Erich Blume f2362086ef Deploy Tor Snowflake proxy on ringtail

Add snowflake-proxy as a native systemd service on ringtail to help
censored users reach the Tor network. This is a bridge proxy, not an
exit node — traffic exits through Tor exit nodes elsewhere.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-24 20:37:42 -07:00

2.4 KiB

Raw Blame History

title

modified

Snowflake Proxy

Tor Snowflake proxy that helps censored users reach the Tor network. Runs as a native systemd service on ringtail.

Quick Reference

Property	Value
Host	ringtail
Type	NixOS systemd service
Package	`pkgs.snowflake` (nixpkgs)
Binary	`proxy`
Upstream	https://snowflake.torproject.org/
Source	https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake
Metrics	`localhost:9999/metrics` (Prometheus)

Architecture

Snowflake is a pluggable transport for Tor that uses WebRTC to provide short-lived proxies. The proxy:

Polls the Tor broker for censored clients needing a bridge
Establishes a WebRTC connection with the client
Forwards the encrypted traffic to a Tor bridge (relay)

This proxy is NOT a Tor exit node. Traffic exits through Tor exit nodes operated by others. The proxy operator cannot see traffic content (double-encrypted: WebRTC DTLS + Tor onion routing) and destination servers never see the proxy's IP.

Censored user ──[WebRTC/DTLS]──▶ THIS PROXY ──[encrypted]──▶ Tor bridge ──▶ Tor network ──▶ Exit node

Configuration

The service runs with default settings — no special configuration needed. Key defaults:

Setting	Value
Broker	`https://snowflake-broker.torproject.net/`
Relay	`wss://snowflake.torproject.net/`
STUN	Google + BlackBerry STUN servers
Capacity	Unlimited concurrent clients
Summary interval	1 hour
Metrics port	9999 (Prometheus format)

Resource Usage

Based on community reports, a Snowflake proxy typically uses:

Bandwidth: ~5-10 GB/day (varies with client demand)
Memory: Under 100 MB
CPU: Negligible

Legal Considerations

Running a Snowflake proxy carries very low legal risk in the US:

Traffic does not exit from the proxy's IP (exit nodes are elsewhere)
Content is not visible to the proxy operator (end-to-end encrypted)
No known legal cases against Snowflake proxy operators worldwide
EFF and Tor Project both classify this as minimal-risk activity
US intermediary protections (Section 230, ECPA) apply

ringtail - Host machine
architecture - Overall system design

2.4 KiB Raw Blame History