user access to /var/lib/tor denied after fresh tor install on raspberry pi 4

Question

Raspberry PI 4 running Raspbian Full Install, I followed the instructions at https://community.torproject.org/onion-services/setup/install/ following the debian/ubuntu section but using the default repository as the docs for using the suggested repo said no support for arm 32 which means I just ran

sudo apt install tor

it created configuration docs under /etc/tor and it created the folder /var/lib/tor appar which seemed to be owned by debian-tor going back to the "Setup onion services" directions at https://community.torproject.org/onion-services/setup/ I installed nginx and verified a domain name would connect to it on port 80 from outside my network. I got to Step 2: Configure your Tor onion service and it is talking about copying keys and info to the folder /var/lib/tor, which I don't have access to. Per question 21492 I ran

ps -o user= -p $(pgrep -x tor)

to verify tor was running under debian-tor, which it was. The one answer (not accepted) suggested

sudo chown -R debian-tor:debian-tor /var/lib/tor

which didn't make sense to me but I tried it. I still couldn't access the directory. Then bringing my own very limited knowledge to bear I ran

sudo chown -R pi:pi /var/lib/tor

and now I have full access to that directory and can presumably complete the installation process. Unlike another question, 15185, I did not have issues starting tor, I just couldn't put my keys where they needed to go.

sudo systemctl restart tor

I configured torrc with

 HiddenServiceDir /var/lib/tor/test/
 HiddenServicePort 80 127.0.0.1:80

I created /var/lib/tor/test and copied the three files created by mkp224o (hostname, hs_ed25519_public_key, hs_ed25519_secret_key) to that folder and re-started tor. The onion address failed to load in a working tor browser on my phone. Re-assigned the /var/lib/tor back to debian-tor, restarted tor, same results. Not seeing any errors on screen, the folders /var/log/tor and /var/log/runit/tor are empty. The /var/lib/tor/state document has some info about circuits built and tor addresses sampled, no errors. That's about all the info I have. My questions are

1. did I create some terrible security risk or other issue by taking ownership of /var/lib/tor? I assume so otherwise it would not have been inaccessible in the first place.
2. do the instructions at torproject need to be updated?
3. where are my error logs or other clues I could follow concerning my test domain not being on the tor network?

Answer 1

First of all, run systemctl status as root and see the Tor service name, after that you will see the actual running log with journalctl -feu your-service-name