隐私托管实战手册。
由主机撰写，而非联盟合作方。

01 · Pillar · 12 min read

Anonymous VPS hosting — the 2026 pillar guide

A complete walk-through of what "anonymous" actually means for a virtual private server: the three independent layers (signup, payment, network), the legal frame around each, the operational mistakes that quietly de-anonymise a server, and the questions that separate a real KYC-free host from a marketing-only one.

阅读指南

02 · How-to · 8 min read

How to pay for a VPS with Monero — step by step

Five steps from "I have never used Monero" to "my Stockholm VPS is booted and paid for in XMR" — pick a wallet, acquire XMR, scan the panel QR, wait for the network confirmation, order a server. Tested on Feather, Cake and the official Monero GUI.

阅读指南

03 · How-to · 9 min read

How to pay for a VPS with Bitcoin and Lightning

Bitcoin on-chain is settled in about ten minutes; Lightning is settled before you finish reading the QR. This guide covers both — when to use each, how to top up from a self-custodial wallet, and how to handle the rare LN-channel routing failure.

阅读指南

04 · Explainer · 10 min read

No-KYC VPS hosting, explained

What KYC is, why most hosts require it, why a small slice of the market deliberately does not, what the legal status of KYC-free hosting actually is, and how to read a "no-KYC" promise critically — including the four questions that tell you whether a host means it or is just marketing.

阅读指南

05 · Reference · 14 min read

The four Nordic jurisdictions, for hosting

Sweden, Finland, Norway and Iceland — four constitutional press-freedom regimes, each with a different shape. This guide is the deep-dive: the actual statutes, the actual case-law, the actual reachability by EU/US legal process, and what each one means for a server sitting inside it.

阅读指南

06 · How-to · 15 min hands-on

WireGuard VPN on a VPS — self-host your own personal VPN

Five steps from "no server" to "my own personal VPN" — KYC-free signup, crypto-paid, no third-party VPN provider in the trust chain. Tested on Debian 12 with WireGuard 1.0+ in the mainline kernel. The trust chain shrinks by one party; the cost stops being a $15/month subscription.

阅读指南

07 · 操作指南 · 20 分钟实操

Tor hidden service on a VPS — self-host a v3 onion

Five steps from provisioning a Nordic VPS to a live, 56-character v3 .onion address reachable only through Tor. Two lines in torrc, server-banner stripping, Vanguards-lite, and Onion-Location auto-redirect on the clearnet companion.

阅读指南

08 · How-to · ~3h hands-on (mostly IBD)

Self-host a Bitcoin Lightning node on a VPS

Bitcoin Core + LND (or Core Lightning) on a KYC-free Nordic VPS — pruned or full, Tor-routed, BTCPay-ready. The complete walk-through from picking a tier through opening the first three channels, with the channel-management caveats nobody mentions until you hit them.

阅读指南

09 · 操作指南 · 90 分钟实操

Self-host Mastodon on a VPS — fediverse on owned metal

Six steps to your own Mastodon instance, federation-ready, on Ravelin tier. Docker Compose, anonymous domain registration paths, SMTP relay trade-offs, TLS via Let's Encrypt, and the closed-vs-open registration decision you should make on day one.

阅读指南

10 · 操作指南 · 30 分钟实操

Self-host Vaultwarden (Bitwarden) on a VPS — your own password manager

Vaultwarden is the lightweight, Rust-based, Bitwarden-compatible password server. Five Docker commands, one HTTPS reverse proxy, one backup cron — and the credential vault of every account you own lives on metal you rent. Plus the metadata layer: why a KYC-free host matters for a password vault even when the contents are client-side encrypted.

阅读指南

11 · 操作指南 · 90 分钟实操

Self-host Nextcloud on a VPS — your own private cloud

Nextcloud is the open replacement for the Google Workspace stack — file sync, photo backup, contacts, calendar, collaborative documents, end-to-end encrypted chat and video. The All-in-One Docker install, mobile sync, Office Online, Talk, S3 external storage, the backup story and the Nordic jurisdiction angle.

