hidden service + reverse proxy not working

Question

i'm trying to set up a hidden service for an existing webserver that is behind a reverse proxy and i'm unable to get it work. i had no problems creating hidden services on servers with no reverse proxy so i thought that could be the issue. the reverse proxy mainly just takes care of https redirect.

following the tor project instructions: http://3gldbgtv5e4god56.onion/onion-services/setup/

torsocks curl http://3gldbgtv5e4god56.onion from the server works, so tor is working.

i tried letting tor connect to either the reverse proxy or the backend, matching the torrc HiddenServicePort entry to a virtual host on either server. when i load the onion address in a browser, i get this error:

Invalid Onionsite Address

[x] Browser | Network | Onionsite

The provided onionsite address is invalid. Please check that you entered it correctly.

Details: 0xF6 — The provided .onion address is invalid. This error is returned due to one of the following reasons: the address checksum doesn't match, the ed25519 public key is invalid, or the encoding is invalid.

in the tor/notices.log i see this error:

[warn] Could not mmap file "/var/lib/tor/cached-microdescs": Permission denied

[err] Couldn't map file that we just wrote to /var/lib/tor/cached-microdescs

right after Bootstrapped 0%: Starting, but then it finishes bootstrapping with no further problems.

i'm not sure if either error message is reliably pointing to my issue.

so:

• can i test my new address any other way? [surely its fine?]

• can i test that tor is able to receive incoming connections?

• wd this error maybe show up if the address was ok but not correctly configured to connect to a service?

• are any extra steps involved when configuring a hidden service with a reverse proxy?

• could it be a ports issue if my server is already running a clearnet service?

• is there a likely 'translation' of this error message?

i also just tried setting up a new hidden service from scratch, and then a new server block on the reverse proxy server, but now just pointing to a new webroot with a dummy index.html (which i can access locally with http://127.0.0.1:80), and i still get the same error.

EDIT:

• i'm installing LTS tor from debian stable. after installing i have enabled/run/restarted it with systemctl. i've not set 'run as daemon'

• permissions on /var/lib/tor are drwx--S--- 4 debian-tor debian-tor, and on the cached-microdescs they are -rw------- 1 debian-tor debian-tor

EDIT 2 as per steve's request for more detail:

• i'm not running tor from the commandline, no. just systemctl enable/restart

• i'm not in a container. i am on an arm box, no vm.

• torrc looks like

Log notice file /var/log/tor/notices.log
HiddenServiceDir /var/lib/tor/onion/
HiddenServicePort 80 127.0.0.1:80

• the server block i set up looks like

server {
    listen 127.0.0.1:80;
    server_name xyxyxyxzzzz.onion;
    root /var/www/onion;
    access_log off;

    index index.html index.html index.nginx-debian.html;    
}

• i got my onion address as recommended by the docs: sudo cat /var/lib/tor/onion/hostname.

• i don't actually know what mmapping a file is. the permissions for dirs + files are defaults on fresh tor install.

update

• Tor version 0.3.5.10.
• an onion my tor created (random/not configured in the webserver): uj23izqtsljsbsqrn2qfyvxl6t22az5nthhneufwjnutajd4pe2c43yd.onion
• also, if i create a random onion with no webserver config on a different box, i don't get the same error. if the torrc conf is for an open port (eg 80), i get a 404, and if i put a dead/closed port in the torrc file, i get the standard firefox "Unable to connect" error.