I have seen recommendations to run the hidden service and the web server on different servers. I currently have the hidden service running in a second vm than the nginx server which points to an upstream Apache server. For better security I want to move the hidden service to a different server, and point it to the nginx server. Would the communication between the hidden service and the nginx server be encrypted? I don't think it would be. How should I achieve encryption between both of the servers?
Tor is like STunnel, i.e. it's working as a tunnel mapper - and the data that are going out of the Tor are as they sent, and in the case of HTTP - it's a plaintext. Your VM setup is completely separated from Tor setup itself, so - if you need to make it encrypted and work as simply as it can - use STunnel :) Don't forget to set the verification level to 3 and just enjoy your secure ride! Feel free to ask for more details if you need them!