Private server setup checklist

Before you log in

Use a contact address and an SSH key comment that don't reuse your real name. Pay with Monero if the payment itself shouldn't sit on a public ledger.

We store the contact method and the order. We don't store your SSH key. The privacy policy is the list of what the account actually contains.

Access

Log in with the key from the order, then add your own key and disable password authentication.

Create a non-root sudo user, give root a long random password you store offline, and set PermitRootLogin no once the new user works. Test the new session before you close the old one.

Network

Enable a firewall and allow only the ports the service needs. On Ubuntu, ufw is enough for a single VPS.

If you can, reach SSH through WireGuard and close public port 22. The WireGuard guide is written for that kind of setup, with the VPN as the path in.

Logs you control

We don't log your server's traffic. Your web server, your application and journald will, if you let them.

Decide what you need. Shorten journald retention, and turn off access logs that record visitor IPs if the service doesn't need them. Don't collect data you would hate to explain later.

Identity hygiene

Don't clone a dotfiles repo that embeds your name. Don't apt-add a personal package archive tied to a public identity. Don't send mail from the server until port 25 is actually open and the DNS is ready.

Keep the wallet that paid the invoice separate from wallets you use under your name, if payment privacy was the point.

After the first hour

Install updates, reboot once, and confirm the service comes back. Write down the order reference somewhere that isn't only your inbox.

Backups are yours. The terms are explicit that we don't keep a copy of customer disks unless you've bought a backup service.

相关页面

• WireGuard guide
• Anonymous hosting
• Privacy policy