i2pforge

i2pforge gives any service you already run a second front door on the I2P network. You point it at your web server, or your SSH box, or a Monero node, and it hands you back an address that ends in .b32.i2p. People reach your service through that address over I2P. Your server's real IP address never appears anywhere.

You do not need to know anything about I2P to use it. You do not edit config files or run I2P software yourself. i2pforge is a small, locked-down container that runs the I2P router for you and does one job well.

What you get

A working .b32.i2p address for your service, usually within a minute.
No exposed IP. Visitors connect to the I2P address, not to your machine.
A container that is hard to attack: it drops every Linux privilege it can, runs read-only, opens no management ports, and keeps no logs on the host.
Your address is yours to keep. It lives in one folder you back up. Move that folder to a new machine and the same address comes back.

What it is not

It is not a way to browse I2P. i2pforge publishes a service; it does not act as a proxy for your own outbound traffic.
It is not a Tor tool. If you want a Tor onion address instead, use its sibling project, HiddenForge. The two work the same way and you can run both.
It does not hide a badly built backend. If your own web app leaks your IP in a header or a link, i2pforge cannot fix that for you. See the OPSEC page.

Quickstart

You need Docker installed and running. That is the only prerequisite.

The easiest path is the setup wizard, which walks you through a few questions and writes everything for you. Run it from a terminal:

./scripts/i2pforge setup

Or, if you just want one address for one HTTP backend and prefer to skip the wizard, run the container directly. Replace web:80 with your backend's address on the Docker network:

mkdir -p ./i2p-keys
docker run -d --name i2p \
    --cap-drop ALL --cap-add CHOWN --cap-add DAC_OVERRIDE \
    --cap-add FOWNER --cap-add SETUID --cap-add SETGID \
    --security-opt no-new-privileges:true --read-only \
    --tmpfs /tmp:rw,noexec,nosuid,size=64m \
    --tmpfs /etc/i2pd:rw,noexec,nosuid,size=8m \
    --tmpfs /var/lib/i2pd:rw,noexec,nosuid,size=256m,uid=100,gid=101,mode=0700 \
    -v "$PWD/i2p-keys:/var/lib/i2pd/destinations" \
    -e I2P_EEPSITE="web:80" \
    sambent.dev/sam/i2pforge:latest

# Wait about 30 to 60 seconds, then read your address:
docker logs i2p 2>&1 | grep -A1 "EEPSITE READY"

The address is printed in the logs and also saved to ./i2p-keys/eepsite.b32.i2p. Back up the whole ./i2p-keys folder. That folder is your address. If you lose it, the address is gone for good and there is no way to get it back.

Where to go next

How it works explains I2P addresses, destinations, and tunnels in plain terms.
The installer covers the click-through desktop app if you would rather not use a terminal.
Backing up your key is short and important. Read it before you rely on the address for anything.
Encrypt at rest shows how to protect the key with a passphrase.
Verifying the image proves the container is exactly what the source says.
Troubleshooting and the FAQ cover the common snags.
OPSEC mistakes is the page to read if anonymity actually matters to you.