loohive/vault-over-tor repository overview

⁠ Vault-over-Tor (maintained by LOOHIVE)

⁠🚀 The Solution

Vault-over-Tor is an open-source project maintained by the LOOHIVE Infrastructure Team that orchestrates HashiCorp Vault for the darknet. It is designed for organizations and individuals who need to manage highly sensitive credentials across distributed networks without the cost or complexity of traditional VPNs, leased lines, or public-facing load balancers.

By utilizing the community Tor Onion Sidecar, this suite exposes the Vault API exclusively through a Version 3 Onion Service.

⁠�️ What to Expect (Live Output)

When you launch the container, the automated entrypoint automatically establishes your secure circuit and generates your unique fallback identity. You will see this banner in your docker logs:

🧅 Starting Tor to establish Hidden Service circuit...
⏳ Waiting for .onion address generation...

***************************************************
  🚀 VAULT-OVER-TOR IS ACTIVE
  📍 PUBLIC ONION: http://v2c3...f4g5.onion
  🔒 SECURE ONION: https://v2c3...f4g5.onion
  🔐 ACCESS YOUR SECRETS SECURELY AT THESE URLS
***************************************************

2026-01-16 12:00:00 INFO supervisord started with pid 1

⁠�🛡️ Why Vault-over-Tor?

⁠🛠️ Rapid Deployment (Docker Compose)

Simply add this to your docker-compose.yml to get started. By default, it exposes Vault on port 80 of the host for easy access.

services:
  vault-service:
    image: loohive/vault-over-tor:latest
    container_name: vault-service
    ports:
      # Use VAULT_PORT env to change the host port (Default: 80)
      - "${VAULT_PORT:-80}:8200"
    volumes:
      - ./data:/vault/file
      - ./keys:/var/lib/tor/hidden_service
    cap_add:
      - IPC_LOCK
    restart: always

⁠🎯 Professional Use Cases

⁠1. Multi-Cloud Secret Synchronization

Manage secrets for clusters running on AWS, Azure, and a private home lab simultaneously. All workers connect to the central Vault via the .onion address, ensuring a unified security policy regardless of the hosting provider.

⁠2. Secure IoT Command & Control

Deploy field devices (Raspberry Pis, industrial sensors) that need to rotate their own API keys. Since these devices often live behind cellular (LTE) networks with no public IP, Vault-over-Tor provides the only reliable way to fetch secrets remotely.

⁠3. The "Last Stand" Backup

Even if your primary corporate VPN is compromised or taken down, your Vault remains accessible via the Tor network, providing a "break-glass" emergency access to critical infrastructure passwords.

⁠🧪 Proof of Concept: Automated Remote Access

You don't need a browser to use this. You can interact with your secret store programmatically from anywhere in the world using this Python snippet.

⁠test-connection.py (Remote Secret Fetcher)

import requests
import urllib3

# Suppress warnings for self-signed certificates
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# CONFIGURATION
# Use the HTTPS URL for maximum security (Internal SSL Termination)
ONION_URL = "https://your_secret_address.onion/v1/secret/data/test"
ROOT_TOKEN = "your_vault_root_token"

# PROXY CONFIG (Must have Tor running locally, e.g., 'loohive/tor:latest')
proxies = {
    'http': 'socks5h://127.0.0.1:9050',
    'https': 'socks5h://127.0.0.1:9050'
}

def get_secret():
    headers = {"X-Vault-Token": ROOT_TOKEN}
    try:
        # verify=False is required for the self-signed certificate generated by the container
        response = requests.get(ONION_URL, headers=headers, proxies=proxies, verify=False)
        data = response.json()
        print(f"✅ Success! Secret retrieved: {data['data']['data']}")
    except Exception as e:
        print(f"❌ Connection failed: {e}")

if __name__ == "__main__":
    get_secret()

⁠⚙️ How it Works (Under the Hood)

1. Vault Instance: Runs in a locked-down container with IPC_LOCK enabled to prevent memory from being swapped to disk (security best practice).
2. Encrypted Volume: All data is stored in the ./data directory using AES-GCM-256 encryption.
3. Tor Gate (Internal Port Mapping): The container runs a Tor Hidden Service that maps Port 80 (Onion) to Port 8200 (Vault). This allows you to access Vault using standard URLs without appending :8200.
4. Health-Sync: The tunnel does not open until Vault passes its internal readiness probe.

⁠🔒 Security Best Practices Checklist

When deploying Vault-over-Tor in a production environment, ensure you follow these steps:

1. Seal the Vault: Access via .onion is encrypted, but always use vault operator seal if you suspect the physical host is compromised.
2. External Keys: Keep your ./keys directory (the Onion ID) on a separate encrypted volume if possible.
3. Firewall: Ensure your host machine allows no inbound traffic to port 8200 from the public internet. Only the internal Docker network should bridge these.

⁠🤝 Support & Maintenance

Developed by the LOOHIVE Infrastructure Team.

• Website: loohive.com⁠
• Documentation: GitHub: loohive/vault-over-tor⁠
• Support: [email protected]⁠

⁠⚖️ Legal Disclaimer

HashiCorp Vault is a trademark of HashiCorp, Inc. Tor is a trademark of The Tor Project, Inc. This project is a community-driven implementation and is not an official product of either organization.