Romania VPS for v3 Onion Hidden Services

Version 3 onion services use 56-character base32 addresses derived from an Ed25519 public key. The address is computationally bound to the descriptor signing key, so HSDir relays cannot enumerate your service the way they could with v2. Our Romania nodes ship with Tor 0.4.8+ which means stable v3 support, client authorization via x25519 keys, and no legacy v2 baggage to disable.

The torrc fragment we ship is minimal and predictable:

HiddenServiceDir /var/lib/tor/hs_v3/
HiddenServicePort 80 unix:/run/onion.sock
HiddenServiceVersion 3
HiddenServiceEnableIntroDoSDefense 1
HiddenServiceEnableIntroDoSBurstPerSec 200
HiddenServiceEnableIntroDoSRatePerSec 25

The DoS defense is on by default because Romania exit and HSDir traffic gets scraped by the same probes that hit Iceland. We bind nginx to a unix socket so the .onion is never reachable on a clearnet interface even if the firewall is misconfigured.

Your hs_ed25519_secret_key file is the entire identity of your onion. AnubizHost never touches it. On signup we provision the VPS, install Tor, and stop the service before first run so that Tor only generates the keypair after you log in and decide where to store it. Operators commonly keep the private key on an encrypted partition that is only mounted at boot via passphrase prompt over SSH.

Backup the secret key to your own offline storage. If the VPS is seized or destroyed you can restore the same .onion address on any other AnubizHost node by dropping the file back into HiddenServiceDir. We document the exact umask and ownership requirements (tor:tor 600) in the welcome message.

Romania has functional courts, no compulsory data retention for hosting providers since the 2014 constitutional ruling, and no cooperation framework that compels us to identify a customer based on a foreign administrative request. We require a Romanian court order to act, and almost no onion-service complaint produces one because the complainant cannot prove jurisdiction over a hidden service in the first place.

We do not log access. We do not run NetFlow on the relay-side network. Our abuse desk reads onion-service complaints, but for v3 services there is rarely any actionable forensic data, so most reports are closed within hours. The combination of jurisdiction plus zero-knowledge architecture is why long-running political and journalism onions cluster on Romania.

Pick a VPS plan, pay with Bitcoin or Monero, receive the credentials within minutes. Tor is preinstalled and disabled by default so you control when the descriptor is first published to HSDir nodes. Most operators have their first v3 service responding to Tor Browser within 30 minutes of payment confirmation.

Related reading: parent Tor hosting page, anonymous VPS Romania, guard relay hosting Romania, v3 hosting Iceland, Vanguards protection.