阅读指南

12 · 操作指南 · 3 小时实操

Self-host a mail server on a VPS — Mailcow vs Mail-in-a-Box vs iRedMail

Self-hosted email in 2026 is gated on three brick walls — outbound port 25, IP reputation, PTR alignment — before any software is installed. The three serious stacks compared, the DNS records that must align perfectly, the warm-up period at Gmail and Outlook, and the no-KYC host that opens port 25 by default.

阅读指南

13 · 操作指南 · 2 小时实操

Self-host Matrix (Synapse + Element) on a VPS — your own encrypted chat

Matrix is what email would look like if it had been designed for chat in the open-protocol era. Synapse as the homeserver, Element as the client, PostgreSQL as the store, federation enabled, end-to-end encryption by default — and the metadata-layer reasoning for why the host the homeserver lives on matters.

阅读指南

14 · 操作指南 · 20 分钟实操

Self-host SearXNG on a VPS — your own private metasearch engine

SearXNG fans queries out to 70+ upstream search engines without forwarding your IP or identity. Three Docker commands, one reverse proxy, the IP-reputation wall that makes hyperscaler IPs fail, browser-default integration on desktop and mobile, and the Perplexica AI-search front-end that turns the whole thing into a private ChatGPT-search analogue.

阅读指南

15 · 操作指南 · 60 分钟实操

VPS hardening — the first-hour OPSEC checklist

Eight concrete steps to harden a fresh Nordic VPS in under one hour — SSH key-only, custom port, firewall baseline, unattended-upgrades, fail2ban, snapshot, recovery doc. The universal pre-launch checklist before any workload goes live, regardless of what the workload is.

阅读指南

16 · 操作指南 · 40 分钟实操

如何匿名托管一台远程 MCP 服务器

把你的 MCP 服务器从 localhost 迁移到一台公开的、无需 KYC 的 VPS 上：选一个套餐，安装你的服务器，套上 TLS，暴露 streamable-HTTP 端点，加上 OAuth，并托管 agent card。用加密货币支付，整条链路上都没有身份证件的踪影。

阅读指南

17 · 深度解读 · 12 分钟阅读

无需 KYC 的 MCP 服务器托管 — 不用证件也能部署 MCP 服务器

无需 KYC 的 MCP 服务器托管究竟是什么，为什么 AI 代理基础设施不该背负你的身份信息，以及如何在一台北欧无需 KYC 的 VPS 上、用加密货币支付部署一台 MCP 服务器 — 不需要邮箱验证，不需要银行卡，不需要证件。

阅读指南

18 · 操作指南 · 25 分钟实操

在 VPS 上 24/7 运行 AI 代理 — 无需 KYC，加密货币支付

先讲清楚阻止代理长住在笔记本电脑上的四种失败模式，再讲解决它们的运行环境：按代理形态给机器定规格、systemd 和 Docker 的重启策略、崩溃循环的陷阱、绝不能进入镜像的密钥、调度、支出上限 — 以及一个无需 KYC 的主机能保护什么、不能保护什么。

阅读指南

19 · 操作指南 · 30 分钟实操

在 VPS 上自建大模型——CPU 跑 Ollama，无需 GPU

在自己的硬件上运行大模型，不需要显卡，也不用 API 密钥。这篇讲清楚了：买机器前用一道算式预测每秒能跑多少 token，4、8、16、32 GB RAM 各能塞下什么规模的模型，Ollama 本身不带的身份验证要怎么补上，CPU 在嵌入和检索上真正占优的地方，还有老实说哪些任务它跑不动。

阅读指南

20 · 操作指南 · 45 分钟实操

VPS 加密备份——restic、Borg 与异地堡垒

VPS 加密备份指南：六个步骤，带你从一台毫无防护的服务器，走到第二法域内另一台机器上通过验证的加密仓库——包含列表该写什么，restic 与 Borg 的对比，可干净恢复的数据库转储，带保留策略的 systemd 定时任务，一个服务器被攻破也无法抹除的仅追加仓库，以及把以上一切变成真正保证的恢复演练。

阅读指南

21 · 操作指南 · 30 分钟实操

在 VPS 上自托管 n8n——由您掌控的自动化

六个步骤，从一台裸的 Debian 主机，到您自己域名下、由 TLS 终结的 n8n——带 Caddy 和 PostgreSQL 的 Docker Compose 技术栈，丢失后会让实例万劫不复的加密密钥，能在反向代理之后正常触发的 webhook，配 Redis worker 的队列模式，以及为什么这台保管着您全部 API 密钥的机器，不应该用您的真实法定姓名去租用。

