Been using start9 and always had Envoy connect to my fulcrum node using my .onion address. Just recently updated my start9 to 0.4.0. The new version now uses tor as a separate service and does not come with it built in. Is Envoy only compatible with a .onion address or can it connect to a mydomain:port address? If it can connect, what would be the recommended connection as I have 5 total. Not sure of those which is the best/more secure?
Envoy can connect over either a .onion address or a normal host:port, so it’s not Tor-only. But for your setup the Tor address is still the best option. StartOS 0.4 splits Tor out into its own service rather than removing it, and from your screenshot it looks like there’s a Tor section lower down on that same Electrum (SSL) screen (just below what’s visible in the image). If you scroll down to it, you should find your .onion address there, that’s the one to use in Envoy, exactly as before. Keep Envoy set to Improved Privacy and it’ll connect over Tor.
On the five “Local” entries in your screenshot (the IPv4/IPv6/mDNS ones): those are local-network addresses, so they only work when your phone is on the same Wi-Fi as your Start9, not when you’re out and about. They also use your Start9’s own certificate, which Envoy may not accept over SSL (this is untested right now). The “Public” option would work from anywhere but requires exposing your node to the internet, which is less private, so I’d avoid it unless you specifically need it.
So: check that Tor section for your .onion, keep Improved Privacy on, and you should be back to your previous, most-private setup.
I’ll be sticking with my tor connection. Thanks for explaining it, I appreciate it.
The previous versions only supported Tor, which made accessing your server from outside your home network somewhat limiting. While I appreciated the strong focus on privacy, I found it a bit inconvenient.
With the 0.4.0 update, I’d definitely recommend using StartTunnel. I’m running it on the cheapest VPS I could find, and it’s been a great balance of privacy and convenience. As you’d expect, it works great with Envoy as well. It’s also made it much easier to access my Lightning node, Nextcloud, and Vaultwarden securely when I’m away from home.
Does it matter if its ssl (https) or non ssl (http) for the onion address for both the node address and explorer address in Envoy?
Node address: Envoy doesn’t use http/https here, it uses tcp:// or ssl://. If you paste a .onion with no prefix, Envoy assumes tcp://. If the address ends in :50002, or you add :s on the end, it switches to ssl://.
What matters is that this matches the interface the onion address came from. Your screenshot was the Electrum (SSL) page, so if that onion is the SSL interface you’ll want the :50002 port (or the :s suffix) so Envoy connects with ssl://. If you grab the onion from the plain Electrum (TCP) interface instead, paste it as-is and Envoy will use tcp:// on port 50001.
Worth knowing that over Tor the connection is already encrypted end to end by Tor itself, so plain TCP isn’t leaking anything. SSL on top is belt-and-braces rather than necessary, and self-signed certificates can sometimes cause trouble. If one doesn’t connect, try the other.
Explorer address: this one does use http/https, and Envoy requires the prefix. For an onion explorer, http:// is correct and expected. Just the base URL, no trailing slash and no /tx/, as Envoy adds that itself.