Umbrel's onion address (addresses): how are they derived?

[yik77]

in case of recovery, or just for full clarity, how are my umbrel's tor addresses derived? Where do they come from? How (if at all) are they related to my 24 words and/or my password? Are the tor addresses of web UI, of mempool, of BTC node, and LN node related? (Each is different, as it should be). Are the tor addresses of RTL and Thunderhub related? Are they permanent? If not, what would make them change?

[lukechilds]

Currently all Tor hidden service addresses are generated randomly on first boot. They will last for the lifetime of your Umbrel. If an address is compromised you can rotate it manually by SSHing in and removing the private key for that hidden service and restarting your Umbrel. If you restore a new Umbrel, all your hidden service addresses will change.

We do plan to derive hidden service addresses deterministically from the main Umbrel seed, which will persists hidden services between restores and also allow rotating addresses via the UI, however it's not currently high priority.