Pre-installed Debian 12 and 13 on every tier, with apt mirrors, unattended-upgrades and a stock kernel. No telemetry, no cloud-init phone-home, no NordBastion patches — close to a debootstrap of debian.org sources.
Pre-installed Debian 12 and 13 images on every tier — Sentinel to Citadel, no surcharge.
First-class apt sources, unattended-upgrades on by default, stock Debian kernel — no NordBastion patches you have to trust us about.
Pinned to one of four Nordic constitutional jurisdictions — Sweden, Finland, Norway or Iceland — paid in Bitcoin or Monero.
Debian moves slowly on purpose. A stable release ships with a frozen package set, gets five years of security support (two as the current stable, three as Long-Term Support), and breaks almost nothing across point releases. On a server you wanted to forget about — a side mail-relay, a Wireguard exit, a small Postgres — that is the right shape of operating system.
Bookworm ships PostgreSQL 15, nginx 1.22, OpenSSH 9.2 — versions that are already in production at thousands of sites and have been hardened by the wider community before they reach the Debian archive. You give up a few months of the very latest features and you gain a binary that has been beaten on harder than anything you would compile yourself.
Debian's social contract — "free software, no compromise" — sits next to NordBastion's anti-identity-collection doctrine more comfortably than any other major distribution. Both are explicit, written commitments to refuse a class of expedient behaviour. You can run Ubuntu or Arch on us; we just think Debian is the most honest pairing.
| Image | Slug | Use case |
|---|---|---|
| Debian 13 (Trixie) | debian-13 |
Current stable — the default pick for a new server in 2026. |
| Debian 12 (Bookworm) | debian-12 |
Previous stable, LTS until mid-2028 — for long-running production where you want zero surprises. |
| Debian 12 minimal | debian-12-min |
No graphical stack, no recommended packages — a 380 MB base for tightly-scoped sidecars. |
| Debian 12 + WireGuard | debian-12-wg |
Kernel module + wg-quick pre-configured — useful as a Nordic exit node or site-to-site endpoint. |
| Debian 12 + Docker | debian-12-docker |
Docker engine + compose plugin from the official Docker apt repo, no daemon-tuning required. |
Custom ISO mount available for any other Debian release on request — ticket-free via the panel.
Five-year support window, conservative package set, dist-upgrade path that almost always works. The default we recommend for production, sidecars and anything that should still boot in 2031 without intervention.
Same Debian-family apt tooling, plus the PPAs and vendor docs that overwhelmingly target Ubuntu LTS. If your runbook says "apt install" and "add-apt-repository", Ubuntu will be one less translation layer. A dedicated Ubuntu VPS page is forthcoming at /ubuntu-vps/.
Rolling release, no stable freeze, latest upstream kernel and userland. The cost is that you maintain the rolling discipline yourself — Arch breaks under neglect. A dedicated Arch Linux VPS page is forthcoming at /arch-linux-vps/.
2 vCPU, 4 GB RAM, 120 GB NVMe. A Debian 13 minimal here runs a Wireguard exit, a small Caddy reverse proxy, a Tor relay or a personal mail bridge with room to spare.
4 vCPU, 8 GB RAM, 240 GB NVMe. The sweet spot for one production application — a Bookworm Postgres at scale, an nginx + PHP-FPM stack, a Mastodon instance up to a few thousand users.
8 vCPU, 16 GB RAM, 480 GB NVMe. Comfortable for a Docker-Compose stack with database, queue, web and worker, or a self-hosted suite like Nextcloud plus mail plus search.
Full tier line — Sentinel · Garrison · Ravelin · Bulwark · Citadel — on /vps/.
For most workloads — a production application, a privacy sidecar, an operator's own infrastructure — Debian is the operating system that pays you back in years of silence. It boots, it patches itself, it does not surprise you. The pairing with a Nordic KYC-free host is doctrinal: two organisations that have made explicit written commitments to refuse identity collection and to ship only free software.
Pick Ubuntu if your runbook assumes it. Pick Arch if you genuinely need today's kernel. Pick Debian for everything else.
The questions operators actually ask before deploying a Debian server on a privacy-first host.
Debian 13 (Trixie) as the current stable default, Debian 12 (Bookworm) as the previous stable still in LTS until mid-2028, plus the minimal, WireGuard-preinstalled and Docker-preinstalled variants of 12. Older Debian releases are not in the panel by default but can be installed on request via the ISO-mount workflow.
Yes — Debian is in fact the distribution where this is most reliable. The standard apt-get update / apt-get dist-upgrade path between point releases works, and the documented Bookworm-to-Trixie procedure (release notes section 4) is supported and tested on NordBastion images. Snapshot the VPS first; a one-click rollback is a single panel action.
Stock Debian kernel, no NordBastion patches. The VM-side virtualisation drivers (virtio-net, virtio-blk, virtio-scsi) are the upstream Debian builds. We do not ship a custom kernel because every patch we add is a patch you have to trust us about — keeping it stock is part of the doctrine.
Base system, openssh-server, sudo, curl, wget, vim, nano, htop, ca-certificates, unattended-upgrades configured to apply security updates automatically, and a NordBastion-issued /etc/motd. No telemetry, no analytics agent, no cloud-init metadata server callouts. The image is intentionally close to a debootstrap of debian.org sources.
Yes. /etc/apt/sources.list defaults to deb.debian.org via the official CDN, which resolves to a Nordic mirror (typically ftp.se.debian.org or ftp.fi.debian.org) from any of the four bastions. You can pin a specific mirror in /etc/apt/sources.list at any time without breaking anything.
Yes. Add deb https://deb.debian.org/debian bookworm-backports main to /etc/apt/sources.list.d/backports.list and run apt update — the firewall does not block any Debian repository. Backports is the right way to get a newer kernel, newer PostgreSQL or newer nginx on a stable system without leaving stable for testing.
Yes. Install apt-transport-tor and tor, then point /etc/apt/sources.list at the official deb.debian.org onion (vwakviie2ienjx6t.onion as of 2026). Egress to .onion addresses is permitted from every NordBastion bastion. This is the recommended setup for an operator who wants apt traffic itself to be metadata-resistant.
The default image enables unattended-upgrades restricted to the security suite, so DSA-tagged advisories install automatically without rebooting. Kernel updates that require a reboot are flagged in /var/run/reboot-required — you decide when to apply them. We do not auto-reboot your server.
Private hosting, built in the North.
