I have seen recommendations to run the hidden service and the web server on different servers. I currently have the hidden service running in a second vm than the nginx server which points to an upstream Apache server. For better security I want to move the hidden service to a different server, and point it to the nginx server. Would the communication between the hidden service and the nginx server be encrypted? I don't think it would be. How should I achieve encryption between both of the servers?
The communication between the two web server are not encrypted. Instead of going through the trouble of create SSL certs just use a reverse SSH connection and proxy_pass in Nginx.