Tor, I2P, and CJDNS

Tidecoin Core supports the same alternative network transports as Bitcoin Core: Tor v3 onion services, I2P through SAM, and CJDNS over fc00::/8 addresses. These transports can improve reachability, peer diversity, and censorship resistance, but they do not replace node monitoring or correct RPC security.

This page is the operator setup guide. Protocol-level transport behavior belongs in P2P Transport.

Transport summary

V2 P2P transport remains a Tidecoin P2P setting. Alternative transports change how peers are reached; they do not turn RPC into a private or public-safe API.

Tor outbound proxy

Run Tor with a SOCKS proxy, commonly 127.0.0.1:9050, then start Tidecoin with:

tidecoind -proxy=127.0.0.1:9050

This routes outbound connections through the proxy. If you want automatic outbound connections only to onion peers:

tidecoind -proxy=127.0.0.1:9050 -onlynet=onion

Use -onion=<ip:port> when onion traffic should use a different SOCKS proxy than other proxied traffic. Use -onion=0 to disable onion access explicitly.

Tor inbound onion service

Tidecoin can automatically create an onion service through Tor’s control port when Tor authentication is configured:

listenonion=1
torcontrol=127.0.0.1:9051
debug=tor

You can also configure a static onion service in torrc:

HiddenServiceDir /var/lib/tor/tidecoin-service/
HiddenServicePort 8755 127.0.0.1:8756

Then start Tidecoin with the onion address and onion bind:

tidecoind -proxy=127.0.0.1:9050 \
  -externalip=<your-onion-address>.onion \
  -bind=127.0.0.1:8756=onion \
  -listen

Replace the onion address with the hostname generated by Tor.

I2P

Run an I2P router with the SAM bridge enabled. The SAM bridge commonly listens on 127.0.0.1:7656.

tidecoind -i2psam=127.0.0.1:7656

Useful options:

I2P-only initial sync can be slow. For initial block download, consider allowing more than one privacy transport, then tightening policy after the node is synced.

CJDNS

CJDNS is configured outside Tidecoin Core. Once the host can route fc00::/8 CJDNS addresses, enable CJDNS reachability:

tidecoind -cjdnsreachable

For CJDNS-only automatic outbound connections:

tidecoind -cjdnsreachable -onlynet=cjdns

-cjdnsreachable tells the node to treat fc00::/8 addresses as CJDNS rather than ordinary IPv6 local addresses. Without that option, CJDNS-only operation will not be configured correctly.

Mixed transport policy

You can combine transports:

proxy=127.0.0.1:9050
i2psam=127.0.0.1:7656
cjdnsreachable=1
onlynet=onion
onlynet=i2p
onlynet=cjdns
v2transport=1

onlynet affects automatic outbound connections. Inbound and manual connections are not the same policy surface, so review bind, externalip, addnode, and firewall rules separately.

Diagnostics

For Tor and I2P, look for local addresses ending in .onion or .b32.i2p in logs and getnetworkinfo.

Security boundaries

Alternative P2P transports do not protect wallet RPC. Keep RPC bound to localhost or a private service network, and use RPC Security for authentication and whitelisting.

Do not publish RPC, REST, or ZMQ endpoints through the same onion/I2P service as P2P unless there is a deliberate authenticated design. A public P2P node is not a public admin API.

Source of truth

See also: Configuration, P2P Transport, RPC Security.