doc: Document P2P transport mixing

bin/darkfid/darkfid_config.toml

@@ -176,7 +176,7 @@ seeds = [
 # own external addresses
 seeds = [
     "socks5://127.0.0.1:9050/wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:18341",
-    "socks5://127.0.0.1:9050/eu7b6sqsxvyfgmufquwr622fbbaqut7qwvpedzlste3b66bv7jvxlpyd.onion:18341",
+    "socks5://127.0.0.1:9050/inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:18341",
 ]
 
 # Peer nodes to manually connect to

bin/darkfid/src/tests/harness.rs

@@ -111,8 +111,12 @@ impl Harness {
         };
 
         // Generate validators
-        let mut settings =
-            Settings { localnet: true, inbound_connections: 3, ..Default::default() };
+        let mut settings = Settings {
+            active_profiles: vec!["tcp+tls".to_string()],
+            localnet: true,
+            inbound_connections: 3,
+            ..Default::default()
+        };
 
         // Alice
         let alice_url = Url::parse(&config.alice_url)?;

bin/darkfid/src/tests/mod.rs

@@ -110,7 +110,12 @@ async fn sync_blocks_real(ex: Arc<Executor<'static>>) -> Result<()> {
     }
 
     // We are going to create a third node and try to sync from Bob
-    let mut settings = Settings { localnet: true, inbound_connections: 3, ..Default::default() };
+    let mut settings = Settings {
+        active_profiles: vec!["tcp+tls".to_string()],
+        localnet: true,
+        inbound_connections: 3,
+        ..Default::default()
+    };
     let charlie_url = Url::parse("tcp+tls://127.0.0.1:18342")?;
     settings.inbound_addrs = vec![charlie_url];
     let bob_url = th.bob.p2p_handler.p2p.settings().read().await.inbound_addrs[0].clone();

bin/darkfid/src/tests/sync_forks.rs

@@ -66,7 +66,12 @@ async fn sync_forks_real(ex: Arc<Executor<'static>>) -> Result<()> {
     th.validate_fork_chains(3, vec![3, 1, 1]).await;
 
     // We are going to create a third node and try to sync from Bob
-    let mut settings = Settings { localnet: true, inbound_connections: 3, ..Default::default() };
+    let mut settings = Settings {
+        active_profiles: vec!["tcp+tls".to_string()],
+        localnet: true,
+        inbound_connections: 3,
+        ..Default::default()
+    };
 
     let charlie_url = Url::parse("tcp+tls://127.0.0.1:18442")?;
     settings.inbound_addrs = vec![charlie_url];

bin/darkirc/config/darkirc-mixed.toml

@@ -48,8 +48,8 @@ external_addrs = ["tcp+tls://MY_IP_V4:9600", "tcp+tls://MY_IP_V6:9600", "tcp+tls
 [net.profiles."tor"]
 ## Seed nodes to connect to
 seeds = [
-    "tor://g7fxelebievvpr27w7gt24lflptpw3jeeuvafovgliq5utdst6xyruyd.onion:9600",
-    "tor://yvklzjnfmwxhyodhrkpomawjcdvcaushsj6torjz2gyd7e25f3gfunyd.onion:9600",
+    "tor://wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:9601",
+    "tor://inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:9601",
 ]
 
 ## P2P accept addresses

bin/darkirc/config/darkirc-tor.toml

@@ -38,8 +38,8 @@ mixed_profiles = []
 [net.profiles."tor"]
 ## Seed nodes to connect to
 seeds = [
-    "tor://g7fxelebievvpr27w7gt24lflptpw3jeeuvafovgliq5utdst6xyruyd.onion:9600",
-    "tor://yvklzjnfmwxhyodhrkpomawjcdvcaushsj6torjz2gyd7e25f3gfunyd.onion:9600",
+    "tor://wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:9601",
+    "tor://inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:9601",
 ]
 
