uniqueEntries = Array.from(new Set([...KNOWN_APP_ENTRIES, ...Object.keys(dedicated)])).sort((a, b) => {
+  if (a === "hub") return -1;
+  if (b === "hub") return 1;
+  return a.localeCompare(b);
+});

 const drLines = Object.keys(dedicated)
  .sort()
@@ -273,17 +108,11 @@ ${drLines}
 } as const;
 `;

-// fix typo "generon" -> "generate"
-let nginxInc = "# CyberLux — generated onion vhosts (included from nginx.example.conf)\n";
 let torConf =
  "# CyberLux — generated v3 onion services (include from torrc)\n#\n# Tor ≥ 0.4.7: DoS lines follow each HiddenServiceDir/Port pair.\n";

 for (const n of nodes) {
  torConf += torBlock(n.torDir, n.port);
-  if (n.kind === "hub") continue;
-  if (n.kind === "dedicated") nginxInc += dedicatedNginx(n.port, n.entry);
-  else if (n.kind === "wiki") nginxInc += wikiNginx(n.port);
-  else if (n.kind === "w") nginxInc += wNginx(n.port);
 }

 const genDir = path.join(REPO, "scripts", "generated");
@@ -306,8 +135,9 @@ fs.writeFileSync(path.join(genDir, "onion-port-range.txt"), `${minP} ${maxP}\n`)

 fs.writeFileSync(path.join(REPO, "lib", "onionRoutes.generated.ts"), ts);
 fs.writeFileSync(path.join(REPO, "tor", "cyberlux-nodes.conf"), torConf.trim() + "\n");
-fs.writeFileSync(path.join(REPO, "nginx", "cyberlux-onion-servers.inc"), nginxInc.trim() + "\n");

+const onionLabel = nodes.length === 1 ? "onion" : "onions";
+const loopbackLabel = minP === maxP ? `${minP}` : `${minP}–${maxP}`;
 console.log(
-  `[generate-onion-config] ${nodes.length} onions, nginx loopback ${minP}–${maxP}, TS entries: ${uniqueEntries.length}`,
+  `[generate-onion-config] ${nodes.length} ${onionLabel}, nginx loopback ${loopbackLabel}, TS entries: ${uniqueEntries.length}`,
 );
--- a/scripts/generated/onion-labels.tsv
+++ b/scripts/generated/onion-labels.tsv
@@ -1,43 +1 @@
 cyberlux	Hub — full storefront
-cyberlux_forum	forum — / → /forum
-cyberlux_exchange	exchange — / → /exchange
-cyberlux_wiki	Wiki — / → /hidden-wiki
-cyberlux_market	market — / → /market
-cyberlux_barter	barter — / → /barter
-cyberlux_chatter	chatter — / → /chatter
-cyberlux_search	search — / → /search
-cyberlux_syndicate	syndicate — / → /syndicate
-cyberlux_arb_academy	arb-academy — / → /arb-academy
-cyberlux_reviews	reviews — / → /reviews
-cyberlux_trust	trust — / → /trust
-cyberlux_vault	vault — / → /vault
-cyberlux_messages	messages — / → /messages
-cyberlux_drop_box	drop-box — / → /drop-box
-cyberlux_easter_eggs	easter-eggs — / → /easter-eggs
-cyberlux_links	links — / → /links
-cyberlux_red_room	red-room — / → /red-room
-cyberlux_drops	drops — / → /drops
-cyberlux_inner_circle	inner-circle — / → /inner-circle
-cyberlux_comparison	comparison — / → /comparison
-cyberlux_testimonials	testimonials — / → /testimonials
-cyberlux_wallets	wallets — / → /wallets
-cyberlux_support	support — / → /support
-cyberlux_darknet_atlas	darknet-atlas — / → /darknet-atlas
-cyberlux_security_analysis	security-analysis — / → /security-analysis
-cyberlux_mixer	mixer — / → /mixer
