Simple setup, indoor Wap acting as CAPman manager outdoor Wap is managed by indoor one (makes making changes easier if things go wrong). Both just bridge to the ISPs router which also has 6Ghz ax WiFi. House is a old farm house with walls over 80cm thick in some parts so they needed more than one AP.

I built this for my own setup and figured the people here might find it interesting, so I'm sharing rather than pitching.

What it is

tor-gateway is a Kubernetes operator that exposes in-cluster Services as Tor v3 hidden services using the upstream Gateway API. You apply a Gateway of class tor-gateway and an HTTPRoute, and the operator runs a Tor daemon, manages the ed25519 keys as Secrets, and writes the resulting .onion address back into Gateway.status.addresses.

Current release is v0.3.2, alpha. What works today:

• Persistent v3 keys via Secrets
• Vanity prefixes via on-demand mkp224o Jobs
• v3 client authorization
• Per-Gateway egress NetworkPolicy
• Prometheus metrics
• Cosign-signed images with SBOMs attached
• Helm chart on OCI and a Helm repo

The motivation was selfish: I wanted a declarative, GitOps-friendly way to put services behind onions without hand-rolling Tor configs and Secrets every time.

AI disclosure

Worth being upfront on r/tor specifically: most of the code in this repo was written by an AI assistant (Claude), with me reviewing, running tests, and making the design/security calls. The keystrokes are largely not mine. I know what that means for code that touches anonymity primitives — AI-written code can be plausible-looking and quietly wrong. I'm not claiming otherwise, and I'd rather you know that going in than find out from the git history.

Apache-2.0. Repo: https://github.com/chimbosonic/tor-gateway