I access Lightning Terminal locally on my node (https-//localhost:8443/home) to setup Lightning Node Connect passphrases for use on my phone, laptop & node itself. I then use https-//terminal.lightning.engineering/ that connects to my Tor-only node to open/close channels and update fees to optimize routing. You could also setup a Tor hidden service for https-//localhost:8443/ to access it remotely if you need to create more passphrases while away from your node☕
Discussion
I think that the connections from the node to terminal.lightning.engineerig are in clear net, exposing your IP to lightning.engineering at least. Also, to whoever is watching your traffic is clear that you're running a node.
Is there a way to avoid that?
Possibly so... The best solution then imo would be to run RTL instead (Ride The Lightning) via a Tor hidden service if you don't like lncli. You'd also want to open your channels in private mode using only taproot addresses but I haven't reached that level (of paranoia) yet🐸