onionbalance master domain periodically offline - error 'Descriptor upload failed'

Support Onion Services
1

hi, i have an multiple hidden services with onionbalance on the same server and periodically one of master-domains is offline, but if i try restart service multiple times - domain is online.

here an logs from service with offline domain:

#-----------------------master------------------------

service1_master  | 2026-01-09 16:36:04,738 [INFO]: [*] fetch_instance_descriptors() called [*]

service1_master  | 2026-01-09 16:36:04,739 [INFO]: Initiating fetch of descriptors for all service instances.

service1_master  | 2026-01-09 16:36:10,246 [INFO]: Found instance sgdfoigjwohgd4fhgidgowisgoehirgoiehrogahefdogregsdfgwrad for this new descriptor!

service1_master  | 2026-01-09 16:36:10,249 [INFO]: We got a new descriptor for instance sgdfoigjwohgd4fhgidgowisgoehirgoiehrogahefdogregsdfgwrad but the intro set did not change.

service1_master  | 2026-01-09 16:36:10,504 [INFO]: Found instance fdgfeqgjwohgd4fhgidgoewfsdgwrhjoiehrogahefdogregsdfgwrid for this new descriptor!

service1_master  | 2026-01-09 16:36:10,507 [INFO]: We got a new descriptor for instance fdgfeqgjwohgd4fhgidgoewfsdgwrhjoiehrogahefdogregsdfgwrid but the intro set did not change.

service1_master  | 2026-01-09 16:36:10,834 [INFO]: Found instance fsdgahfgkjdfghehfsgjoewfsdgwrhjoiehrogahefdogregsdfgwrid for this new descriptor!

service1_master  | 2026-01-09 16:36:10,837 [INFO]: We got a new descriptor for instance fsdgahfgkjdfghehfsgjoewfsdgwrhjoiehrogahefdogregsdfgwrid but the intro set did not change.

service1_master  | 2026-01-09 16:36:11,995 [INFO]: Found instance htjefhrfgfuefhehfsgjoewfsdgwrhjoiehrogahefdogregsdfgwrid for this new descriptor!

service1_master  | 2026-01-09 16:36:11,998 [INFO]: We got a new descriptor for instance htjefhrfgfuefhehfsgjoewfsdgwrhjoiehrogahefdogregsdfgwrid but the intro set did not change.

service1_master  | 2026-01-09 16:36:51,887 [INFO]: [*] publish_all_descriptors() called [*]

service1_master  | 2026-01-09 16:36:51,888 [INFO]:   Intro set not modified

service1_master  | 2026-01-09 16:36:51,888 [INFO]:   Our first descriptor is still fresh (3599 seconds old).

service1_master  | 2026-01-09 16:36:51,897 [INFO]: Using srv dae5f6eb79c695789663c7d56c627dd38444875b0d64534b8661ab8dbee9e7f5 and TP#20461 (first descriptor)

service1_master  | 2026-01-09 16:36:51,994 [INFO]: Initialized hash ring of size 5774 (blinded key: b'DhGLJ6ztpkP8+NwVVCiNIsKk6lRCDcuj+N/Yvy9wl8o=')

service1_master  | 2026-01-09 16:36:51,994 [INFO]: Getting HS index with TP#20461 for first descriptor (1 replica)

service1_master  | 2026-01-09 16:36:51,994 [INFO]:   Tried with HS index 557e3f6b0c75b0240932a046987abec66bf616bc632291293bc65f33390a2ea5 got position 1930

service1_master  | 2026-01-09 16:36:51,994 [INFO]: Getting HS index with TP#20461 for first descriptor (2 replica)

service1_master  | 2026-01-09 16:36:51,994 [INFO]:   Tried with HS index 1607ebb098e886f10f9480982e3ea382663c4a2522598222593937f2223f6022 got position 480

service1_master  | 2026-01-09 16:36:51,994 [INFO]:   HSDir set remained the same

service1_master  | 2026-01-09 16:36:51,994 [INFO]: No reason to publish first descriptor for hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion

service1_master  | 2026-01-09 16:36:51,994 [INFO]:   Intro set not modified

service1_master  | 2026-01-09 16:36:51,994 [INFO]:   Our second descriptor is still fresh (3599 seconds old).

