Iroh Socks Proxy P2P Web Update

A while ago I wrote about the Blueprint for a Sovereign Web: an idea for websites that don’t depend on domain registrars, DNS providers or hosting companies to exist. Back then it was mostly a concept and a small prototype. Now it works for real, and you can try it.

What it is

Iroh Socks Proxy has two small parts:

A daemon, a little program that runs quietly on your computer.
A browser extension, a simple on/off switch.

When the switch is on, your browser can open addresses ending in .anon. These aren’t normal websites. Nobody registers them, no DNS server knows about them, and no company can take them down. A .anon address is simply a cryptographic key, a long string of letters and digits, and only the person holding the matching secret key can publish under it.

How it works

Every daemon gets its own identity. The first time it starts, it creates a secret key and keeps it on your computer. The public half of that key is the address, for example 6bbjgq88ox3dmdq3dfks3faf46c8akbqh9eei7cnhb7bqxwxr3xo.anon.
Your browser asks your daemon for the site. When you type a .anon address, the browser hands it to the daemon on your own computer instead of looking it up on the internet.
The daemon finds the other computer by its key. It uses Iroh, an open-source peer-to-peer networking library, to open an encrypted connection straight to the computer that owns that key. If a direct connection isn’t possible, Iroh passes the traffic through a relay server. The relay only sees encrypted data.
The page travels back over that connection. End-to-end encrypted, with no web host in between.

Everything that isn’t .anon is blocked while the switch is on. I call this Air-Gap Mode. Normal websites are deliberately not let through, so nothing leaks around the proxy by accident. Switch it off and you browse normally again.

What’s new

Real peer-to-peer connections over Iroh, replacing the earlier demo page.
Publish your own site: anyone running the daemon can publish a folder of web pages with one command (--serve my-folder), or share a web server that’s already running on their computer.
Ready-made downloads for Windows, macOS and Linux. No programming tools needed.
A Docker image, so a site can run around the clock on a cheap cloud server instead of your own computer. My own test site runs this way on bunny.net.
Security hardening: limits and timeouts against overload, a published site can never expose files outside its folder, and everything is covered by automatic tests on all three operating systems.

Try it

My test site is online right now at:

http://6bbjgq88ox3dmdq3dfks3faf46c8akbqh9eei7cnhb7bqxwxr3xo.anon

To visit it:

Download the daemon for your system from the latest release and start it. No programming tools needed. If you’d rather build it yourself, the README explains how.
Load the browser extension (Chrome, Edge or Brave) and switch it on.
Open http://6bbjgq88ox3dmdq3dfks3faf46c8akbqh9eei7cnhb7bqxwxr3xo.anon/. Note http://, not https://. The connection is already encrypted by Iroh, so the browser’s “Not secure” warning can be ignored here.

Full instructions, including how to publish your own site, are in the README.

What it is not (yet)

I want to be clear about this: encrypted is not the same as anonymous. Tor hides who you are by sending your traffic through several volunteer relays. This project connects you directly. That means:

a .anon site can see your IP address, just like a normal website;
the relay and lookup servers used by default can see which addresses connect to which (but not what you send);
your daemon uses the same key everywhere, so sites could recognise you.

What you do get is encryption, and addresses nobody can confiscate. If being identified would put you at risk, use Tor. Real anonymity is on the roadmap: a separate key for browsing, and eventually routing traffic through Tor itself.

What’s next

Better anonymity, as described above.
Our own relay server, so we don’t depend on anyone else’s.
Friendlier names than 52-character keys.
Getting rid of the “Not secure” warning.

The project is open source, and feedback or help is very welcome, especially from people who know Rust or networking. Find it on GitHub.

Hosting your own site without keeping your computer on

A .anon site is only online while a daemon is running for it. You don’t have to use your own computer for that, though. The project includes a ready-made Docker image, so a site can run on any service that keeps a container running around the clock.

My test site runs on bunny.net’s Magic Containers. Setting it up took a few minutes in their dashboard, with no command line:

point it at the image ghcr.io/creepybits/iroh-socks-proxy;
run one copy in one region;
attach a small storage volume at /data, so the site keeps the same address after restarts.

There’s a step-by-step guide in the repository (docs/DEPLOY-BUNNY.mdDen här sessionen körs inte, så dess filer kan inte öppnas. Skicka ett meddelande för att starta den igen.). The same image works on a small VPS, Fly.io, a Raspberry Pi at home, or anywhere else that runs Docker.

Known limitations and issues

Brave Browser:

There is a profile-level state bug specifically affecting Brave Browser where the browser permanently locks its internal proxy routing to the local loopback interface (127.0.0.1:9999) once the extension is initialized.

The Symptom: The extension toggle becomes unresponsive, and Brave remains permanently locked to the proxy even if the extension is disabled or completely uninstalled from the browser.
The Behavior:
- If the local Rust daemon is running, only .anon domains load; normal websites are refused (Air-Gap Mode).
- If the local daemon is stopped, all internet connectivity inside that specific Brave profile will be completely blocked.
Possible Fix (unconfirmed): Since version 1.1, the extension re-applies or clears the proxy setting every time the browser starts, to match the toggle. This may unstick Brave; it has not been confirmed yet.
Observed Scope: This issue is not present in Google Chrome or Edge (where the proxy properly detaches on toggle/uninstall). Vivaldi is untested. Firefox can’t use the extension, but works with its built-in proxy setting: Settings → Network Settings → Manual proxy, SOCKS host 127.0.0.1, port 9999, SOCKS v5, and tick “Proxy DNS when using SOCKS v5”.

Temporary Workaround

If you are developing, testing, or running the prototype in Brave, do not load the extension in your primary browsing profile. Instead, use a dedicated profile:

Click your profile icon in Brave and select Add to create a new, clean user profile.
Load the unpacked extension only within this dedicated test profile.
This keeps your main Brave profile completely untouched and allows you to safely test the SOCKS5 daemon’s routing behavior.