AnarchoTechNYC / ansible-role-onionshare

🧅📮 Build and configure an OnionShare server to anonymously receive files in low- to medium-security environments.

Anarcho-Tech NYC: OnionShare

This role builds and configures an OnionShare receiving server. Notably, this role has been tested with Raspbian on Raspberry Pi hardware. This role's purpose is to make it simple to prepare a host that is not security-critical to anonymously receive files. For security-critical applications, please use SecureDrop instead.

Role variables

• onionshare_username: The user that will be running OnionShare. For public shares, this user's disk space should be restricted using disk quotas. Defaults to onionshare.
• onionshare_user_home_dir: The home directory of the user that will be running OnionShare. Defaults to /var/onionshare.
• onionshare_data_dir: Path to OnionShare's data_dir, the filesystem location in which received files will be saved. Defaults to "{{ onionshare_user_home_dir }}/uploads".
• onionshare_private_key: The private key for the Tor Onion service managed by OnionShare, as prepared by OnionShare. This should be a Base64-encoded X25519 private key. See Generating authentication credentials for version 3 Onion services on the Anarcho-Tech NYC meta wiki. Defaults to the empty string (""), which will cause OnionShare to generate a private key the first time it starts. This key will be saved in OnionShare's configuration file (/etc/onionshare/onionshare.json) unless onionshare_save_private_key is false, in which case the key will be lost when the OnionShare process stops.
• onionshare_public_mode: Whether or not to enable OnionShare's Public mode. Defaults to true.
• onionshare_save_private_key: Whether or not to write the current Onion service private key back to the OnionShare configuration file. Setting this to false will create a new Onion address each time the OnionShare server starts. Defaults to true.