service1_master  | 2026-01-09 16:36:51,999 [INFO]: Using srv 1bc8ad0ab9eb2f6b6b3d00bdc65bd5af5fc15595fbf6ca66019c91e2792fe722 and TP#20462 (second descriptor)

service1_master  | 2026-01-09 16:36:52,044 [INFO]: Initialized hash ring of size 5774 (blinded key: b'EDuPkqwQnV+uRWGqkBn5uKd19KVruNTjlf+tPwWgMaw=')

service1_master  | 2026-01-09 16:36:52,044 [INFO]: Getting HS index with TP#20462 for second descriptor (1 replica)

service1_master  | 2026-01-09 16:36:52,044 [INFO]:   Tried with HS index ebb7613a6c1ef26b738ec280e2f5d01235c0ef883ecf7f3c6ab24aecc0db71e7 got position 5304

service1_master  | 2026-01-09 16:36:52,044 [INFO]: Getting HS index with TP#20462 for second descriptor (2 replica)

service1_master  | 2026-01-09 16:36:52,044 [INFO]:   Tried with HS index e769916436ddb214539256569900a3dd2b468223a1192e5107a2fc9a6f0c6887 got position 5210

service1_master  | 2026-01-09 16:36:52,044 [INFO]:   HSDir set remained the same

service1_master  | 2026-01-09 16:36:52,044 [INFO]: No reason to publish second descriptor for hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion

service1_master  | 2026-01-09 16:41:51,086 [INFO]: [*] publish_all_descriptors() called [*]

service1_master  | 2026-01-09 16:41:51,086 [INFO]:   Intro set not modified

service1_master  | 2026-01-09 16:41:51,086 [INFO]:   Our first descriptor has expired (3898 seconds old). Uploading new one.

service1_master  | 2026-01-09 16:41:51,096 [INFO]: Using srv dae5f6eb79c695789663c7d56c627dd38444875b0d64534b8661ab8dbee9e7f5 and TP#20461 (first descriptor)

service1_master  | 2026-01-09 16:41:51,189 [INFO]: Initialized hash ring of size 5774 (blinded key: b'DhGLJ6ztpkP8+NwVVCiNIsKk6lRCDcuj+N/Yvy9wl8o=')

service1_master  | 2026-01-09 16:41:51,189 [INFO]: Getting HS index with TP#20461 for first descriptor (1 replica)

service1_master  | 2026-01-09 16:41:51,189 [INFO]:   Tried with HS index 557e3f6b0c75b0240932a046987abec66bf616bc632291293bc65f33390a2ea5 got position 1930

service1_master  | 2026-01-09 16:41:51,189 [INFO]: Getting HS index with TP#20461 for first descriptor (2 replica)

service1_master  | 2026-01-09 16:41:51,190 [INFO]:   Tried with HS index 1607ebb098e886f10f9480982e3ea382663c4a2522598222593937f2223f6022 got position 480

service1_master  | 2026-01-09 16:41:51,190 [INFO]:   HSDir set remained the same

service1_master  | 2026-01-09 16:41:51,190 [INFO]: We got 12 intros from 4 instances. We want 8 intros ourselves (got: 8)

service1_master  | 2026-01-09 16:41:51,584 [INFO]: Service hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion created first descriptor (8 intro points) (blinding param: 2bd2db38a1bad942a0fffc20b6fc5d2c6933ef8182d400f051fd4047fcfa7d79) (size: 26419 bytes). About to publish:

service1_master  | 2026-01-09 16:41:51,584 [INFO]: Using srv dae5f6eb79c695789663c7d56c627dd38444875b0d64534b8661ab8dbee9e7f5 and TP#20461 (first descriptor)

service1_master  | 2026-01-09 16:41:51,620 [INFO]: Initialized hash ring of size 5774 (blinded key: b'DhGLJ6ztpkP8+NwVVCiNIsKk6lRCDcuj+N/Yvy9wl8o=')

service1_master  | 2026-01-09 16:41:51,620 [INFO]: Getting HS index with TP#20461 for first descriptor (1 replica)

service1_master  | 2026-01-09 16:41:51,620 [INFO]:   Tried with HS index 557e3f6b0c75b0240932a046987abec66bf616bc632291293bc65f33390a2ea5 got position 1930

service1_master  | 2026-01-09 16:41:51,620 [INFO]: Getting HS index with TP#20461 for first descriptor (2 replica)

service1_master  | 2026-01-09 16:41:51,620 [INFO]:   Tried with HS index 1607ebb098e886f10f9480982e3ea382663c4a2522598222593937f2223f6022 got position 480

