I haven't read up on it but wouldn't this dox your Umbrel's IP address? Unless you are using it over TOR?

I don't think so. Most nostr apps are completely client side, which means you load the events from the local IP. I'm not 100% sure about snort though.

So you basically load the app from your umbrel, and then the app runs locally and fetches the events without communication with your umbrel

that's how i imagine it SHOULD work.