From a3148848f2072100009e2fd5c1ed958583618993 Mon Sep 17 00:00:00 2001
From: Kibi Kelburton <git@f0ck.it>
Date: Sun, 26 Jul 2026 21:43:39 +0200
Subject: [PATCH] option to advertise onion url

---
 config_example.json | 1 +
 src/index.mjs       | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/config_example.json b/config_example.json
index 21ad32c..62b7b13 100644
--- a/config_example.json
+++ b/config_example.json
@@ -5,6 +5,7 @@
       "domain": "example.com",
       "regex": "example\\.com"
     },
+    "onion": "http://your-onion-address.onion",
     "socks": "socks5://127.0.0.1:9050",
     "mail": "admin@example.com",
     "maxfilesize": 104857600,
diff --git a/src/index.mjs b/src/index.mjs
index 87b405c..51a3d86 100644
--- a/src/index.mjs
+++ b/src/index.mjs
@@ -456,6 +456,15 @@ process.on('uncaughtException', err => {
     res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
     // Encourage connection reuse — helps external tools like ShareX avoid repeated TCP/TLS handshakes
     res.setHeader('Connection', 'keep-alive');
+
+    // Tor Onion-Location header: advertises .onion service counterpart to Tor Browser users
+    if (cfg.main.onion && !req.headers['host']?.endsWith('.onion')) {
+      const p = req.url?.pathname || '/';
+      const s = req.url?.search || '';
+      const onionHost = cfg.main.onion.replace(/\/+$/, '');
+      res.setHeader('Onion-Location', `${onionHost}${p}${s}`);
+    }
+
     if (isSecure) {
       res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
     }