 ## Addresses we want to advertise to peers

bin/darkirc/darkirc_config.toml

@@ -109,13 +109,16 @@ hostlist = "~/.local/share/darkfi/darkirc/p2p_hostlist.tsv"
 # If ports are left empty all ports from this peer will be blocked.
 #blacklist = [["example.com", ["tcp"], [8551, 23331]]]
 
-# Whitelisted transports for outbound connections
+# Transports this node can dial. Leave tcp and tcp+tls out when direct
+# clearnet connections are not permitted.
 active_profiles = ["tor"]
 #active_profiles = ["tcp+tls"]
-#active_profiles = ["tor", "tor+tls"]
 
-# Transports you want to be mixed (e.g. Tor would be allowed to connect to `tcp://`
-# if tcp is added to mixed_profiles and tor is added to active_profiles)
+# Canonical peer schemes that may be reached through a compatible active
+# transport. For example, route learned tcp and tcp+tls peers through Tor with:
+#active_profiles = ["tor", "tor+tls"]
+#mixed_profiles = ["tcp", "tcp+tls"]
+# Keep bootstrap seeds under the active tor and tor+tls profile tables below.
 #mixed_profiles = []
 
 # Tor Socks5 proxy
@@ -174,8 +177,8 @@ seeds = [
 [net.profiles."socks5"]
 ## Seed nodes to connect to
 seeds = [
-    "socks5://127.0.0.1:9050/g7fxelebievvpr27w7gt24lflptpw3jeeuvafovgliq5utdst6xyruyd.onion:9600",
-    "socks5://127.0.0.1:9050/yvklzjnfmwxhyodhrkpomawjcdvcaushsj6torjz2gyd7e25f3gfunyd.onion:9600",
+    "socks5://127.0.0.1:9050/wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:9601",
+    "socks5://127.0.0.1:9050/inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:9601",
 ]
 
 ## Manual peers to connect to

bin/fud/fud/fud_config.toml

@@ -140,8 +140,8 @@ seeds = [
 [net.profiles."tor"]
 ## Seed nodes to connect to
 seeds = [
-    "tor://g7fxelebievvpr27w7gt24lflptpw3jeeuvafovgliq5utdst6xyruyd.onion:9701",
-    "tor://yvklzjnfmwxhyodhrkpomawjcdvcaushsj6torjz2gyd7e25f3gfunyd.onion:9701",
+    "tor://wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:9701",
+    "tor://inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:9701",
 ]
 
 ## Manual peers to connect to
@@ -171,8 +171,8 @@ seeds = [
 [net.profiles."socks5"]
 ## Seed nodes to connect to
 seeds = [
-    "socks5://127.0.0.1:9050/g7fxelebievvpr27w7gt24lflptpw3jeeuvafovgliq5utdst6xyruyd.onion:9701",
-    "socks5://127.0.0.1:9050/yvklzjnfmwxhyodhrkpomawjcdvcaushsj6torjz2gyd7e25f3gfunyd.onion:9701",
+    "socks5://127.0.0.1:9050/wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:9701",
+    "socks5://127.0.0.1:9050/inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:9701",
 ]
 
 ## Manual peers to connect to

bin/tau/taud/taud_config.toml

@@ -118,8 +118,8 @@ seeds = [
 [net.profiles."tor"]
 ## Seed nodes to connect to
 seeds = [
-    "tor://g7fxelebievvpr27w7gt24lflptpw3jeeuvafovgliq5utdst6xyruyd.onion:9801",
-    "tor://yvklzjnfmwxhyodhrkpomawjcdvcaushsj6torjz2gyd7e25f3gfunyd.onion:9801",
+    "tor://wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:9801",
+    "tor://inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:9801",
 ]
 