-cyberlux_secret_layer	secret-layer — / → /secret-layer
-cyberlux_trees	trees — / → /trees
-cyberlux_presswire	presswire — / → /presswire
-cyberlux_awards	awards — / → /awards
-cyberlux_raffle	raffle — / → /raffle
-cyberlux_game	game — / → /game
-cyberlux_webring	webring — / → /webring
-cyberlux_conspiracies	conspiracies — / → /conspiracies
-cyberlux_sanctuary	sanctuary — / → /sanctuary
-cyberlux_dashboard	dashboard — / → /dashboard
-cyberlux_checkout	checkout — / → /checkout
-cyberlux_vendors	vendors — / → /vendors
-cyberlux_sign_in	sign-in — / → /sign-in
-cyberlux_sign_up	sign-up — / → /sign-up
-cyberlux_account	account — / → /account
-cyberlux_w	Shadow nodes — / → /syndicate, /x → /w/x
--- a/scripts/generated/onion-port-range.txt
+++ b/scripts/generated/onion-port-range.txt
@@ -1 +1 @@
-8080 8122
+8080 8080
--- a/scripts/generated/tor-dirs.txt
+++ b/scripts/generated/tor-dirs.txt
@@ -1,43 +1 @@
 cyberlux
-cyberlux_forum
-cyberlux_exchange
-cyberlux_wiki
-cyberlux_market
-cyberlux_barter
-cyberlux_chatter
-cyberlux_search
-cyberlux_syndicate
-cyberlux_arb_academy
-cyberlux_reviews
-cyberlux_trust
-cyberlux_vault
-cyberlux_messages
-cyberlux_drop_box
-cyberlux_easter_eggs
-cyberlux_links
-cyberlux_red_room
-cyberlux_drops
-cyberlux_inner_circle
-cyberlux_comparison
-cyberlux_testimonials
-cyberlux_wallets
-cyberlux_support
-cyberlux_darknet_atlas
-cyberlux_security_analysis
-cyberlux_mixer
-cyberlux_secret_layer
-cyberlux_trees
-cyberlux_presswire
-cyberlux_awards
-cyberlux_raffle
-cyberlux_game
-cyberlux_webring
-cyberlux_conspiracies
-cyberlux_sanctuary
-cyberlux_dashboard
-cyberlux_checkout
-cyberlux_vendors
-cyberlux_sign_in
-cyberlux_sign_up
-cyberlux_account
-cyberlux_w
--- a/scripts/install-tor-onion.sh
+++ b/scripts/install-tor-onion.sh
@@ -43,7 +43,7 @@ start_tor() {

 node "${REPO}/scripts/generate-onion-config.cjs"

-mkdir -p /etc/tor /etc/nginx/sites-available /etc/nginx/sites-enabled
+mkdir -p /etc/tor /etc/nginx/conf.d /etc/nginx/sites-available /etc/nginx/sites-enabled
 touch "${TORRC}"

 tor_changed=0
@@ -63,10 +63,10 @@ if ! grep -qF "${TOR_INCLUDE}" "${TORRC}"; then
  tor_changed=1
 fi

-if install_if_changed "${REPO}/nginx/cyberlux-server-common.inc" /etc/nginx/cyberlux-server-common.inc 0644; then
+if install_if_changed "${REPO}/nginx/cyberlux-ddos-zones.conf" /etc/nginx/conf.d/cyberlux-ddos-zones.conf 0644; then
  nginx_changed=1
 fi
-if install_if_changed "${REPO}/nginx/cyberlux-onion-servers.inc" /etc/nginx/cyberlux-onion-servers.inc 0644; then
+if install_if_changed "${REPO}/nginx/cyberlux-server-common.inc" /etc/nginx/cyberlux-server-common.inc 0644; then
  nginx_changed=1
 fi
 if install_if_changed "${REPO}/nginx.example.conf" /etc/nginx/sites-available/cyberlux-onion 0644; then
--- a/scripts/install-vanity-onion-key.sh
+++ b/scripts/install-vanity-onion-key.sh
@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+# Install a mkp224o-generated v3 key directory into the CyberLux HiddenServiceDir and restart Tor.
