Dark Web website Tech Stacks

well in order to do api calls in the frontend the template gotta be server rendered!

Docker helps isolate pretty much everything. It's really needed for Tech Stacks. I figured it would've been a given. Especially involing mirrors. You have various Nginx or Apache2 servers so you're not limited to just one hostname. You can also bridge these to different VPS's if you have the knowledge on how to do. Ultimately I suggest running a container for front-end, one for the back-end, a seperate one for your choice of SQL(I prefer PostgreSQL, although you can choose). One for Nginx/Apache2.

If you plan on having a payment processor I suggest you use something like SHKeeper, Although you want a ton of space if you plan on downloading the blockchain. You also can't go wrong with dropping some type of agent for Wazuh or any other SIEM. I suggest using a seperate VPS for the host and dropping your agents in each individual container assuming how you are building it.

Now that setup is a nightmare for only a single developer, but if you have a team I believe it could run smoothly! Also throw in a mix of Tailscale in there because you'll have data pretty much leaking onto the open internet if you don't. I hope this helps as it being a more in-depth overview!

no, as a backend on ur server instead of for example php

tbh i've never hosted a website on the dark web, but since ur very familiar with clearnet hosting ur definitely ahead of 99%.sure theres some extra steps u can take but honestly nothing that u wouldnt do on a clearnet website as well like for example when it comes to ur server set up, things like hiding the version history so a possible attacker cant gather information as easily, forbid incoming traffic, maybe even put an extra server in the middle so main server > proxy server > website which again isnt uncommon nowadays for clearnet websites. security often correlates with anonymity, if i wanted to host a .onion domain id probably start looking at the sourcecode of similar websites to the one i wanna build, go through angles that attackers or le would go, maybe even try some attack patterns just to see what happens and what the response is, if its similar to clearnet or different etc. id probably also make a post on here too lol but lots of bs on here too.. generally when it comes to darkweb i try to simplify as much as possible bc when it gets complicated its much easier to find holes to slip through for attackers, i try to keep my distance by for exanple doing every single action through a vps bought anonymously that i ssh into via torsocks so my ip is never in the picture (assuming tor is safe but if we cant assume that then what are we even talking about here) and from there on keep it clean and organized. what i'd also do is go through those past fuckups of big markets, like u said u are bc u can always learn from others mistakes ofc, but very often the issues werent with the setup or the code in the website or the security etc. but simply the carelessnes of people, see silk road founder.

nginx is not a programming language lol, its a webserver + reverse proxy, not a programming language at all

Makes sense, you do bring up a lot of good points to look after that I honestly would have missed, so thanks. For more context, about me, I've never built something from start to finish, I was more thrown into the chaos at every company I've worked at. The only things I've built from scratch were simple hobby websites/projects while I was in Uni.

While I do have familiarity with clearnet hosting, the consequences for developing/hosting something illegal in nature is far more pressure than losing a company I don't give a shit about a few hundred thousand dollars because they think I can do everything correctly within unreasonable deadlines (end rant, lol). Anyway, there definitely are many parallels but it's vastly different from hosting a website on some cloud platform like AWS or GCP. My line of work is also not security-focused (quite the opposite actually, they just want shit done on time). But I am keenly aware of a variety of different ways I could attack my company's website if I were someone technically inclined, so maybe I don't give myself enough credit on that end. It's just that I do devops, mostly frontend/backend and have a decent understanding of networking security (probably my weakest link though, if I had to rate myself. I wear a lot of hats, so I'm spread pretty thin. A jack of all trades, master of none, if you will.

Anyway, it would be pretty fun to eventually get to the point to the point to set up a fun little market that transparently pretends to sell things and ask people to find vulnerabilities and learn from my mistakes that way somehow, or just get something up and running.

Definitely would be a lot of work for sure. But my dumb job puts me through the same hell anyway too lmao. While I haven't suffered the pain of setting up a docker microservice infrastructure from scratch, I've added many of my own and had to maintain pretty much all of it. But setting up a few containers like that honestly doesn't sound too bad tbh. It's more the security stuff I worry more about because I think that's where I lack skills the most. Mainly because I work a job that rewards you for fast results, and ignores you when you bring up security concerns. In a nutshell, they ain't gonna last long unless they get their shit together, lmao.

Also, thanks mentioning shkeeper and Wazuh are two names I've never heard of. Tailscale I'm already familar with, so I guess that's something.

I appreciate your in-depth response!

If you're wanting security, have you heard of Alpine docker? Less bloat, and you need to install exactly what you need. An Alpine Image ins like 5 megabytes

Yeah actually, when I was learning Docker it was one of the first images I went with for the sake of learning. Plus, I do tend to be a minimalist myself in general, I have this odd hobby of trying to get old hardware to be usable again by just cutting down on bloat. (I'm a big fan of suckless if you've ever heard of em) even though I eventually moved over to awesomeWM for convenience.

Anyway, back on topic. Alpine sounds like a good choice. I actually tried the Archlinux one too because I thought it'd be minimal to some degree, and for the sake of familiarity. I was sorely disappointed in how large it ended up being (I think it was even larger than Ubuntu's)

Haha, this whole thread has given me a lot of perspective, I appreciate the suggestions from all of you.

Yeah you'll be surprised what starts happening once you start installing things on images. I've used alpine mainly for minimal attack surfaces and to keep all the bloat down. The only problem first getting used to it which I've experienced it first hand is Alpine doesn't save like the others, haha.