Tor hidden service key not persisted across container recreates

[macterra]

Problem

The Tor hidden service private key (/var/lib/tor/cln-service/hs_ed25519_secret_key) is not stored in a persistent volume. When the container is recreated (e.g. docker compose up -d --force-recreate, image update, or compose file change), a new key is generated and the .onion address changes.

This is a significant problem for Archon, where agents publish the node's .onion address as a Lightning service endpoint in their DID documents. A changed onion address invalidates every agent's published endpoint.

Current behavior

• /var/lib/tor/cln-service/ lives only in the container filesystem
• Container restart: key survives (container filesystem preserved)
• Container recreate: key is lost, new .onion address generated

Expected behavior

The Tor hidden service key should be persisted so the .onion address is stable across container lifecycle events.

Suggested fix

Store the hidden service directory inside the already-mounted /data/lightning volume, e.g.:

/data/lightning/tor-service/ -> /var/lib/tor/cln-service/

Either symlink or configure Tor's HiddenServiceDir to point to a path under /data/lightning.

Reproduction

# Note current onion address
docker exec archon-cln-mainnet-node-1 cat /var/lib/tor/cln-service/hostname

# Recreate container
docker compose up -d --force-recreate cln-mainnet-node

# Onion address has changed
docker exec archon-cln-mainnet-node-1 cat /var/lib/tor/cln-service/hostname

[macterra]

Fixed instead in archetech/archon#188