Going to the Dark Side: How chrisbmn.com Got an Onion Address

Every so often a project starts with a perfectly reasonable question and immediately gets out of hand. This one started with: "what do I do with a Linux box that used to run a World of Warcraft sandbox server that nobody plays on?" The answer, apparently, was: give it a job on the dark web.

So chrisbmn.com now has a Tor hidden service. Not a mirror, not a secret backup plan, just a small three-page corner of the site that only exists if you know how to get there - and as of this week, it actually tells you how.

Step one: a server with nothing to do

The Cold North realm - a little AzerothCore private server I had started to build, but never really got any traction. Community interest dried up or maybe never really started to begin with. Tearing down a whole realm (database, build toolchain, the works) just to let the box sit idle felt like a waste of a perfectly good server, so I gave it a new job: hosting a Tor hidden service for chrisbmn.com.

Same box, completely different life. No regrets.

Step two: an address that doesn't look like a cat walked across the keyboard

Default .onion addresses are 56 random-looking characters - technically meaningful (it's derived from a cryptographic key), but not exactly memorable. There's a whole category of tool built for exactly this complaint: generate key after key after key until one happens to produce an address starting with whatever prefix you want. I pointed one of these at my own initials and let it grind away until it landed on an address starting with "cbmn" - close enough to feel intentional, random enough to prove it wasn't faked.

It's a neat trick. It also means the resulting address is exactly as secure as a randomly generated one - vanity prefixes don't cost you anything except the wait.

Step three: Tor has a naming problem

Getting Tor and nginx actually talking to each other went about as smoothly as these things ever do, with one genuinely aggravating exception: on Debian-based systems, systemctl status tor and systemctl restart tor both target a service that does almost nothing. It always reports success, whether or not Tor is actually running, because the real daemon lives under a completely different unit name: tor@default.service. I lost a chunk of an evening to this before finding the actual logs. Filed under: things that should not have been named that way.

Step four: actually building the thing

The onion site itself is deliberately not a mirror of the real chrisbmn.com - that would be a lot of upkeep for very little payoff. Instead it's three pages: a home page, an identity/verification page, and a privacy policy that's two lines long because there's genuinely nothing to disclose. Same dark theme as the real site, but with the accent color swapped from blue to violet - a small, deliberate "you're not where you started" signal. There's a real logo, and a couple of Rick and Morty pics. Just because I assume Rick Sanchez would obviously be hanging out on the dark web. 

Step five: telling anyone this exists

A hidden service that nobody can find isn't much of an experiment, so the "light side" chrisbmn.com now points to the "dark side" in one of two ways: an Onion-Location response header (which Tor Browser reads automatically and offers as a one-click switch), and a card on the Identity page explaining what it is and why it exists.

This week's chapter: giving it some manners

Here's the problem I'd conveniently ignored until now: that card just linked straight to the .onion address. Click it in literally any normal browser, and you get an instant DNS failure - because plain browsers have no idea what to do with a .onion domain, and never will. Technically correct, but a genuinely bad first impression if you're just curious and don't already have Tor Browser sitting open.

I briefly considered getting clever about it - having the page quietly probe whether Tor was reachable and only show the link if so. The more I looked at it, the less it was worth the trouble: slow Tor circuits would read as "not installed" when they weren't, and it added a pile of complexity to solve a problem a much simpler idea already handles fine.

So instead there's now a short waypoint page before you ever touch the actual address: what the onion site is, a few honestly-boring security basics (leave the window at its default size, keep it updated, the default settings are fine), a link to the official Tor Browser download, and only then the real address - plus a copy button, for anyone who wants to grab it now and paste it in later. The button that gets you there even has a tooltip warning you what's about to happen if you don't have Tor Browser installed. It does not sugarcoat it.

Why bother with any of this

Not for anonymity - I'm not exactly hiding my identity on a page that's, itself, an identity verification page. This was always closer to curiosity than opsec: wanting to understand how hidden services actually work end to end, from key generation to nginx config to the weird little quirks of running Tor on a box that used to host a video game. That box has had a stranger year than most of my hardware.

If you've got Tor Browser handy and want to see the other side, the Identity page will point you the rest of the way.