This guide requires a system with Podman and Podman Compose installed. Read our guide on Podman

Introduction

I2P is the new kid on the block. It stands for Invisible Internet Project. Not really the "new kid", as it started in 2002, the same year as Tor, but it only recently began taking off.

There are a lot of differences between I2P and Tor, most of which I'm too stupid to understand, but here are some important ones:

Sybil Resistant

In I2P, almost everyone contributes to the network, while in Tor millions of users leech from (relatively) very few volunteers running relays (aka nodes).

Call me schizophrenic, but I don't think it's very far-fetched to imagine that not a lot of people want to:

  • rent a server, losing money and time dealing with abuse complaints (not on Kyun(TM)!), or
  • run a relay from their home and risk getting arrested, having all of their hardware seized and being labelled as a pedophile because someone was downloading CP using their Tor exit relay. this actually happened btw

This makes it a lot more feasible, for those that can afford it, to run a lot of nodes and use the data collected from those nodes in order to, for example, deanonymize users. This is called a Sybil attack.

People actively try to fight against these attacks, but, realistically, these mitigations would only, MAYBE, be able to stop small-time cybercriminals, not full-on government sponsored hacker groups with effectively infinite funding.

In I2P, pretty much every user acts as a "relay".

Completely Segregated

I2P does not connect to the clearnet. At all. You can only connect to .i2p addresses from I2P, as opposed to Tor where you can connect to any website via exit nodes and still have your traffic routed through the Tor network.

Not Funded by the US Government

This one is not that relevant, but it's really funny.

It's also really true.

Anyways, let's get to what you came for:

Getting Started With i2pd

i2pd is a C++ implementation of the original I2P Java client(yes, Java, it was 2002). You can use the original one if you insist, but for this guide we'll go with i2pd.

Let's say you want to run a website called "coolwebsite1337".

Create a new directory named coolwebsite1337. Inside that directory, create a compose.yaml file:

# coolwebsite1337/compose.yaml
services:
  i2p:
    image: docker.io/purplei2p/i2pd
    restart: unless-stopped
    ports:
      - 7070:7070 # web console port
      - 9000-31000:9000-31000 # p2p inbound traffic, speeds up things a lot
    volumes:
      - ./i2p:/home/i2pd/data
    command: --http.address 0.0.0.0 --http.strictheaders false --http.auth true --http.pass supersecretpassword # change this

  caddy: # you can use nginx if you want, caddy is just better
    image: docker.io/library/caddy:alpine
    restart: unless-stopped
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./caddy:/data # caddy internal data
      - ./public:/public # public website files

Create a new directory named i2p under coolwebsite1337. Inside the new directory, create a tunnels.conf file, containing some minimal server configuration:

1
2
3
4
5
6
# coolwebsite1337/i2p/tunnels.conf
[coolwebsite1337]
type = http
host = caddy
port = 80
keys = coolwebsite1337.keys

caddy, in this case, is the name of the container in compose.yaml

At this point, your directory structure should be:

1
2
3
4
- coolwebsite1337
  - compose.yaml
  - i2p
    - tunnels.conf

Let's not wrangle with users and groups and whatever. Open up the permissions of the i2p directory, or else i2pd will complain about it and fail:

$ chmod -R 7777 i2p

Alright, now we're ready to start i2pd, generate our keys and .i2p addresses. Bring the container up:

$ podman-compose up -d i2p

If all goes well, you should be able to access the web console at http://[server ip]:7070. Log in using the username i2pd and password supersecretpassword (i hope you changed the password. if you didn't, delete everything and start over. move to transnistria. change your name to igor)

If not, well, check the logs:

$ podman-compose logs --tail 500 -f i2p

Finding Your .i2p Address

Once you're in the web console, click on I2P Tunnels. Under Server Tunnels, you will be able to see the new .i2p address people can access your website at. It should look something like mc6n3rbnuapb2rqjh7torefjt6usdocy2ffsqkfj23g7wg3ybl2a.b32.i2p. But there's no website yet......

Caddy Configuration

Create a new file named Caddyfile in the coolwebsite1337 directory:

1
2
3
4
5
# coolwebsite1337/Caddyfile
http://mc6n3rbnuapb2rqjh7torefjt6usdocy2ffsqkfj23g7wg3ybl2a.b32.i2p {
  root * /public
  file_server
}

Replace the i2p address with your own.

Create a file named index.html under coolwebsite1337/public. Obviously, this is supposed to be an HTML file, but for testing purposes you can put anything in there.

Just to double-check, this is what the directory structure should be at this point:

1
2
3
4
5
6
7
8
9
- coolwebsite1337
  - compose.yaml
  - Caddyfile
  - i2p/
    - tunnels.conf
    - coolwebsite1337.keys
    - [a lot of other files generated by i2pd]
  - public/
    - index.html

Now we're ready to really take this website online:

$ podman-compose up -d

That's it. Your website is now on I2P. kthxbai~

Tipz'n'Trix

Fancy domain.i2p name

I2P, unlike Tor, supports a domain name system out of the box, where you can get a short, easy-to-remember domain name instead of the long ugly base32 address, through something called jump services, or something.

Remember the Server Tunnels section from before where you found your .b32.i2p address?

  • Click on the purple link that says coolwebsite1337, left of the b32 address
  • Click Address registration line
  • Type your domain
  • Click Generate
  • Type a description for your website
  • Click Submit,

and now you, my friend, have a fancy .i2p domain, for free.

Just like clearnet domains, these are managed by a third party and can be compromised.

The .b32.i2p address is tied to your private key, just like .onion domains, so it can't be compromised unless someone manages to get your private key.

If I were you, I wouldn't use these fancy domains for anything serious. Which brings me to:

Vanity base32 addresses

Maybe you don't want to use a jump service but still want your long, ugly b32 address to be recognizable. You can use the vain tool from i2pd-tools for this. There's an unofficial container image for i2pd-tools so we're going to use that. If you don't trust the image and want to build the tools yourself, feel free, it doesn't take that long.

$ podman run --rm -it -v ./:/workdir docker.io/justinhimself/i2pd-tools vain vanity

This will bruteforce private keys until it finds one which has a .b32 address starting with vanity. You can, of course, replace vanity with anything else.

Keep in mind that the longer the vanity part, the longer it will take to generate. Anything over 6 characters will probably take hours, if not days, to generate (on a consumer CPU)

After running the command, you should have a private*.dat file in your current directory. Move the file to coolwebsite1337/i2p/coolwebsite1337.keys, restart i2pd, and your website should now be up at the new vanity address.

Edit Report
Pub: 01 Nov 2023 22:57 UTC
Views: 74