I've read that it's best to host Tor and your website service on separate machines and then point your torrc file to your web host (host where website files are stored). It's quite possible that my Tor machine and web host will be geographically separate. Assuming my web host has a public IP of say 220.127.116.11, I would change my Tor host machine settings to:
HiddenServiceDir /Library/Tor/var/lib/tor/hidden_service/ HiddenServicePort 80 18.104.22.168:8080
My question: Does this mean that my Tor machine will have to go out onto the clearnet to connect to my web host and then receive the data back from the host and then serve it to my visitors, essentially making it a sort of "exit node" to connect to my web host? This would be very bad for security and anonymity. The data between the Tor host and web host will also be plain text unless SSL is implemented between the two, correct? Or how would you ensure encryption for the data from the web host back into Tor?
Would it not be possible (and better) to also set up Tor on the web host machine and then point the Tor host machine to the .onion link of my web host, thus keeping all the traffic inside the Tor network and essentially turning the Tor machine into a sort of proxy while still making it secure so that if my Tor service was to be compromised my webhost would still be safe? Like so:
HiddenServiceDir /Library/Tor/var/lib/tor/hidden_service/ HiddenServicePort 80 xxxxxxxxxxxxxxxx.onion:8080