+# Run with sudo after vanity-onion-mine.sh has produced a folder named *.onion under the output path.
+#
+#   sudo bash scripts/install-vanity-onion-key.sh /path/to/var/vanity-mine
+#   sudo bash scripts/install-vanity-onion-key.sh /path/to/specificXXXX.onion
+#
+# If the path is a parent with several *.onion children, one is chosen automatically
+# (default: first in lexicographic order). Override with:
+#   CYBERLUX_VANITY_PICK=latest  — use the directory with the newest mtime
+#   CYBERLUX_VANITY_PICK=first   — same as default (first sorted A–Z)
+# Or pass a direct path to a single ... .onion folder.
+#
+set -euo pipefail
+[[ "${EUID}" -eq 0 ]] || { echo "Run as root (sudo)."; exit 1; }
+
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+TOR_DIRS_FILE="${REPO}/scripts/generated/tor-dirs.txt"
+ARG="${1:-}"
+
+if [[ -z "${ARG}" ]]; then
+  echo "Usage: sudo bash $0 <vanity_out_dir|path_to_name.onion_dir>"
+  exit 1
+fi
+
+# If ARG is relative, prefer REPO/ARG (so `var/vanity-mine` works from any cwd when using this repo).
+if [[ "${ARG}" != /* && -d "${REPO}/${ARG}" ]]; then
+  ARG="${REPO}/${ARG}"
+fi
+
+if [[ ! -f "${TOR_DIRS_FILE}" ]]; then
+  echo "Missing ${TOR_DIRS_FILE}. Run: cd ${REPO} && node scripts/generate-onion-config.cjs"
+  exit 1
+fi
+
+# Resolve single torDir (CyberLux uses "cyberlux" in onion-nodes.json)
+TOR_DIR_NAME="$(head -1 "${TOR_DIRS_FILE}" | tr -d '\r\n')"
+if [[ -z "${TOR_DIR_NAME}" ]]; then
+  echo "Empty ${TOR_DIRS_FILE}"
+  exit 1
+fi
+
+HS_ROOT="/var/lib/tor/${TOR_DIR_NAME}"
+KEY_SRC=""
+
+if [[ -d "${ARG}" ]]; then
+  if [[ -f "${ARG}/hs_ed25519_secret_key" ]]; then
+    KEY_SRC="${ARG}"
+  else
+    # Pick a *.onion child (one or many)
+    mapfile -t kids < <(find "${ARG}" -maxdepth 1 -type d -name '*.onion' 2>/dev/null | sort)
+    if [[ "${#kids[@]}" -eq 1 ]]; then
+      KEY_SRC="${kids[0]}"
+    elif [[ "${#kids[@]}" -eq 0 ]]; then
+      echo "No subdirectory matching *.onion under ${ARG} and no key at top level."
+      exit 1
+    else
+      pick="${CYBERLUX_VANITY_PICK:-first}"
+      case "${pick}" in
+        first)
+          KEY_SRC="${kids[0]}"
+          echo "[*] ${#kids[@]} *.onion key dirs; using first (lexicographic): ${KEY_SRC}"
+          ;;
+        latest|newest)
+          latest=""
+          latest_m=0
+          for d in "${kids[@]}"; do
+            m="$(stat -c %Y "${d}" 2>/dev/null || echo 0)"
+            if (( m >= latest_m )); then
+              latest_m="${m}"
+              latest="${d}"
+            fi
+          done
+          KEY_SRC="${latest}"
+          echo "[*] ${#kids[@]} *.onion key dirs; using latest mtime: ${KEY_SRC}"
+          ;;
+        *)
+          echo "Unknown CYBERLUX_VANITY_PICK=${pick} (use first or latest)."