 ## Manual peers to connect to
@@ -144,8 +144,8 @@ seeds = [
 [net.profiles."socks5"]
 ## Seed nodes to connect to
 seeds = [
-    "socks5://127.0.0.1:9050/g7fxelebievvpr27w7gt24lflptpw3jeeuvafovgliq5utdst6xyruyd.onion:9801",
-    "socks5://127.0.0.1:9050/yvklzjnfmwxhyodhrkpomawjcdvcaushsj6torjz2gyd7e25f3gfunyd.onion:9801",
+    "socks5://127.0.0.1:9050/wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:9801",
+    "socks5://127.0.0.1:9050/inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:9801",
 ]
 
 ## Manual peers to connect to

contrib/localnet/taud-four-nodes/seed.toml

@@ -91,9 +91,9 @@ inbound = ["tcp://127.0.0.1:23331"]
 # seeds = [
 #"tcp+tls://lilith0.dark.fi:5363",
 # "tcp+tls://lilith1.dark.fi:5363",
-# "tor://rwjgdy7bs4e3eamgltccea7p5yzz3alfi2vps2xefnihurbmpd3b7hqd.onion:5362"
-# "tor://f5mldz3utfrj5esn7vy7osa6itusotix6nsjhv4uirshkcvgglb3xdqd.onion:5362"
+# "tor://wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:5362"
+# "tor://inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:5362"
 # ]
 
 ## Manual peers to connect to
-#peers = []
+#peers = []

doc/src/misc/darkirc/normal-node.md

@@ -52,6 +52,56 @@ addresses, proxy settings, and any inbound address you intend to expose. See
 [node configuration guides](../nodes/node-configurations.md) for transport and
 public-listener setups.
 
+## Route learned clearnet peers through Tor
+
+Use transport mixing when the seed advertises canonical clearnet peers but
+direct clearnet connections are not allowed. This configuration uses the
+built-in Arti transports, so it does not require `tor_socks5_proxy`:
+
+```toml
+[net]
+active_profiles = ["tor", "tor+tls"]
+mixed_profiles = ["tcp", "tcp+tls"]
+
+[net.profiles."tor"]
+seeds = [
+    "tor://wgxxaifz5gv4iggcflyl67lgmsihffs6bbwobqah4np52t3y3olrnpid.onion:9601",
+    "tor://inx5s3pdzddvgb5ii3oydutmbvw6fvor3oqu65wtxl3pyevtvrdn4had.onion:9601",
+]
+
+[net.profiles."tor+tls"]
+seeds = [
+    "tor+tls://lilith0.dark.fi:9600",
+    "tor+tls://lilith1.dark.fi:9600",
+]
+```
+
+`active_profiles` are the transports the node may actually dial.
+`mixed_profiles` are canonical schemes accepted from seed and peer discovery.
+The compatible mappings in this example are `tcp` through `tor` and
+`tcp+tls` through `tor+tls`. A learned address such as
+`tcp+tls://peer.example:9600` remains under that canonical URL in the hostlist
+and peer lifecycle, while the connection endpoint is derived as
+`tor+tls://peer.example:9600`. Network diagnostics display the derived route.
+
+The seed entries belong to the active `tor` and `tor+tls` profile tables.
+Profile tables that are only named in `mixed_profiles` do not contribute
+seeds, peers, listeners, or external addresses. Do not move these bootstrap
+addresses into `[net.profiles."tcp"]` or `[net.profiles."tcp+tls"]` unless
+those transports are deliberately active for direct clearnet use.
+
+A valid learned address is placed on the dark list when this node has no
+direct or mixed route for its scheme. With the configuration above, learned
+`tcp` and `tcp+tls` peers are dialable through Tor and remain in the normal
+grey, white, and gold host lifecycle. The dark list is an unsupported-host
+classification; it is distinct from the operator-configured blacklist.
+
+Transport mixing prevents a direct connection for these canonical peer
+schemes, but it does not make public DarkIRC messages private or remove all
+traffic-analysis metadata. The remote clearnet service sees a Tor exit rather
+than the node's IP, subject to Tor's threat model. Use encrypted DarkIRC
+channels separately when message confidentiality is required.
+
 ## Start and connect
 
 Start the node from the repository root: