MEEK-SERVER(1)

📦 version 0.38.0, in alpine 3.24, arch rolling, nixos 26.05, nixpkgs unstable

💅 MEEK-SERVER(1) — the meek server transport plugin, explained by your favorite unix girlie

okay so before we even start: this is a page from the meek-server manual, section 1, and honestly? it's giving "niche but iconic." let's go 🫶

✨ NAME ✨

meek-server — literally the meek server transport plugin. that's the whole name, no notes, periodt. 👑

🦋 SYNOPSIS 🦋

meek-server --acme-hostnames=HOSTNAME [OPTIONS]

so yeah, that's your starter pack: you give it --acme-hostnames=HOSTNAME and then whatever [OPTIONS] your heart desires. easy. 😌

🌸 DESCRIPTION 🌸

okay so meek-server is a transport plugin for Tor that encodes a stream as a sequence of HTTP requests and responses. yes bestie, that's the whole bit — traffic goes in, looks like a lil HTTP conversation, comes out the other side. iconic behavior fr fr. 🔥

and now the part you can't skip: you will need to configure TLS certificates. there are two ways to set up certificates, and honestly both are valid:

  • --acme-hostnames=HOSTNAME (with optional --acme-email=EMAIL) will automatically get certificates for HOSTNAME using Let's Encrypt. 🎀 the catch? when you use this option, meek-server will need to be able to listen on port 80. no cap.
  • --cert=FILENAME and --key=FILENAME allow use to use your own externally acquired certificate. (yes, the original really says "allow use to use" — i'm keeping it, it's part of the lore. 🙈)

configuration for meek-server usually appears in a torrc file. here's a sample configuration using automatic Let's Encrypt certificates:

ExtORPort auto
ServerTransportListenAddr meek 0.0.0.0:443
ServerTransportPlugin meek exec ./meek-server --acme-hostnames meek-server.example --log meek-server.log

and here's a sample configuration using externally acquired certificates:

ExtORPort auto
ServerTransportListenAddr meek 0.0.0.0:8443
ServerTransportPlugin meek exec ./meek-server 8443 --cert cert.pem --key key.pem --log meek-server.log

now, to listen on ports 80 and 443 without needed to run as root, on Linux, you can use the setcap program, part of libcap2:

setcap 'cap_net_bind_service=+ep' /usr/local/bin/meek-server

(yes, "without needed to run as root" — again, original wording, keeping it. she's quirky. 💀)

💖 OPTIONS 💖

  • --acme-email=EMAIL — optional email address to register for Let's Encrypt notifications when using --acme-hostnames. think of it as leaving your number with the ACME people so they can text you. 💌
  • --acme-hostnames=HOSTNAME[,HOSTNAME]... — comma-separated list of hostnames to honor when getting automatic certificates from Let's Encrypt. meek-server will open a special listener on port 80 in order to handle ACME messages; this listener is separate from the one specified by ServerTransportListenAddr. the certificates will be cached in the pt_state/meek-certificate-cache directory inside tor state directory. lowkey a lot going on, but it slays. 🎀
  • --cert=FILENAME — name of a PEM-encoded TLS certificate file. required unless --acme-hostnames or --disable-tls is used. so like, don't forget it. 😤
  • --disable-tls — use plain HTTP rather than HTTPS. ⚠️ this option is only for testing purposes. don't use it in production. i mean it bestie, do NOT. 🙈
  • --key=FILENAME — name of a PEM-encoded TLS private key file. required unless --acme-hostnames or --disable-tls is used. same energy as --cert, she needs her other half. 🔐
  • --log=FILENAME — name of a file to write log messages to (default stderr). because we love a paper trail. 📓
  • --port=PORT — port to listen on. overrides the TOR_PT_SERVER_BINDADDR environment variable set by tor. in most cases you should set the ServerTransportListenAddr option in torrc, rather than use the --port option. iykyk. 🫶
  • -h, --help — display a help message and exit. the classic. the mother of all flags. 🌈

⭐ SEE ALSO ⭐

💀 BUGS 💀

please report at https://trac.torproject.org/projects/tor. not me asking you to file a bug, but like... if you find one, absolutely file it. 🍓

okay that's the whole page!! mwah 💋 this was the MEEK-SERVER(1) manual, dated 09/14/2021, and it's from the MEEK-SERVER(1) source — that's a whole lotta meek, and honestly? we ate. ✨🎀👑

📦 where this page comes from