We run a Tor hidden service stack on the Gateway VPS, providing an onion-routed mirror for one internal application as an additional access path.
Client authentication for Tor v3 hidden services uses X25519 keypairs. The server only ever stores the public half — the matching private key exists solely on the client side and must be captured and saved securely at generation time, since it can't be derived from the public key afterward. Treat any Tor client-auth key the same as any other credential: save it properly the moment it's generated, or it's gone for good.
Specific onion addresses, mirrored services, and key material are not published here — see the private operational docs (claude-md/tor.md) and Vaultwarden for that level of detail.