service1_master  | 2026-01-09 16:41:51,620 [INFO]: Uploading first descriptor for hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion to ['5A1688FA7441B69920F8DC2A71265C57393CADE7', '32EE911D968BE3E016ECA572BB1ED0A9EE43FC2F', '876BA5C41AB7F4A8A99AACAB980C081DBA61711B', '6A562C3B1403AE530FD93CD7B84EA1DDBC1BB306', '0CAFFFE470E88AF156D6750B616995B3790F24EF', 'D281CCB4BEF52391DCD7E90E73B32E324043A944', '1AD5D1AB1932F683B6CE40D85021FB4CA830E7F2', '54D3DD124E52B1A474838A60005D10AA4CBF167A']

service1_master  | 2026-01-09 16:41:51,700 [INFO]:   Intro set not modified

service1_master  | 2026-01-09 16:41:51,701 [INFO]:   Our second descriptor has expired (3899 seconds old). Uploading new one.

service1_master  | 2026-01-09 16:41:51,704 [INFO]: Using srv 1bc8ad0ab9eb2f6b6b3d00bdc65bd5af5fc15595fbf6ca66019c91e2792fe722 and TP#20462 (second descriptor)

service1_master  | 2026-01-09 16:41:51,738 [INFO]: Initialized hash ring of size 5774 (blinded key: b'EDuPkqwQnV+uRWGqkBn5uKd19KVruNTjlf+tPwWgMaw=')

service1_master  | 2026-01-09 16:41:51,738 [INFO]: Getting HS index with TP#20462 for second descriptor (1 replica)

service1_master  | 2026-01-09 16:41:51,738 [INFO]:   Tried with HS index ebb7613a6c1ef26b738ec280e2f5d01235c0ef883ecf7f3c6ab24aecc0db71e7 got position 5304

service1_master  | 2026-01-09 16:41:51,738 [INFO]: Getting HS index with TP#20462 for second descriptor (2 replica)

service1_master  | 2026-01-09 16:41:51,738 [INFO]:   Tried with HS index e769916436ddb214539256569900a3dd2b468223a1192e5107a2fc9a6f0c6887 got position 5210

service1_master  | 2026-01-09 16:41:51,738 [INFO]:   HSDir set remained the same

service1_master  | 2026-01-09 16:41:51,738 [INFO]: We got 12 intros from 4 instances. We want 8 intros ourselves (got: 8)

service1_master  | 2026-01-09 16:41:51,909 [INFO]: Service hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion created second descriptor (8 intro points) (blinding param: 7af21d1b57034c3efddb679f8ee1454fea40ab62fe1ad3bb8bd19030719cf40e) (size: 26322 bytes). About to publish:

service1_master  | 2026-01-09 16:41:51,909 [INFO]: Using srv 1bc8ad0ab9eb2f6b6b3d00bdc65bd5af5fc15595fbf6ca66019c91e2792fe722 and TP#20462 (second descriptor)

service1_master  | 2026-01-09 16:41:51,941 [INFO]: Initialized hash ring of size 5774 (blinded key: b'EDuPkqwQnV+uRWGqkBn5uKd19KVruNTjlf+tPwWgMaw=')

service1_master  | 2026-01-09 16:41:51,941 [INFO]: Getting HS index with TP#20462 for second descriptor (1 replica)

service1_master  | 2026-01-09 16:41:51,941 [INFO]:   Tried with HS index ebb7613a6c1ef26b738ec280e2f5d01235c0ef883ecf7f3c6ab24aecc0db71e7 got position 5304

service1_master  | 2026-01-09 16:41:51,941 [INFO]: Getting HS index with TP#20462 for second descriptor (2 replica)

service1_master  | 2026-01-09 16:41:51,941 [INFO]:   Tried with HS index e769916436ddb214539256569900a3dd2b468223a1192e5107a2fc9a6f0c6887 got position 5210

service1_master  | 2026-01-09 16:41:51,942 [INFO]: Uploading second descriptor for hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion to ['A5E662AB4A4644E55D6C37D56468B57ADA8D0F6B', '868D28B145A379BE094390A52E61C063A891A1EB', 'AA876FF84E0F035F1D20BDF0150C045156168619', 'EBC856A495B361C4207229CB03EFE64637A5CE4F', '4916C94702DB9FE5A94B69657880FCF6D1B2A21B', '3D01CE600B2DC5C719684800E8C6990FE4CB8F9A', '071C2330B45FCFE8228161CAEED4E6AADE60841B', '81F4867EC51E06053346C0226FB82AC8D14BE4D2']

