Security vulnerabilities for http login of self-hosted nextcloud server over tor?

Question

After setting up my own Nextcloud server over tor, using a private .onion domain, and http, I am unsure about the security implications of using http in this setup.

I learned one can buy a .onion https certificate at digicert, and I expect one may be able to use a self-signed certificate. However, I would like to minimize costs, and I have not yet been able to make self-signed certificates work in practice.

Assumptions

To limit the scope of the question, I make the following assumptions:

0. Malicious actors can see the outgoing traffic towards tor, over wifi.
1. A malicious tor-exit node can see the un-encrypted http data that is submitted into the .onion domain, upon loggin in via tor.
2. The malicious tor-exit node does not need to know where my nextcloud server is located, if they can intercept my username and password that is submitted over tor over http, as they can re-use them over tor, on the same .onion themselves.

Doubts

I am not sure whether it would be the exit node that presents me the .onion site and login, or whether it is the "input node" to which my server connects that needs to be compromised for an adversary to intercept my login credentials. (Or both, or either of the two).

Question

Can malicious actors, and/or malicous tor-node operators directly read the Nextcloud password and username that I submit over http://some_onion_domain.onion, or do they require an additional vulnerability/exploit/majority to actually read the passwords?

And if yes, are malicous actors monitoring my wifi able to do so, or only malicious tor-node operators, or both, or also some other actors outside the tor-network?

Update: self-signed SSL cert

In the meantime, this script was written that creates a self-signed certificate. Note, I am involved in writing that script.

Answer 1

Can malicious actors, and/or malicous tor-node operators directly read the Nextcloud password and username that I submit over http://some_onion_domain.onion, or do they require an additional vulnerability/exploit/majority to actually read the passwords?

Malicious tor relay operators cannot read your Nextcloud username or password that you submit to http://some_onion_domain.onion. Onion service traffic is encrypted from the client's tor proxy to the onion service's tor proxy. No tor relay can see any of the http traffic, even when you're not using tls/https. Onion service connections don't have an "exit" relay like non-onion connections do. Onion service connections are handled differently.

And if yes, are malicous actors monitoring my wifi able to do so, or only malicious tor-node operators, or both, or also some other actors outside the tor-network?

Neither anyone monitoring your wifi nor tor relay operators should be able to read any of the http contents. As long as your client tor proxy is running on the same computer as the client, and the onion service's tor proxy is running on the same computer as the web server, then no one should be able to read any of the plaintext traffic.

To limit the scope of the question, I make the following assumptions:

1. Malicious actors can see the outgoing traffic towards tor, over wifi.

They can see the encrypted traffic, but not the plaintext http contents.

2. A malicious tor-exit node can see the un-encrypted http data that is submitted into the .onion domain, upon loggin in via tor.

No, a tor relay cannot see the un-encrypted http data for onion services. They can see un-encrypted http data for non-onion services.

3. The malicious tor-exit node does not need to know where my nextcloud server is located, if they can intercept my username and password that is submitted over tor over http, as they can re-use them over tor, on the same .onion themselves.

No, a malicious tor relay should never learn the http contents, or the onion address that you're connecting to. So even if they could learn the http contents, they wouldn't know what onion service address to connect to.