+          exit 1
+          ;;
+      esac
+    fi
+  fi
+else
+  echo "Not a directory: ${ARG}"
+  exit 1
+fi
+
+if [[ ! -f "${KEY_SRC}/hs_ed25519_secret_key" ]]; then
+  echo "No hs_ed25519_secret_key in ${KEY_SRC}"
+  exit 1
+fi
+
+TOR_USER=""
+for u in debian-tor tor _tor; do
+  if id -u "${u}" &>/dev/null; then
+    TOR_USER="${u}"
+    break
+  fi
+done
+if [[ -z "${TOR_USER}" ]]; then
+  echo "No Tor system user (tried debian-tor, tor, _tor). Install Tor."
+  exit 1
+fi
+
+TS="$(date +%s)"
+if [[ -d "${HS_ROOT}" ]]; then
+  echo "[*] Preserving current service dir as ${HS_ROOT}.stale.${TS}"
+  mv "${HS_ROOT}" "${HS_ROOT}.stale.${TS}"
+fi
+
+mkdir -p "${HS_ROOT}"
+shopt -s dotglob nullglob
+for item in "${KEY_SRC}"/*; do
+  base="$(basename "${item}")"
+  [[ "${base}" == "." || "${base}" == ".." ]] && continue
+  cp -a "${item}" "${HS_ROOT}/"
+done
+shopt -u dotglob nullglob
+
+chown -R "${TOR_USER}:${TOR_USER}" "${HS_ROOT}"
+chmod -R u+rwX,og-rwx "${HS_ROOT}"
+chmod 0700 "${HS_ROOT}"
+
+restart_tor() {
+  systemctl restart tor@default.service 2>/dev/null || systemctl restart tor
+}
+
+echo "[*] Installed key material into ${HS_ROOT} (onion: $(tr -d '\n' < "${HS_ROOT}/hostname" 2>/dev/null || echo '?'))"
+restart_tor
+
+if [[ -f "${REPO}/scripts/export-onion-urls.sh" ]]; then
+  bash "${REPO}/scripts/export-onion-urls.sh" || true
+fi
+if [[ -f "${REPO}/scripts/backup-onion-keys.sh" ]]; then
+  bash "${REPO}/scripts/backup-onion-keys.sh" || true
+fi
+
+echo "[*] Done. Open: http://$(tr -d '\n' < "${HS_ROOT}/hostname")  (in Tor Browser)"
+echo "[*] Old keys (if any): ${HS_ROOT}.stale.${TS}"
--- a/scripts/mkp224o-build.sh
+++ b/scripts/mkp224o-build.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Build cathugger/mkp224o (Tor v3 vanity .onion key generator) into vendor/mkp224o/mkp224o.
+# Requires: git, make, gcc or clang, autoconf, pkg-config, libsodium-dev (Debian: libsodium-dev)
+#
+#   bash scripts/mkp224o-build.sh
+#
+set -euo pipefail
+
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+VEND="${REPO}/vendor/mkp224o"
+BIN="${VEND}/mkp224o"
+
+if [[ -x "${BIN}" ]]; then
+  echo "Already built: ${BIN}"
+  exit 0
+fi
+
+if ! command -v git >/dev/null 2>&1; then
+  echo "Install git and retry."
+  exit 1
+fi
+
+mkdir -p "${REPO}/vendor"
+if [[ ! -d "${VEND}/.git" ]]; then
+  echo "[*] Cloning mkp224o..."
+  git clone --depth 1 https://github.com/cathugger/mkp224o.git "${VEND}"
+fi
+
+cd "${VEND}"
+if [[ ! -f "./configure" ]]; then
+  if [[ -f "./autogen.sh" ]]; then
+    echo "[*] autogen.sh..."
+    ./autogen.sh
+  else
+    echo "No configure/autogen in ${VEND}"
+    exit 1
+  fi
+fi
+
+if [[ ! -f "./Makefile" ]]; then
+  echo "[*] configure..."