service1_master  | 2026-01-09 16:41:52,433 [WARNING]: Descriptor upload failed for frontend hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid to $32EE911D968BE3E016ECA572BB1ED0A9EE43FC2F~ndnr1 (UPLOAD_REJECTED)

service1_master  | 2026-01-09 16:41:52,557 [WARNING]: Descriptor upload failed for frontend hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid to $5A1688FA7441B69920F8DC2A71265C57393CADE7~AnonRelay13 (UPLOAD_REJECTED)

service1_master  | 2026-01-09 16:41:52,594 [WARNING]: Descriptor upload failed for frontend hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid to $6A562C3B1403AE530FD93CD7B84EA1DDBC1BB306~privatus (UPLOAD_REJECTED)

service1_master  | 2026-01-09 16:41:52,824 [WARNING]: Descriptor upload failed for frontend hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid to $0CAFFFE470E88AF156D6750B616995B3790F24EF~mgvx (UPLOAD_REJECTED)

service1_master  | 2026-01-09 16:41:52,825 [WARNING]: Descriptor upload failed for frontend hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid to $876BA5C41AB7F4A8A99AACAB980C081DBA61711B~TORKeFFORG13 (UPLOAD_REJECTED)

#-----------------------node1------------------------

service1_node_1  | Jan 08 18:50:32.828 [notice] Tor 0.4.8.21 running on Linux with Libevent 2.1.12-stable, OpenSSL 3.3.5, Zlib 1.3.1, Liblzma 5.6.2, Libzstd 1.5.6 and Unknown N/A as libc.

service1_node_1  | Jan 08 18:50:32.828 [notice] Tor can't help you if you use it wrong! Learn how to be safe at 


service1_node_1  | Jan 08 18:50:32.828 [notice] Read configuration file "/etc/tor/torrc".

service1_node_1  | Jan 08 18:50:32.830 [notice] OnionBalance: MasterOnionAddress hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion registered

service1_node_1  | Jan 08 18:50:32.831 [notice] Opening Socks listener on 127.0.0.1:9050

service1_node_1  | Jan 08 18:50:32.831 [notice] Opened Socks listener connection (ready) on 127.0.0.1:9050

#-----------------------node2------------------------

service1_node_2  | Jan 08 18:50:32.770 [notice] Tor 0.4.8.21 running on Linux with Libevent 2.1.12-stable, OpenSSL 3.3.5, Zlib 1.3.1, Liblzma 5.6.2, Libzstd 1.5.6 and Unknown N/A as libc.

service1_node_2  | Jan 08 18:50:32.770 [notice] Tor can't help you if you use it wrong! Learn how to be safe at 


service1_node_2  | Jan 08 18:50:32.770 [notice] Read configuration file "/etc/tor/torrc".

service1_node_2  | Jan 08 18:50:32.772 [notice] OnionBalance: MasterOnionAddress hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion registered

service1_node_2  | Jan 08 18:50:32.773 [notice] Opening Socks listener on 127.0.0.1:9050

service1_node_2  | Jan 08 18:50:32.773 [notice] Opened Socks listener connection (ready) on 127.0.0.1:9050

#-----------------------node3------------------------

service1_node_3  | Jan 08 18:50:32.718 [notice] Tor 0.4.8.21 running on Linux with Libevent 2.1.12-stable, OpenSSL 3.3.5, Zlib 1.3.1, Liblzma 5.6.2, Libzstd 1.5.6 and Unknown N/A as libc.

service1_node_3  | Jan 08 18:50:32.718 [notice] Tor can't help you if you use it wrong! Learn how to be safe at 


service1_node_3  | Jan 08 18:50:32.718 [notice] Read configuration file "/etc/tor/torrc".

service1_node_3  | Jan 08 18:50:32.720 [notice] OnionBalance: MasterOnionAddress hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion registered

service1_node_3  | Jan 08 18:50:32.721 [notice] Opening Socks listener on 127.0.0.1:9050

service1_node_3  | Jan 08 18:50:32.721 [notice] Opened Socks listener connection (ready) on 127.0.0.1:9050

