The stack · xmr.club

Curator's daily kit

What the curator actually uses end-to-end. Each carries a directory link so you can read the formal grade.

Role	Tool	Why
Privacy network	Mullvad VPN	Account-ID only signup, cash + XMR accepted, audited.
XMR wallet	Feather	Desktop XMR wallet — fast sync, hardware wallet support, Tor-aware.
XMR mobile	Cake Wallet	Mobile XMR with built-in non-KYC exchange.
Browser	Tor Browser	Default for any signup flow we audit.
Anonymous email	Proton Mail	Light-KYC tier — email required for upstream signups; we burn aliases.
Swap	kyc.rip / ghost	1ST PARTY — two-hop XMR-detour aggregator, no markup.
SIM / eSIM	Silent.Link	XMR-paid eSIM with no identity tied to data line.
Anonymous hosting	Njalla	Pseudonymous VPS + domain, crypto pay.
Search	SearXNG	Self-hostable metasearch front-end.

Each tool here is graded under /methodology — sponsorship doesn't move grade, only placement. Curator does not affiliate-stack on these.

Runtime

Cloudflare Workers — SSR + JSON APIs at the edge. Free tier comfortably covers current traffic.
Cloudflare D1 — SQLite at the edge. Providers + audit_log + sponsorships + review + provider_probe tables.
Cloudflare KV — hot caches: rate limits, idempotency keys, /ask classifier cache.
Cloudflare R2 — provider logos + OG images + public /data.json snapshot.

Frontend

Astro 6 — SSR-first renderer with React islands only where interactivity is required (search overlay).
@astrojs/cloudflare — worker adapter. dist/client → static, dist/server → worker entry.
No CSS framework — one hand-rolled stylesheet. monochrome base + green/orange accents.
No analytics, no fingerprinting — only CF request logs.

Data flow

Curator edits content/<category>.json in the source repo.
apps/web/scripts/seed-d1.mjs pushes the JSON into D1 via INSERT OR REPLACE. Idempotent. Status field on each provider supports active / draft / inactive.
Worker queries D1 at request time. Edge cache via Cache-Control. 14 categories × ~15 providers each = ~210 active rows currently.
Daily cron probes every provider's clearnet URL + Onion-Location header. Results land in provider_probe — surfaced on /status, /onion-audit, and the per-provider audit trail.

Open surfaces

/data.json · full dataset, CC-BY-4.0
/feed.xml + /feed.json · Atom + JSON Feed audit changelog
/sitemap.xml · multi-locale sitemap with xhtml:link alternates
/llms.txt + /llms-full.txt · /llm/<cat>/<id>.txt · AI ingestion target
/api/v1/... · public REST endpoints
/badge/<id>.svg · /og/<cat>/<id>.svg · /widget/<id> · /embed/<cat> · embeddable surfaces

Fork instructions

Clone the source repo. Install Node 22+ and pnpm.
wrangler d1 create kyc-rip-directory, update wrangler.jsonc binding id, run schema/migrate.
node scripts/seed-d1.mjs to push your content/*.json into D1.
pnpm build && wrangler deploy. Done — your fork is up.

Bun + SQLite + Caddy works as an offline alternative. SSR-first means the edge isn't load-bearing — it's a latency optimisation. See /colophon for the rationale and /heroes for the upstream projects this stack rests on.