+  # Prefer AMD64 fast curve implementation when available
+  if ./configure --help 2>/dev/null | grep -q 'enable-amd64-64-24k'; then
+    ./configure --enable-amd64-64-24k
+  else
+    ./configure
+  fi
+fi
+
+echo "[*] make -j \$(nproc)..."
+make -j"$(nproc)"
+
+if [[ ! -x "${BIN}" ]]; then
+  echo "Build failed: ${BIN} not executable"
+  exit 1
+fi
+
+echo "Built: ${BIN}"
+echo "Mine a prefix: bash ${REPO}/scripts/vanity-onion-mine.sh <prefix>"
--- a/scripts/onion-nodes.json
+++ b/scripts/onion-nodes.json
@@ -1,47 +1,5 @@
 {
  "nodes": [
-    { "torDir": "cyberlux", "port": 8080, "kind": "hub" },
-    { "torDir": "cyberlux_forum", "port": 8081, "kind": "dedicated", "entry": "forum", "path": "/forum" },
-    { "torDir": "cyberlux_exchange", "port": 8082, "kind": "dedicated", "entry": "exchange", "path": "/exchange" },
-    { "torDir": "cyberlux_wiki", "port": 8083, "kind": "wiki" },
-    { "torDir": "cyberlux_market", "port": 8084, "kind": "dedicated", "entry": "market", "path": "/market" },
-    { "torDir": "cyberlux_barter", "port": 8085, "kind": "dedicated", "entry": "barter", "path": "/barter" },
-    { "torDir": "cyberlux_chatter", "port": 8086, "kind": "dedicated", "entry": "chatter", "path": "/chatter" },
-    { "torDir": "cyberlux_search", "port": 8087, "kind": "dedicated", "entry": "search", "path": "/search" },
-    { "torDir": "cyberlux_syndicate", "port": 8088, "kind": "dedicated", "entry": "syndicate", "path": "/syndicate" },
-    { "torDir": "cyberlux_arb_academy", "port": 8089, "kind": "dedicated", "entry": "arb-academy", "path": "/arb-academy" },
-    { "torDir": "cyberlux_reviews", "port": 8090, "kind": "dedicated", "entry": "reviews", "path": "/reviews" },
-    { "torDir": "cyberlux_trust", "port": 8091, "kind": "dedicated", "entry": "trust", "path": "/trust" },
-    { "torDir": "cyberlux_vault", "port": 8092, "kind": "dedicated", "entry": "vault", "path": "/vault" },
-    { "torDir": "cyberlux_messages", "port": 8093, "kind": "dedicated", "entry": "messages", "path": "/messages" },
-    { "torDir": "cyberlux_drop_box", "port": 8094, "kind": "dedicated", "entry": "drop-box", "path": "/drop-box" },
-    { "torDir": "cyberlux_easter_eggs", "port": 8095, "kind": "dedicated", "entry": "easter-eggs", "path": "/easter-eggs" },
-    { "torDir": "cyberlux_links", "port": 8096, "kind": "dedicated", "entry": "links", "path": "/links" },
-    { "torDir": "cyberlux_red_room", "port": 8097, "kind": "dedicated", "entry": "red-room", "path": "/red-room" },
-    { "torDir": "cyberlux_drops", "port": 8098, "kind": "dedicated", "entry": "drops", "path": "/drops" },
-    { "torDir": "cyberlux_inner_circle", "port": 8099, "kind": "dedicated", "entry": "inner-circle", "path": "/inner-circle" },
-    { "torDir": "cyberlux_comparison", "port": 8100, "kind": "dedicated", "entry": "comparison", "path": "/comparison" },
-    { "torDir": "cyberlux_testimonials", "port": 8101, "kind": "dedicated", "entry": "testimonials", "path": "/testimonials" },
-    { "torDir": "cyberlux_wallets", "port": 8102, "kind": "dedicated", "entry": "wallets", "path": "/wallets" },
-    { "torDir": "cyberlux_support", "port": 8103, "kind": "dedicated", "entry": "support", "path": "/support" },
