### Tor Install tor. On Linux you can probably install a package called `tor` and be done, otherwise [compile it][tor]. On Windows download this binary: . Find your [torrc][torrc]. On Linux it is probably at `/etc/tor/torrc`. On Windows it might be somewhere in `%appdata%\tor` or something. #### Background A Tor hidden service is a regular TCP service that you talk to via a 6-hop circuit created inside the Tor network. You initiate the creation of this circuit by providing tor with the service's hostname, a long base32-encoded string ending in ".onion". This hostname is derived from a pair of cryptographic keys generated by the hidden service operator. A TCP service is a computer program you interact with over the Internet using TCP. TCP is a low-level networking protocol that sits above IP and creates a reliable "connection" between two computers. It handles the reordering and resending of packets that are shuffled or lost in transit on the Internet, such that the bytes sent from one computer will match exactly the bytes that arrive at the other (barring active interference (MITM), TCP is not secure). Getting reliability for free greatly simplifies the creation of network applications, and for this reason and other historical reasons TCP is ubiquitous on the Internet to this day. Many applications use TCP, for example IRC, SSH, RTMP, Minecraft, and HTTP (like us here). #### Configuration We are now going to create a hidden service. We need to give tor a directory to store the keys it generates, the location of our existing TCP service, and a virtual TCP port to listen on. There are two directives we have to add to our torrc: `HiddenServiceDir` and `HiddenServicePort`. (There is a commented-out section in the default torrc for hidden services, you may wish to make these changes there.) ##### `HiddenServiceDir` `HiddenServiceDir` sets the directory for the hidden service's keys and other data. You could choose any directory, but you should make sure it's owned by the user the tor daemon runs as, and the directory's permissions are `0700/drwx------` (`rwx` for user, `---` for group and everyone else). If you configure this in a way tor doesn't like, tor will kill itself and complain in one of these two ways: ``` Jun 11 23:21:17.000 [warn] Directory /home/n9k/projects/anonstream/hidden_service cannot be read: Permission denied ``` ``` Jun 12 02:37:51.036 [warn] Permissions on directory /var/lib/tor/anonstream are too permissive. ``` The simplest option is to copy the examples provided in the torrc, on Linux that would probably be a directory inside `/var/lib/tor`, e.g. `HiddenServiceDir /var/lib/tor/anonstream`. tor will create this directory itself with the uid, gid, and permissions that it likes, which for me are these: ``` Access: (0700/drwx------) Uid: ( 42/ tor) Gid: ( 42/ tor) ``` ###### `HiddenServiceDir` troubleshooting If you created the directory yourself and gave it the wrong permissions or uid or gid, delete the directory and let tor create it itself, or do this: ``` # chown -R tor:tor /var/lib/tor/anonstream # chmod 0700 /var/lib/tor/anonstream # chmod 0600 /var/lib/tor/anonstream/* # chmod 0700 /var/lib/tor/anonstream/*/ ``` If the user and group `tor` do not exist, your tor daemon runs as some other user. There may be a `User` directive in your torrc or in a file included by your torrc, for example on Debian it's `User debian-tor`. This means that a tor process running as root will immediately drop privileges by switching to the user `debian-tor`. The user's primary group should have the same name, check like this as root: `# id debian-tor`. On Linux, if tor is already running you can see what user and group it is running as like this: ``` $ ps -C tor -o uid,gid,cmd UID GID CMD 42 42 tor --quiet --runasdaemon 0 $ cat /etc/passwd | grep :42: | cut -f 1 -d : # 42 is the UID here tor $ cat /etc/group | grep :42: | cut -f 1 -d : # 42 is the GID here tor ``` Alternatively you could specify a directory inside the cloned repository, e.g. `/home/delphine/Documents/anonstream/hidden_service` or something like that. This will only work if the tor daemon has `rwx` permissions on the directory and at least `r-x` permissions on all the directories above it. This is probably not the case for you since your home folder might have `0700/drwx------` permissions. If you installed tor as a package, the daemon probably runs as its own user (e.g. `debian-tor` on Debian, `tor` on Arch/Gentoo). If you want to figure this out yourself go ahead. I would advise just using `/var/lib/tor/anonstream` though. ##### `HiddenServicePort` Include this line verbatim directly below the `HiddenServiceDir` line: ``` HiddenServicePort 80 127.0.0.1:5051 ``` tor will listen for connections to our onion address at virtual port 80 (the conventional HTTP port), and it will forward traffic to the TCP service at 127.0.0.1:5051, which is our webserver. ##### Finish Example configuration: ``` HiddenServiceDir /var/lib/tor/anonstream HiddenServicePort 80 127.0.0.1:5051 ``` Reload tor to make it reread its torrc: `# pkill -HUP tor`. With systemd you can alternatively do `# systemctl reload tor`. If everything went well, the directory will have been created and your onion address will be in `$HIDDEN_SERVICE_DIR/hostname`. ### OBS Studio Install OBS Studio. If the autoconfiguration wizard prompts you to choose a third-party service, ignore it since we're not going to be using a third-party service. Click `Settings` and set these: * Advanced * Recording * Filename Formatting: `stream` * Overwrite if file exists: yes * Video * Output (Scaled) Resolution: `960x540` or lower, or whatever you want * Common FPS Values: any integer framerate (e.g. 30 or 60) * Output * Output Mode: `Advanced` * Recording: ``` +----------------------------+-------------------------------------+ | Field | Value | +============================+=====================================+ | Type | `Custom Output (FFmpeg)` | +----------------------------+-------------------------------------+ | FFmpeg Output Type | `Output to File` | +----------------------------+-------------------------------------+ | File path or URL | same as the `segments/directory` | | | option in config.toml, but make it | | | an absolute path | +----------------------------+-------------------------------------+ | Container Format | `hls` | +----------------------------+-------------------------------------+ | Muxer Settings (if any) | `hls_init_time=0 hls_time=2 ` | | | `hls_list_size=120 ` | | | `hls_flags=delete_segments ` | | | `hls_segment_type=fmp4` | +----------------------------+-------------------------------------+ | Video bitrate | `420 Kbps` or lower, or whatever | | | you want | +----------------------------+-------------------------------------+ | Keyframe interval (frames) | `framerate` * `hls_time`, e.g. for | | | 60fps and an `hls_time` of 2 | | | seconds, set this to 120 | +----------------------------+-------------------------------------+ | Video Encoder | libx264, or an H.264 hardware | | | encoder (e.g. `h264_nvenc` for | | | Nvidia, [see here][ffmpeg]) | +----------------------------+-------------------------------------+ | Audio Bitrate | `96 Kbps`, or whatever you want | +----------------------------+-------------------------------------+ | Audio Encoder | `aac` | +----------------------------+-------------------------------------+ ``` > *If this table looks garbled, read this file as plaintext or [click > here][plaintext] and scroll to the bottom.* To start streaming click `Start Recording`. When it is recording, segments older than four minutes will be regularly deleted, and when it stops recording the last four minutes worth of segments will remain the segments directory. (You can change the number of kept segments by modifying the `hls_list_size` option in the muxer settings.) When it is not recording, you can delete the files in the segments directory without consequence. Old segments will never be sent over the network even if they are not deleted. [tor]: https://gitlab.torproject.org/tpo/core/tor [torrc]: https://support.torproject.org/#tbb-editing-torrc [ffmpeg]: https://trac.ffmpeg.org/wiki/HWAccelIntro [plaintext]: https://git.076.ne.jp/ninya9k/anonstream/raw/branch/master/STREAMING.md