Twenty-eight long-form guides on anonymous VPS hosting, crypto payment, no-KYC posture, Nordic jurisdiction, encrypted offsite backups, AI-agent and MCP runtimes, local language models, and self-hosting the privacy stack — a BTCPay checkout, a Git forge, a Headscale mesh VPN, cookieless web analytics, Vaultwarden, Nextcloud, mail server, Matrix, SearXNG, n8n, a Monero node, a private DNS resolver, Tor, WireGuard, Bitcoin Lightning, Mastodon. No affiliate links, no "best of" listicles, no sponsored mentions — just the questions a careful customer would actually ask their host.
Legal claims are tied to named statutes (Tryckfrihetsförordningen, Sananvapauslaki, Section 100, IMMI), wallet recommendations are tied to the wallet documentation, network claims are tied to RFCs and operator practice. If we cannot cite it, we do not assert it.
No wallet, exchange or peer-host link on these pages is an affiliate link. If a guide says "use Feather", it is because Feather is the right wallet, not because we get $7 every time someone installs it. The same applies to peer hosts on the /compare/ pages.
Crypto wallet UIs change, statutes are amended, network topologies shift. Every guide shows the date it was last fact-checked. If a guide has not been reviewed in twelve months it carries a stale-data warning at the top.
Start with the pillar if you are new to privacy hosting. Skip to the how-to-pay guides if you already know what you want. The Nordic jurisdiction reference is for the careful reader who wants to read the statute. The self-host guides assume the VPS is already provisioned.
A complete walk-through of what "anonymous" actually means for a virtual private server: the three independent layers (signup, payment, network), the legal frame around each, the operational mistakes that quietly de-anonymise a server, and the questions that separate a real KYC-free host from a marketing-only one.
Five steps from "I have never used Monero" to "my Stockholm VPS is booted and paid for in XMR" — pick a wallet, acquire XMR, scan the panel QR, wait for the network confirmation, order a server. Tested on Feather, Cake and the official Monero GUI.
Bitcoin on-chain is settled in about ten minutes; Lightning is settled before you finish reading the QR. This guide covers both — when to use each, how to top up from a self-custodial wallet, and how to handle the rare LN-channel routing failure.
What KYC is, why most hosts require it, why a small slice of the market deliberately does not, what the legal status of KYC-free hosting actually is, and how to read a "no-KYC" promise critically — including the four questions that tell you whether a host means it or is just marketing.
Sweden, Finland, Norway and Iceland — four constitutional press-freedom regimes, each with a different shape. This guide is the deep-dive: the actual statutes, the actual case-law, the actual reachability by EU/US legal process, and what each one means for a server sitting inside it.
Five steps from "no server" to "my own personal VPN" — KYC-free signup, crypto-paid, no third-party VPN provider in the trust chain. Tested on Debian 12 with WireGuard 1.0+ in the mainline kernel. The trust chain shrinks by one party; the cost stops being a $15/month subscription.
Five steps from provisioning a Nordic VPS to a live, 56-character v3 .onion address reachable only through Tor. Two lines in torrc, server-banner stripping, Vanguards-lite, and Onion-Location auto-redirect on the clearnet companion.
Bitcoin Core + LND (or Core Lightning) on a KYC-free Nordic VPS — pruned or full, Tor-routed, BTCPay-ready. The complete walk-through from picking a tier through opening the first three channels, with the channel-management caveats nobody mentions until you hit them.
Six steps to your own Mastodon instance, federation-ready, on Ravelin tier. Docker Compose, anonymous domain registration paths, SMTP relay trade-offs, TLS via Let's Encrypt, and the closed-vs-open registration decision you should make on day one.
Vaultwarden is the lightweight, Rust-based, Bitwarden-compatible password server. Five Docker commands, one HTTPS reverse proxy, one backup cron — and the credential vault of every account you own lives on metal you rent. Plus the metadata layer: why a KYC-free host matters for a password vault even when the contents are client-side encrypted.
Nextcloud is the open replacement for the Google Workspace stack — file sync, photo backup, contacts, calendar, collaborative documents, end-to-end encrypted chat and video. The All-in-One Docker install, mobile sync, Office Online, Talk, S3 external storage, the backup story and the Nordic jurisdiction angle.
Self-hosted email in 2026 is gated on three brick walls — outbound port 25, IP reputation, PTR alignment — before any software is installed. The three serious stacks compared, the DNS records that must align perfectly, the warm-up period at Gmail and Outlook, and the no-KYC host that opens port 25 by default.
Matrix is what email would look like if it had been designed for chat in the open-protocol era. Synapse as the homeserver, Element as the client, PostgreSQL as the store, federation enabled, end-to-end encryption by default — and the metadata-layer reasoning for why the host the homeserver lives on matters.
