Tor endpoint for HTTP API

[sr-gi]

At the moment we're offering the service over HTTP/HTTPS. For privacy reasons, it'll be good to allow the HTTP endpoint to be served over Tor. This includes:

• Adding a Tor option to both client and server so it can be run through Tor if set.
• Offer the API in a .onion if the config flag is set.
• Send request via Tor if flag is set.

[tee8z]

I am starting to work through this one, I'll let you know when I have something that might work & is ready for a review. Just to clarify, the goal here is to have the public & private APIs be running as hidden services with just a boolean flag in the configuration file needed to set it up?

[sr-gi]

Hi @tee8z

This should only apply to the public API.

Indeed, it should be configurable via a flag in the config file.

[mariocynicys]

I was looking into this issue and have found some possible tor implementations that could be used. IMO the best one for this task is libtor (arti will probably be better but it's not quite mature yet).
libtor won't require us to install a tor daemon on the system, and it is also cross platform, but will probably increase the build time so much since it statically builds a C tor daemon inside. Maybe it can be added as a feature in The Eye.

I will keep looking for some other candidate solutions for a little while. Wanted to know if you guys have any other crates in mind that can better deal with tor.

[mariocynicys]

For the client side we can use tor-stream, but I believe we won't need it, right?
Only the clients who are talking to the tower will need to send their requests via Tor?

[tee8z]

I have this code basically ready to go, just need to finish up the unit tests, using the https://crates.io/crates/torut crate as it just communicates with a tor daemon setup on the given server. With the libtor library it adds a dependency to 'openssl' which can make building the project much more difficult and I try to avoid adding that dependency when possible. I agree arti would be best once that is ready to be used.

[sr-gi]

Only the clients who are talking to the tower will need to send their requests via Tor?

Not sure I follow what you mean there.

[sr-gi]

I have this code basically ready to go, just need to finish up the unit tests, using the https://crates.io/crates/torut crate as it just communicates with a tor daemon setup on the given server. With the libtor library it adds a dependency to 'openssl' which can make building the project much more difficult and I try to avoid adding that dependency when possible. I agree arti would be best once that is ready to be used.

Exciting!

[mariocynicys]

Only the clients who are talking to the tower will need to send their requests via Tor?

Not sure I follow what you mean there.

Nvm that, I got confused. No need to tor_stream.

[tee8z]

I have a PR posted 'Tor endpoint http api', please let me know of any changes you would like me to make!