We claim exactly this: the system hides your computer's network address — from your site's visitors, and from the website software itself.
How the claim is engineered
- The website container has no network. Not “firewalled” — no interface, no routes, no DNS. It reaches the outside only as content passed over a unix socket by the Tor gateway. It never holds the onion key, so a fully compromised site cannot impersonate your site after a rebuild.
- Only the Tor gateway is online, and it speaks only Tor. Proof-of-work and introduction-point rate limits are on by default.
- A self-checking firewall. The live firewall is compared against a regenerated golden copy on a timer and on system events. If they differ, Tor refuses to start: the system fails closed, never open.
- Encryption with the phrase typed at every boot. LUKS2 whole-disk encryption, no auto-unlock, sleep and hibernation disabled. The sensitive boot keyfile is excluded by the operating system itself — not by instructions to you — from every backup and diagnostic export.
- Leak discipline in the small things. Updates randomised across the full UTC day, response headers with no wall-clock time, published photos stripped of EXIF location and time metadata.
What we don't claim
- That nobody can ever locate the computer. Tor hides where a server is, not when it is online; uptime correlation against public outage reports can narrow a region over time. If being physically located would put you in danger, do not rely on hosting from your home.
- Protection against an adversary who can watch large parts of the Tor network itself.
- Protection of a running machine that has been stolen, seized, or already compromised. The ironclad state is powered off.
- An authenticated, tamper-proof boot. The boot files are encrypted and the bootloader chain is Debian's signed one, but the system does not prove at every boot that nothing in the boot path was ever touched. We say so rather than implying otherwise.
The review gate
Two external reviews have audited the design. No independent reviewer has yet audited the built system, and that review is a hard gate for this project: until it is done, treat Manioc Server as alpha software for testing, and do not rely on its address-hiding claim if being located would cause you harm.
How you can check us
The code, design documents, external reviews — including the ones that corrected us — and build logs are published with the project. A release only counts as verified when independent rebuilders produce a bit-identical image matching the published checksum; reproducible releases are a release gate, not a slogan. Found a problem? Coordinated disclosure, credit given — see Contribute.