A little guidance goes a long way.
Practical starting points for independent hosting, from your first SSH key to a resilient application stack.
38 documents available
Buy for the workload you have.
Choose an initial configuration from evidence, then leave a measured path to grow. A realistic estimate is more useful than the largest number in a plan ca…
Read documentGuidesFrom a clean image to a useful server.
A sensible initial setup makes future maintenance less stressful. Keep a record of the decisions and test each access change before closing the current ses…
Read documentGuidesKeep the machine yours.
Security is an ongoing routine: reduce exposed surfaces, limit privileges, patch deliberately and make recovery possible.
Read documentGuidesA backup matters when it restores.
Design a backup around the data you cannot recreate and the time your service can afford to lose. A successful upload is only the beginning.
Read documentGuidesChoose the route, not just the map.
Location decisions combine users, data, dependencies and resilience. Start with the paths that your application really uses.
Read documentGuidesVirtual server or a whole machine?
Choose the allocation model that matches your resource use, operational needs and budget. Each has a useful place.
Read documentGuidesA careful payment takes a minute.
Crypto transfers deserve a deliberate check because the network does not provide a conventional undo button.
Read documentGuidesAutomation with a clear stop button.
A good automation system has a narrow job, visible state and a predictable response to uncertainty.
Read documentGuidesMitigation is part of the system.
Understand what a network defence can absorb, what the application must handle and what the service agreement actually promises.
Read documentGuidesMake RDP a deliberate entrance.
A Windows server needs the same care as any public machine, with particular attention to remote login and software licensing.
Read documentGuidesPrivate hosting starts with a realistic threat model.
Work out which information you want to minimise and who can observe each part of the service.
Read documentGuidesWhat a no-KYC VPS does — and what still exists.
Minimal signup can be valuable when the limits are explained just as clearly as the benefits.
Read documentGuidesEvaluate a Nordic location with clear questions.
Legal placement and operational placement are related, but neither can be reduced to a country flag.
Read documentGuidesEncrypted backups you can actually restore.
Build an independent recovery path with a tool such as restic or Borg, then test the path before you need it.
Read documentGuidesThe first hour: a smaller attack surface.
A careful first session establishes access, updates and recovery without locking you out.
Read documentGuidesDomain privacy has more than one layer.
Understand the registry, registrar, DNS and certificate records before deciding what information to publish.
Read documentGuidesA careful Monero payment, from invoice to confirmation.
Pay only against a verified invoice and keep the minimum record needed to resolve a delayed transfer.
Read documentGuidesBitcoin on-chain and Lightning are different payment paths.
Use the payment type actually named by the invoice. An address and a Lightning invoice are not interchangeable.
Read documentGuidesMake an agent a service, not a forgotten terminal.
Run long-lived workers with explicit state, bounded permissions and a recovery plan.
Read documentGuidesA remote MCP server with a clear trust boundary.
Model Context Protocol connects clients to tools and resources. Hosting it safely means controlling who can call those tools and what each call can do.
Read documentGuidesMCP hosting without an unnecessary identity file.
Keep the account minimal while giving the protocol endpoint real authentication, authorisation and operational controls.
Read documentGuidesLocal inference, sized with evidence.
A model that fits on disk may still need much more memory at runtime. Start with a representative benchmark.
Read documentGuidesYour node, with careful wallet recovery.
A Bitcoin and Lightning setup combines data synchronisation, networking and funds that require their own backup discipline.
Read documentGuidesA payment server with custody designed deliberately.
BTCPay Server can let a merchant operate its own payment workflow. Separate payment detection, wallet control and store operations.
Read documentGuidesA resolver for your devices, not an open amplifier.
A private DNS resolver can give you control over resolution and filtering when access is deliberately restricted.
Read documentGuidesA small forge you can rebuild.
A Git service can keep repositories and collaboration under your control. Protect the code, the database and the build system separately.
Read documentGuidesA control plane for a private mesh.
Headscale can coordinate a compatible private network. Keep the control-plane, relay and access-policy roles distinct.
Read documentGuidesEmail you operate, with realistic delivery expectations.
Self-hosted mail needs DNS, reputation, filtering, monitoring and a recovery path beyond the server itself.
Read documentGuidesA federated community with an operator behind it.
Mastodon hosting combines a web application, background jobs, storage and community care.
Read documentGuidesYour Matrix home, with federation understood.
A homeserver controls an account namespace and participates in a wider network. Plan identity, retention and administration before inviting users.
Read documentGuidesA Monero node with a private control surface.
Choose full or pruned storage, separate public peer traffic from wallet RPC and keep the software source verifiable.
Read documentGuidesWorkflows that survive the next restart.
A self-hosted automation editor can connect powerful accounts. Treat its database and encryption key as critical infrastructure.
Read documentGuidesFiles you control, with recovery you can test.
Nextcloud combines a file store, database, application configuration and optional integrations. Keep them consistent.
Read documentGuidesA search interface with honest limits.
SearXNG can combine results from search engines through a service you operate. The upstreams, hosting network and browser still have roles.
Read documentGuidesA password vault deserves a careful host.
An unofficial compatible server can be compact, but account security, encrypted data and recovery are critical.
Read documentGuidesUseful measurements without unnecessary surveillance.
Choose the events needed to understand a service and retain less than an advertising platform would.
Read documentGuidesPublish an onion service with a narrow boundary.
An onion service offers a different reachability and identity model. It does not repair insecure application code.
Read documentGuidesA private tunnel with a clear purpose.
WireGuard can connect your devices to a server or private network. Its benefits depend on correct routing, DNS and endpoint security.
Read document