-    { "torDir": "cyberlux_darknet_atlas", "port": 8104, "kind": "dedicated", "entry": "darknet-atlas", "path": "/darknet-atlas" },
-    { "torDir": "cyberlux_security_analysis", "port": 8105, "kind": "dedicated", "entry": "security-analysis", "path": "/security-analysis" },
-    { "torDir": "cyberlux_mixer", "port": 8106, "kind": "dedicated", "entry": "mixer", "path": "/mixer" },
-    { "torDir": "cyberlux_secret_layer", "port": 8107, "kind": "dedicated", "entry": "secret-layer", "path": "/secret-layer" },
-    { "torDir": "cyberlux_trees", "port": 8108, "kind": "dedicated", "entry": "trees", "path": "/trees" },
-    { "torDir": "cyberlux_presswire", "port": 8109, "kind": "dedicated", "entry": "presswire", "path": "/presswire" },
-    { "torDir": "cyberlux_awards", "port": 8110, "kind": "dedicated", "entry": "awards", "path": "/awards" },
-    { "torDir": "cyberlux_raffle", "port": 8111, "kind": "dedicated", "entry": "raffle", "path": "/raffle" },
-    { "torDir": "cyberlux_game", "port": 8112, "kind": "dedicated", "entry": "game", "path": "/game" },
-    { "torDir": "cyberlux_webring", "port": 8113, "kind": "dedicated", "entry": "webring", "path": "/webring" },
-    { "torDir": "cyberlux_conspiracies", "port": 8114, "kind": "dedicated", "entry": "conspiracies", "path": "/conspiracies" },
-    { "torDir": "cyberlux_sanctuary", "port": 8115, "kind": "dedicated", "entry": "sanctuary", "path": "/sanctuary" },
-    { "torDir": "cyberlux_dashboard", "port": 8116, "kind": "dedicated", "entry": "dashboard", "path": "/dashboard" },
-    { "torDir": "cyberlux_checkout", "port": 8117, "kind": "dedicated", "entry": "checkout", "path": "/checkout" },
-    { "torDir": "cyberlux_vendors", "port": 8118, "kind": "dedicated", "entry": "vendors", "path": "/vendors" },
-    { "torDir": "cyberlux_sign_in", "port": 8119, "kind": "dedicated", "entry": "sign-in", "path": "/sign-in" },
-    { "torDir": "cyberlux_sign_up", "port": 8120, "kind": "dedicated", "entry": "sign-up", "path": "/sign-up" },
-    { "torDir": "cyberlux_account", "port": 8121, "kind": "dedicated", "entry": "account", "path": "/account" },
-    { "torDir": "cyberlux_w", "port": 8122, "kind": "w" }
+    { "torDir": "cyberlux", "port": 8080, "kind": "hub" }
  ]
 }
--- a/scripts/onion-status.cjs
+++ b/scripts/onion-status.cjs
@@ -124,7 +124,7 @@ async function main() {
    console.log(`✗ ${bad} loopback vhost(s) did not return OK HTTP — ensure: systemctl status nginx tor; systemctl status cyberlux`);
    process.exit(1);
  }
-  console.log("✓ All loopback nginx vhosts responded (Tor .onion forwarding uses these ports).");
+  console.log("✓ All configured loopback nginx vhosts responded (Tor .onion forwarding uses these ports).");
  console.log("  To test via the Tor network use Tor Browser (not curl from clearnet).");
  process.exit(0);
 }
--- a/scripts/vanity-onion-mine.sh
+++ b/scripts/vanity-onion-mine.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Brute-force a Tor v3 .onion whose address starts with PREFIX (base32: a–z, 2–7).
+# Longer prefixes take exponentially more CPU time. Run on a strong machine; be patient.
