The simplest approach is building a static React application and serving it with Nginx through Tor. This avoids running Node.js on the server, reducing the attack surface and resource usage:
# Build a static React app
npx create-react-app my-onion-site
cd my-onion-site
# Set the homepage for relative paths
# package.json:
# "homepage": "."
# Build static assets
npm run build
# Copy to web root
cp -r build/* /var/www/onion/# Nginx config for React SPA on Tor
server {
listen 127.0.0.1:8080;
root /var/www/onion;
index index.html;
# SPA routing - serve index.html for all paths
location / {
try_files $uri $uri/ /index.html;
}
# Cache static assets aggressively
location ~* \.(js|css|png|jpg|gif|ico|woff2|svg)$ {
expires 1y;
add_header Cache-Control "public, immutable";
}
# Gzip for faster Tor delivery
gzip on;
gzip_types text/css application/javascript application/json image/svg+xml;
gzip_min_length 256;
access_log off;
error_log /dev/null;
}Set "homepage": "." in package.json to generate relative asset paths instead of absolute ones. This ensures the app works correctly regardless of the .onion URL structure. Enable aggressive caching for hashed assets - React's build process generates unique filenames for each build, so long cache lifetimes are safe.