The Umbrel step is where most of these guides quietly break: the daemon bound to loopback answers fine over the LAN but refuses the container that tries to reach it, and the error text points at the credentials while the actual fault is the listener address. The other half is privacy, not plumbing - a full node that your wallet queries without Tor links your own UTXO set to your IP every time it opens. Your flow covers the first one; is the node reached over Tor once it runs?