After the call for more WebTunnel bridges I was setting up a few and would like to suggest an “easier” way for Debian 12 without Docker (the Docker image is outdated and has some flaws imho).
I assume a freshly installed Server with Debian 12 and a domain with at least a DNS A-record pointing to your servers IP address (AAAA should also be present, if you have an IPv6)
Become root if not already logged in as root:
sudo su -
and change directory to /root:
cd
Create the file update.sh with the following content:
apt autoremove
apt-get clean
apt-get update
apt-get upgrade
apt-get dist-upgrade
Execute the script to update your server: sh update.sh
Reboot if necessary (e.g. kernel-update) and login again as root.
Add the following to your /etc/apt/sources.list:
#### backports
deb http://deb.debian.org/debian bookworm-backports main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian bookworm-backports main contrib non-free non-free-firmware
Run the update.sh script again.
Install nginx and certbot:
apt-get install certbot python3-certbot-nginx
Edit /etc/nginx/sites-available/default
Search for the line with server_name and replace the underscore _ with your domain name.
server_name _; → server_name your.domain.tld;
Reload the nginx:
systemctl reload nginx
Check if your nginx is reachable via the domain in a Browser or else: http://your.domain.tld/
If not, check the firewall ufw status and use ufw allow 'Nginx Full' to unblock it, if ufw is installed.
Get a certificate and let certbot configure your nginx to use it:
certbot --nginx --register-unsafely-without-email -d your.domain.tld
Check in the browser again and see if everything is reachable via https://your.domain.tld now.
Now continue with instructions from Tor Project | WebTunnel Bridge 4.1:
Generate the random string:
echo $(cat /dev/urandom | tr -cd "qwertyuiopasdfghjklzxcvbnmMNBVCXZLKJHGFDSAQWERTUIOP0987654321"|head -c 24)
Take the code snipped below and replace $PATH with the random string created:
location = /$PATH {
proxy_pass http://127.0.0.1:15000;
proxy_http_version 1.1;
### Set WebSocket headers ###
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
### Set Proxy headers ###
proxy_set_header Accept-Encoding "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
add_header Front-End-Https on;
proxy_redirect off;
access_log off;
error_log off;
}
Put the code snippet in your /etc/nginx/sites-available/default
right below this block (watch for closing all brackets):
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
#Your snipped goes here#
Reload the nginx again:
systemctl reload nginx
Now the instructions follow Tor Project | Compile and run WebTunnel from the source but tor is installed from debian backports and not the tor repository:
apt-get install golang git
git clone https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webtunnel
cd webtunnel/main/server
go build
cp server /usr/local/bin/webtunnel
apt-get install tor/bookworm-backports
Edit /etc/apparmor.d/system_tor find /var/lib/tor/** r, and put /usr/local/bin/webtunnel ix, below it:
# During startup, tor (as root) tries to open various things such as
# directories via check_private_dir(). Let it.
/var/lib/tor/** r,
/usr/local/bin/webtunnel ix,
apparmor_parser -r /etc/apparmor.d/system_tor
Edit your Tor config file, located at /etc/tor/torrc and replace its contents with:
url=https://your.domain.tld/your_random_stringwith your WebTunnel url including your domain and secret path;<address@example.com>with your contact email address;Nickname WebTunnetTestwith the nickname of your bridge.- Uncomment the last line, if you have IPv6 connectivity.
BridgeRelay 1
ORPort 127.0.0.1:auto
AssumeReachable 1
ServerTransportPlugin webtunnel exec /usr/local/bin/webtunnel
ServerTransportListenAddr webtunnel 127.0.0.1:15000
ServerTransportOptions webtunnel url=https://your.domain.tld/your_random_string
ExtORPort auto
ContactInfo <address@example.com>
Nickname WebTunnelTest
SocksPort 0
Log notice file /var/log/tor/notices.log
#ORPort [::1]:auto
systemctl enable --now tor.service
systemctl restart tor.service
Now you might follow the official version again from section 7. Monitor your logs Tor Project | Compile and run WebTunnel from the source, but your logs will be here:
/var/log/tor/notices.log
Hope it helps to get certificates and renewals easier (a cron-job is automatically added) and makes the installation of tor less error prone. Yes, you can complain Debian backports are always behind official repo, but who ships tor 0.4.8.10 in Docker should not throw stones 
