@sun One approach I have taken in the past is to run the hidden service in an lxc container with no network connectivity. The container host is actually connected to the tor network, with the hidden service keys, but forwards the connections to the hidden service only to the container. The container itself has no network connectivity. You have to put everything the service needs on the container unless you want a set of containers on a bridge with no outward connectivity but, if it's something straightforward, no biggee.
This way, even if your application is breached, you have one more layer of protection between your actual network and the hidden service network.
I can't recall the exact details of how I did this but that's the thousand foot overview. I did one on both kvm for a full vm and proxmox for the lxc one, but you can probably use other approaches, so long as you can shove traffic across a dummy interface, unix socket, w/e.
@pwm@sun cosign this approach. the container/vm host deals with the hidden service and rendezvous over tor, the container or vm (i personally prefer vm) has an exposed unix socket, but nothing more. pre-baking the container/vm image is a requirement as pwm said so that part can be a bit dodgy for some. sun if you need a hand you have people willing to help. that is all. good day
@threat@pwm thanks guys. I am actually going full physical isolation. I have a separate network interface on the tor box, and connected to that is a raspberry pi taht has no network access except over that private interface to the tor box.