阅读指南

22 · 操作指南 · 60 分钟实操

在 VPS 上自托管 Monero 节点——全节点、裁剪节点、仅 Tor

远程节点无法读取您的余额——Monero 钱包是在客户端本地扫描的——但它确实能看到您的 IP 把刚刚签署好的交易递交给它。六个步骤补上这道缺口：全节点与裁剪节点的磁盘成本对比、经过验证的二进制文件、带有两个 RPC 监听端口的加固版 monerod.conf、初始同步的真实情况、通过 SSH、WireGuard 或 v3 洋葱服务连接到节点，以及通过 Tor 广播交易。

阅读指南

23 · 操作指南 · 40 分钟实操

Self-host a private DNS resolver on a VPS — Unbound, AdGuard Home, DoH

Every domain your devices look up is a timestamped line in someone else's file. Six steps to move that file onto a machine you own: recursion from the root instead of forwarding to a public resolver, AdGuard Home filtering in front, DNS-over-TLS and DNS-over-HTTPS on a real certificate, a port 53 that never faces the internet, and an honest list of what a private resolver still does not hide.

阅读指南

24 · 操作指南 · 45 分钟实操

在 VPS 上自建 Git 服务器——Forgejo、运行器与镜像

一个私有仓库，是关于你在构建什么、和谁一起构建、进度如何的一份带日期的记录——而在某个平台上，这份记录归一家公司所有。六个步骤，把它搬过来：在裸仓库和完整的代码托管平台之间做选择，在 Caddy 之后用 PostgreSQL 部署 Forgejo，通过 SSH 推送并签名提交，配置一个永远看不到生产环境密钥的 Actions 运行器，设置推送镜像，以及一份不仅能恢复代码、还能恢复“对话”的备份。

阅读指南

25 · 操作指南 · 动手实践 50 分钟

在 VPS 上自建 Headscale——你自己的 Tailscale 控制服务器

Mesh VPN 需要有人来分发密钥，而这个人手里握着地图：你名下的每一台设备、每一个用户，以及此刻每台设备的连接地址。六个步骤，把这份地图握在自己手里——把 Headscale 部署在 Caddy 之后、使用预授权密钥、把访问规则白纸黑字写下来、把 MagicDNS 指向你自己的解析器、配置子网路由器和出口节点，再加上内嵌 DERP 中继，让兜底路径不再属于别人。

阅读指南

26 · 操作指南 · 60 分钟实操

Self-host BTCPay Server on a VPS — accept Bitcoin with no processor

Every payment gateway sits between you and your customer, takes a percentage, keeps the list of who paid you what, and reserves the right to stop. Six steps to remove it: the node shape that decides the whole budget, the domain that must resolve before the installer runs, the watch-only key that lets the server watch but never spend, the inbound-liquidity problem that makes a new Lightning node unpayable, and the backup rule that Lightning breaks.

阅读指南

27 · 操作指南 · 45 分钟实操

匿名注册域名——其他每一份指南都预设你已经完成的那一步

本资料库中的每一份指南开头都是「把一个子域名指向它」，却没有一份说清楚这个域名从何而来。它是自托管技术栈中唯一故意被公开的那一部分。六个步骤：一次注册实际上会创造的四份独立记录；会拒绝你的那些注册局，以及无论如何都会公开你姓名的那些；如何用 Monero 支付而不被交易所反过来暴露；那份列出你申请过的每一个主机名的证书日志；以及那个构成整套安全模型核心的续费环节。

阅读指南

28 · 操作指南 · 40 分钟实操

在 VPS 上自建网站分析——Plausible、Umami、Matomo

分析工具是大多数人留到最后才移除的第三方标签，也是唯一一个能在每一页上看到每一位读者的标签。六个步骤，把它换成一台你自己掌控的计数器——四款工具，以及那个悄悄决定账单高低的数据库；一个子域名和三个端口；一套部署在 Caddy 之后的 Compose 栈；能在过滤名单下存活的第一方路径；决定你是否仍需要同意横幅的两条独立法律；以及那份足以毁掉整套努力的访问日志。

阅读指南