+#
+#   bash scripts/mkp224o-build.sh
+#   bash scripts/vanity-onion-mine.sh cyberl
+#   sudo bash scripts/install-vanity-onion-key.sh var/vanity-mine
+#
+# Env:
+#   CYBERLUX_MKP224O       — path to mkp224o binary (default: vendor/mkp224o/mkp224o)
+#   CYBERLUX_VANITY_OUT   — output directory (default: repo var/vanity-mine)
+#   CYBERLUX_MKP224O_DOCKER=1 — use Docker image instead of local binary
+#
+set -euo pipefail
+
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+PREFIX="${1:-}"
+
+if [[ -z "${PREFIX}" ]]; then
+  echo "Usage: $0 <prefix>"
+  echo "Example: $0 cyberl   (8 chars: expect long run; 4–6 is more practical on one PC)"
+  echo "Onion v3 hostnames use base32: letters a–z and digits 2–7 only (no 0,1,8,9)."
+  exit 1
+fi
+
+if ! [[ "${PREFIX}" =~ ^[a-z2-7]+$ ]]; then
+  echo "Invalid prefix: use only a–z and 2–7 (Tor onion base32)."
+  exit 1
+fi
+
+OUT_DIR="${CYBERLUX_VANITY_OUT:-${REPO}/var/vanity-mine}"
+mkdir -p "${OUT_DIR}"
+
+if [[ "${CYBERLUX_MKP224O_DOCKER:-0}" == "1" ]]; then
+  echo "[*] Mining with Docker (ghcr.io/cathugger/mkp224o:master) → ${OUT_DIR}"
+  # -s = print stats every 10s; last arg is the base32 filter
+  exec docker run --rm -it -v "${OUT_DIR}:/keys" ghcr.io/cathugger/mkp224o:master -d /keys -s "${PREFIX}"
+fi
+
+MKP="${CYBERLUX_MKP224O:-${REPO}/vendor/mkp224o/mkp224o}"
+if [[ ! -x "${MKP}" ]]; then
+  echo "Missing ${MKP}. Build first:"
+  echo "  bash ${REPO}/scripts/mkp224o-build.sh"
+  echo "Or set CYBERLUX_MKP224O_DOCKER=1 and re-run this script."
+  exit 1
+fi
+
+echo "[*] Mining (Ctrl+C to stop). Output: ${OUT_DIR}/"
+echo "[*] Statistics (-s) enabled. First match appears as a new directory ending in .onion"
+"${MKP}" -d "${OUT_DIR}" -s "${PREFIX}"
--- a/scripts/verify.cjs
+++ b/scripts/verify.cjs
@@ -20,7 +20,7 @@ try {
  run("TypeScript (tsc --noEmit)", "npx tsc --noEmit");
  run(
    "bash syntax (start.sh, install, backup, restore, systemd, health)",
-    "bash -n start.sh && bash -n scripts/install-tor-onion.sh && bash -n scripts/install-systemd.sh && bash -n scripts/health-check-stack.sh && bash -n scripts/list-onion-urls.sh && bash -n scripts/export-onion-urls.sh && bash -n scripts/diagnose-onion-stack.sh && bash -n scripts/backup-onion-keys.sh && bash -n scripts/restore-onion-keys.sh",
+    "bash -n start.sh && bash -n scripts/install-tor-onion.sh && bash -n scripts/install-systemd.sh && bash -n scripts/health-check-stack.sh && bash -n scripts/list-onion-urls.sh && bash -n scripts/export-onion-urls.sh && bash -n scripts/diagnose-onion-stack.sh && bash -n scripts/backup-onion-keys.sh && bash -n scripts/restore-onion-keys.sh && bash -n scripts/mkp224o-build.sh && bash -n scripts/vanity-onion-mine.sh && bash -n scripts/install-vanity-onion-key.sh",
  );
  run("node syntax (onion-status.cjs)", "node --check scripts/onion-status.cjs");
  run("Next.js production build", "npm run build");
@@ -1 +1 @@
 8122
 8080