diff --git a/bin/psyconf b/bin/psyconf
index a518366..1084f0e 100755
--- a/bin/psyconf
+++ b/bin/psyconf
@@ -219,7 +219,8 @@ X
 	close O;
 	chmod 0644, $t;
 
-	my $ports="$c{_protocols_port_PSYC} $c{_protocols_port_jabber_S2S} $c{_protocols_port_applet} $c{_protocols_port_telnet} $c{_protocols_port_HTTP} $c{_protocols_port_IRC} $c{_protocols_port_jabber_clients} $c{_protocols_port_SMTP} $c{_protocols_port_NNTP} $c{_protocols_port_SPYC}";
+	my $ports="";
+	$ports .= "$c{_protocols_port_PSYC} $c{_protocols_port_jabber_S2S} $c{_protocols_port_applet} $c{_protocols_port_telnet} $c{_protocols_port_HTTP} $c{_protocols_port_IRC} $c{_protocols_port_jabber_clients} $c{_protocols_port_SMTP} $c{_protocols_port_NNTP} $c{_protocols_port_SPYC}" if $c{_protocols_use_encryption} ne 'only';
 	$ports .= " $c{_protocols_port_PSYC_encrypted} $c{_protocols_port_telnet_encrypted} $c{_protocols_port_HTTP_encrypted} $c{_protocols_port_IRC_encrypted} $c{_protocols_port_jabber_clients_encrypted} $c{_protocols_port_SMTP_encrypted} $c{_protocols_port_NNTP_encrypted}" if $c{_protocols_use_encryption};
 
 	my @adm;
@@ -382,6 +383,9 @@ provided together as the driver won't figure out the proper name for the IP
 number or vice versa. Please re-edit the psyced.ini to provide all variables.
 
 X
+	undef $c{_protocols_use_encryption}
+	  if $c{_protocols_use_encryption} eq 'no';
+
 	if ($c{_protocols_use_encryption}) {
 		my $t = $c{_basic_path_PEM_key};
 		if ($t) {
@@ -657,6 +661,49 @@ X
 		}
 	}
 
+# TORRC
+	$t = "$base/etc/tor";
+	mkdir($t);
+	$t = "$base/var";
+	mkdir($t);
+	$t = "$base/var/tor";
+	mkdir($t);
+	$t = "$base/etc/tor/torrc";
+	say "Generating control file $t ..\n";
+	rename $t, "$t~";
+	open O, '>', $t or die "Cannot write to $t";
+
+	print O <<X;
+# This torrc generated from $0
+# Don't edit unless you are no longer going to use the configuration tool.
+# Edit $conf instead, then run $0 again.
+
+ControlSocket $base/var/tor/.control
+DataDirectory $base/var/tor
+SocksPort 9050
+
+HiddenServiceDir $base/etc/tor/.onion
+X
+	my $i = 4;
+	foreach $n ( %c ) {
+		next unless $n =~ /^(_protocols_port_\w+)_hidden/;
+		print O "HiddenServicePort $c{$n} 127.0.0.1:$c{$1}\n";
+		say "Too many hidden service ports. Please use as few as possible.\n" if $i-- < 0;
+	}
+	print O <<X;
+
+#ControlPort 9051
+#Log notice stdout
+#DirReqStatistics 0
+#DNSPort 127.0.0.1:5353
+#SafeSocks 1
+X
+	print O <<X if $c{_optional_tor_nodes_entry};
+EntryNodes $c{_optional_tor_nodes_entry}
+X
+	close O;
+
+# ARCHETYPE
 	chdir "$sandbox/net/place" or die "Where is my net/place? $!";
  
 ## start of former archetype.pl
diff --git a/config/psyced.ini b/config/psyced.ini
index 1e9969e..61f6871 100644
--- a/config/psyced.ini
+++ b/config/psyced.ini
@@ -1,5 +1,3 @@
-; $Id: psyced.ini,v 1.22 2008/01/22 09:30:06 lynx Exp $
-;
 ; this is the sample psyced configuration file. in fact it is the one
 ; being used for the gentoo default installation. you can use this if
 ; you are doing manual installation, otherwise 'install.sh' will create
@@ -64,6 +62,12 @@ _language_default = en
 ;_host_name = host
 ;_host_domain = example.org
 ;
+; If you want to run psyced with federation over Tor
+; input the hidden service hostname as provided by Tor
+; in etc/tor/.onion/hostname first time you run it
+;_host_name = <yourPublicKeyHash>
+;_host_domain = onion
+;
 ; You don't *have* to provide this. If nothing is given
 ; psyced will figure out its hostname and/or dynamic
 ; IP address by itself
@@ -85,24 +89,48 @@ _list_nicks = admin
 ;_password_default = my secret
 
 [_protocols]
-; if you don't have TLS or SSL simply set this to
-; no and all the _encrypted ports will be ignored
-_use_encryption = 1
+; If you don't have TLS or SSL simply set this to
+; "no" and all the _encrypted ports will be ignored.
+; This is also a good choice if you intend to use
+; TLS autodetection (see psyclpc).
+_use_encryption = yes
+; If you want ONLY the TLS ports and none of the
+; unencrypted ones, say "only" - but don't do this
+; if you want to use Tor federation.
 
 [_protocols_port]
+; If you want your server to be reachable via a Tor
+; hidden service, psyconf will generate a suitable
+; torrc for you. The port numbers shown as _hidden
+; will be mapped to the Tor hidden service. Avoid
+; having too many of them. For PSYC federation to
+; work properly over Tor, you need your node to use
+; the .onion hostname instead of a traditional one.
+; See above. If you leave that out, then your node
+; will be reachable via Tor, but not connect to other
+; PSYC nodes in the Tor network. Finally, if you want
+; to federate over Tor, you need to add "torsocks" in
+; front of the psyced wrapper script. And remember this
+; is experimental as hell.
+
 _PSYC = 4404
+_PSYC_hidden = 4404
 _PSYC_encrypted = 9404
 _telnet = 2323
+;_telnet_hidden = 23
 _telnet_encrypted = 9992
 _jabber_S2S = 5269
 _jabber_clients = 5222
 _jabber_clients_encrypted = 5223
 _IRC = 6667
+_IRC_hidden = 6667
 _IRC_encrypted = 9999
 _HTTP = 33333
+;_HTTP_hidden = 80
 _HTTP_encrypted = 34443
 _applet = 2008
 _SMTP = 2525
+;_SMTP_hidden = 25
 ;_SMTP_encrypted = 4656
 
 ; Experimental protocol services