BTCPay 2.4.5 Makes Tor Optional for Docker Operators

BTCPay Server’s version 2.4.5 removes Tor from the components automatically included in its standard Docker deployment. Operators who use the server’s onion address must select Tor during their next setup or update to keep that access.

BTCPay announced the deployment change on Oct. 5, and the software release was recorded on GitHub on Oct. 6. The change affects existing Docker installations that previously received Tor through the core BTCPay Server configuration.

Tor remains available as an optional component. After updating to version 2.4.5, operators can add it with `sudo btcpay-fragments add opt-add-tor`. The command requires root access, reapplies the deployment setup and adds the Tor fragment to the configuration.

Existing Tor volumes and their stored data will be preserved. Operators must still include and run Tor in the updated deployment to maintain onion access. The `btcpay-fragments show` command displays saved, excluded and active fragments without changing the configuration.

Version 2.4.5 also blocks outbound HTTP requests to private-network destinations by default. The restriction applies to Lightning connections, LNURL requests, invoice notification URLs and webhooks. It is intended to reduce the risk of server-side request forgery, which can direct a server to contact internal services.

Operators that intentionally connect BTCPay Server to private services must add the approved destinations to the `ssrfexceptions` setting. BTCPay’s operator guidance recommends restarting the application and testing the affected integration after changing the setting.