NovaVPSThe Full Opsec Checklist for an Anonymous Server — 12 Items
The complete anonymous-server opsec checklist: account, access, network, data and payment discipline — 12 concrete items, each doable in under an hour.
The full anonymous-server opsec checklist: 12 concrete items covering account, access, network, data and payment discipline — with the guides for each.
The checklist
- Dedicated email alias for the hosting account — used nowhere else.
- Monero payments from self-custody; never exchange-withdrawals straight to invoices.
- SSH keys only; password auth off; named sudo user, not root.
- Default-deny firewall: 22 (moved), 80/443, service ports only.
- fail2ban + moved SSH port: log noise drops an order of magnitude.
- Unattended security upgrades on the base OS.
- 2FA on the hosting panel — the panel is attack surface too.
- Panel over Tor/VPN if local observers are in your threat model.
- Neutral PTR/DNS: no names, no patterns in record labels.
- LUKS container for data at rest (see the encryption guide).
- Off-box encrypted backups — Restic/Borg to a Storage VPS.
- Monthly review: canary check, DNS audit, credential rotation.
VPS from $8.50/mo. Email, a 12-character password, then a crypto invoice.
Launch nowThe matrix of failures
| Skip this item | Typical failure |
|---|---|
| #1 email | One breach links every account |
| #2 payments | Public BTC trail to your exchange |
| #3/#5 access | Credential stuffing in days |
| #9 DNS/PTR | Historical records name you forever |
| #11 backups | Ransom or deletion ends the project |
Where each item lives
Hosting-side, NovaVPS already gives: no documents, crypto-only billing, editable PTR, no traffic logs (≤24 h connection metadata). The other eight items are yours — each links to a guide on this site.
Recommended setup
Plan: Plus — 4 vCPU/8 GB, room for the LUKS container and backup tooling, $13.50/mo. Location: Zurich. Pair with the opsec guide and its honest limits.
Opsec-ready VPS from $13.50/mo in Zurich.
Launch nowIs 12 items overkill?
Each costs under an hour once; recovering from any single failure costs more. Pick by threat model — but items 1–3 are non-negotiable.
Does the host do any of this for me?
We hold no documents, log no traffic and give PTR control. Access, DNS and backups are yours by design — that’s the privacy model.
Best backup target?
A Storage VPS on the same rails — Restic over SSH, 1 TB from $30/mo.
Ready to launch?
Configure a VPS or dedicated server, set a password, then pay the invoice.
Network
Edge RTT
Uptime · 36h
Complaints · 36h