#-----------------------node4------------------------

service1_node_4  | Jan 08 18:50:32.994 [notice] Tor 0.4.8.21 running on Linux with Libevent 2.1.12-stable, OpenSSL 3.3.5, Zlib 1.3.1, Liblzma 5.6.2, Libzstd 1.5.6 and Unknown N/A as libc.

service1_node_4  | Jan 08 18:50:32.994 [notice] Tor can't help you if you use it wrong! Learn how to be safe at 


service1_node_4  | Jan 08 18:50:32.994 [notice] Read configuration file "/etc/tor/torrc".

service1_node_4  | Jan 08 18:50:32.996 [notice] OnionBalance: MasterOnionAddress hrufera2kgutrjguthwigjrhenwisdjt2irnjyiwjdntjgnejyigjeid.onion registered

service1_node_4  | Jan 08 18:50:32.997 [notice] Opening Socks listener on 127.0.0.1:9050

service1_node_4  | Jan 08 18:50:32.997 [notice] Opened Socks listener connection (ready) on 127.0.0.1:9050

here an torrc of master:

HiddenServiceDir /var/lib/tor/hidden_service/

HiddenServicePort 80 127.0.0.1:6666

ControlPort 9051

CookieAuthentication 1

Log notice file /var/log/tor/notices.log

here an torrc of onionbalance nodes:

HiddenServiceDir /var/lib/tor/hidden_service/

HiddenServicePort 80 service1:8080

HiddenServiceVersion 3

HiddenServiceOnionbalanceInstance 1

NumEntryGuards 8

CircuitBuildTimeout 30

Log notice file /var/log/tor/notices.log

here is my services setup. i build docker images with tor and onionbalance:

FROM alpine:3.20 AS tor

RUN apk add --no-cache tor

CMD ["tor", "-f", "/etc/tor/torrc"]



FROM alpine:3.20 AS onionbalance

RUN apk add --no-cache tor git py3-cryptography py3-pip py3-pycryptodomex py3-setproctitle py3-wheel

RUN pip install onionbalance --break-system-packages

CMD ["sh", "-c", "tor -f /etc/tor/torrc & sleep 5 && exec onionbalance -c /etc/onionbalance/config.yaml"]

here is my docker-compose.yml:

services:

service1:

image: service1:latest

container_name: service1

expose:

      - "8080"

restart: unless-stopped

networks:

      - tor_service1



service1_node_1:

image: tor:latest

container_name: service1_node_1

volumes:

      - ./data/service1/node1/torrc:/etc/tor/torrc

      - ./data/service1/node1/data:/var/lib/tor

depends_on:

      - service1

restart: unless-stopped

networks:

      - tor_service1



service1_node_2:

image: tor:latest

container_name: service1_node_2

volumes:

      - ./data/service1/node2/torrc:/etc/tor/torrc

      - ./data/service1/node2/data:/var/lib/tor

depends_on:

      - service1

restart: unless-stopped

networks:

      - tor_service1



service1_node_3:

image: tor:latest

container_name: service1_node_3

volumes:

      - ./data/service1/node3/torrc:/etc/tor/torrc

      - ./data/service1/node3/data:/var/lib/tor

depends_on:

      - service1

restart: unless-stopped

networks:

      - tor_service1



service1_master:

image: onionbalance:latest

container_name: service1_master

volumes:

      - ./data/service1/onionbalance:/etc/onionbalance

      - ./data/service1/master/torrc:/etc/tor/torrc

      - ./data/service1/master/data:/var/lib/tor

depends_on:

      - service1_node_1

      - service1_node_2

      - service1_node_3

restart: unless-stopped

networks:

      - tor_service1



# similar for service2, service3, service4

networks:

tor_service1:

similar issues still without solution:

2

Hi,

At first glance there seems to be nothing wrong with your config, nor with the backend Tor nodes.

I would not rule out a malformed descriptor (like due to excessive number of introduction points), although you seem to have only a few backends, and Onionbalance checks whether the generated frontend descriptor is too big.

This might also be caused by networking problems.

This may be related to the following issue, for which we still don’t have a way to systematically reproduce: descriptor loading error (#9).

You mention that you have to manually restart Onionbalance in the frontend whenever this happens, which is an additional problem. Ideally, upload errors should not prevent further upload attempts. This problem is tracked here and a fix is proposed here, but needs further testing (feel free to test and report in the issue or merge request if it works for you).