SearXNG fans queries out to 70+ upstream search engines without forwarding your IP or identity. Three Docker commands, one reverse proxy, the IP-reputation wall that makes hyperscaler IPs fail, browser-default integration on desktop and mobile, and the Perplexica AI-search front-end that turns the whole thing into a private ChatGPT-search analogue.
Eight concrete steps to harden a fresh Nordic VPS in under one hour — SSH key-only, custom port, firewall baseline, unattended-upgrades, fail2ban, snapshot, recovery doc. The universal pre-launch checklist before any workload goes live, regardless of what the workload is.
Move your MCP server from localhost to a public, no-KYC VPS: pick a plan, install your server, put it behind TLS, expose the streamable-HTTP endpoint, add OAuth, and host the agent card. Paid in crypto, with no identity document anywhere in the chain.
What no-KYC MCP server hosting actually is, why AI-agent infrastructure should not carry your identity, and how to deploy an MCP server on a Nordic KYC-free VPS paid in crypto — no email verification, no card, no ID.
The four failure modes that stop an agent living on a laptop, then the runtime that fixes them: sizing the box to the agent shape, systemd and Docker restart policies, the crash-loop trap, secrets that must never reach the image, scheduling, spend caps — and what a KYC-free host does and does not protect.
A language model answering on your own hardware, with no graphics card and no API key. The one division that predicts your tokens per second before you buy the box, which model fits in 4, 8, 16 or 32 GB of RAM, the authentication Ollama does not ship and how to add it, embeddings and retrieval where a CPU genuinely wins, and an honest list of the jobs that do not fit.
Six steps from an unprotected server to a verified encrypted repository on a second machine in a second jurisdiction — what to put in the include list, restic and Borg compared, database dumps that restore clean, a systemd timer with a retention policy, an append-only repository that a compromised server cannot erase, and the restore drill that turns all of it into a guarantee.
Six steps from a bare Debian box to a TLS-terminated n8n on your own domain — the Docker Compose stack with Caddy and PostgreSQL, the encryption key that destroys the instance when it is lost, webhooks that fire behind a reverse proxy, queue mode with Redis workers, and why the machine holding every API key you own should not be rented under your legal name.
A remote node cannot read your balance — Monero wallets scan client-side — but it does see your IP hand it the transaction you just signed. Six steps to close that gap: full-versus-pruned disk maths, verified binaries, a hardened monerod.conf with two RPC listeners, the initial-sync reality, reaching the node over SSH, WireGuard or a v3 onion, and broadcasting over Tor.
Every domain your devices look up is a timestamped line in someone else's file. Six steps to move that file onto a machine you own: recursion from the root instead of forwarding to a public resolver, AdGuard Home filtering in front, DNS-over-TLS and DNS-over-HTTPS on a real certificate, a port 53 that never faces the internet, and an honest list of what a private resolver still does not hide.
A private repository is a dated record of what you build, with whom, and how far along you are — and on a platform that record belongs to a company. Six steps to move it: choosing between a bare repository and a full forge, Forgejo with PostgreSQL behind Caddy, SSH push with signed commits, an Actions runner that never sees production secrets, push mirrors, and the backup that restores the conversation and not only the code.
A mesh VPN needs somebody to hand out the keys, and that somebody holds the map: every device you own, every user, and the address each one is dialling from right now. Six steps to hold it yourself — Headscale behind Caddy, pre-authentication keys, access rules written down, MagicDNS pointed at your own resolver, a subnet router and an exit node, and the embedded DERP relay that stops the fallback path from belonging to someone else.
Every payment gateway sits between you and your customer, takes a percentage, keeps the list of who paid you what, and reserves the right to stop. Six steps to remove it: the node shape that decides the whole budget, the domain that must resolve before the installer runs, the watch-only key that lets the server watch but never spend, the inbound-liquidity problem that makes a new Lightning node unpayable, and the backup rule that Lightning breaks.
Every guide in this library opens with "point a subdomain at it" and none of them says where the domain comes from. It is the one part of a self-hosted stack that is published on purpose. Six steps: the four separate records a registration really creates, the registries that will refuse you and the ones that publish your name anyway, paying in Monero without the exchange undoing it, the certificate log that lists every hostname you ever asked for, and the renewal that is the whole security model.
Analytics is the last third-party tag most people keep, and it is the one that sees every reader on every page. Six steps to replace it with a counter you own — the four tools and the database that quietly sets the bill, one subdomain and three ports, a Compose stack behind Caddy, the first-party path that survives filter lists, the two separate laws that decide whether you still need a consent banner, and the access log that undoes the whole exercise.
A jurisdictional explainer on no-KYC vs GDPR, a Monero-vs-Zcash-vs-Wownero crypto-payment comparison, and a Matrix bridge guide (Telegram, Discord, IRC) are in editorial. If there is a topic you want covered, drop a line through the panel.
Private hosting, built in the North.
