Guides
Guides
Step-by-step, with commands that work. 10 guides.
These 10 guides cover the operations that actually matter on a new server: hardening SSH and the firewall, standing up WireGuard, paying anonymously, running mail that reaches the inbox, building a production Docker stack, and encrypting a disk with a key the provider never holds. Every command is copy-pasteable and tested against current distributions.
Secure a new VPS in 10 minutes
Five changes eliminate essentially every automated attack against a new server: key-based SSH with passwords disabled, no direct root l…
Updated June 18, 2026
Set up a WireGuard VPN on a VPS in 5 minutes
A working WireGuard server needs four things: a key pair, a wg0 interface configuration, IP forwarding with NAT, and one peer block per…
Updated May 30, 2026
How to pay for hosting with Monero, step by step
Acquire XMR through an atomic swap or a decentralised exchange, hold it in a wallet you control, then select Monero at checkout and sen…
Updated July 2, 2026
The anonymous VPS purchase checklist
Anonymity is a chain, and it breaks at the weakest link. Four steps close the ones that matter: a no-KYC provider, a signup connection …
Updated July 11, 2026
A self-hosted mail server that actually reaches the inbox
Installing a mail server is easy; being trusted by receivers is not. You need outbound port 25, a PTR record matching your banner hostn…
Updated June 4, 2026
Private DNS with AdGuard Home and Unbound
AdGuard Home filters and serves DNS-over-HTTPS; Unbound behind it performs full recursion so no upstream resolver ever sees your querie…
Updated May 12, 2026
A production Docker Compose stack on a VPS
A workable production stack is Caddy for automatic TLS, your application, PostgreSQL and Redis, defined in one Compose file with named …
Updated June 27, 2026
A correct nftables firewall, including IPv6
nftables replaces iptables with a single unified ruleset that covers IPv4 and IPv6 together through the inet family. A correct base pol…
Updated April 22, 2026
Multi-region failover with a WireGuard mesh
Three instances in three countries, meshed over WireGuard, with the application bound only to the mesh and a health-checked DNS record …
Updated July 8, 2026
Full-disk encryption on a VPS with remote unlock
LUKS2 with a dropbear SSH daemon in the initramfs lets you encrypt the root filesystem and supply the passphrase remotely at every boot…
Updated June 11, 2026