NulNetVPS for a Privacy Tools Stack — VPN, Tor, DNS and Vault
One box carries WireGuard, encrypted DNS, Vaultwarden and an optional Tor bridge. Vanguard $26.50 in Zurich keeps burst headroom; media overflows to Storage.
Der Artikeltext ist auf Englisch. Header, Katalog und Kasse sind übersetzt.
VPS from $3* (fund $50+), storage 1–5 TB NVMe from $24/mo annual-eff, dedicated with IPMI from $30.80/mo. Crypto invoice, no KYC.
Launch nowThe personal privacy stack
Four tools cover most personal privacy needs — and one VPS you control fits all four:
| Tool | Job | Load |
|---|---|---|
| WireGuard | Private tunnel for your devices | ~0 CPU, RAM trivial |
| Tor bridge / Snowflake | Censorship resistance for others | Light |
| Encrypted DNS (DoH/DoT) | Clean resolution for the household | Light |
| Vaultwarden | Passwords/secrets you hold | ~100 MB RAM |
Why self-host the stack
A commercial VPN shifts trust onto some company; public DNS watches every lookup; a cloud vault keeps your secrets behind somebody else’s login. One box, Monero-paid and no-KYC — the trust surface shrinks to rented hardware and keys you hold.
Build order
- WireGuard first (15 minutes, the playbook).
- Unbound or AdGuard Home for DNS.
- Vaultwarden behind TLS with 2FA.
- Snowflake proxy — zero-risk Tor contribution.
- Snapshots before each addition; the whole stack rebuilds in an hour.
A personal privacy hub — what fits on one box
The usual stack: WireGuard portal, password vault, private git, Matrix/Synapse lite, optional Tor bridge. Vanguard at $26.50 (8 vCPU / 24 GB / 400 GB NVMe) idles through it with TLS burst headroom; Zurich is the natural flag. Give each service its own system user. Reverse-proxy with authenticated admin paths. Snapshot before upgrades.
Never share an IPv4 between an exit relay and the personal VPN. Split reputations early — an extra IPv4 or a second Sentry costs less than a burned hub. Each added service widens the CVE surface; prefer fewer tools you actually patch over a vanity mesh.
Pay the hub in Monero. Admin strictly over Tor or VPN. Encrypted offsite backups of the vault matter more than another microservice.
Capacity planning: WireGuard is cheap; Matrix media is not. Move media to Storage once the Vanguard NVMe fills with thumbnails and avatars. Should you add a Tor bridge, its traffic rides a second IPv4. Record every public port in a private note. Vanguard at $26.50 in Zurich is the hub SKU; resist installing every trendy privacy app that goes unpatched for six months.
Operational footnote: fewer services, patched on schedule, media on Storage when needed, Vanguard at $26.50 in Zurich for the hub. Split exits from personal VPN IPs. Monero renewals. A quiet hub outlives a clever mesh nobody can maintain.
Final note: WireGuard, vault, git, optional Matrix — Vanguard $26.50 Zurich, fewer services, patched, media on Storage when required, exits split from the personal VPN, XMR renewals. Quiet hubs outlast clever meshes. Record every public port.
Capacity-plan Matrix media early. Authenticate admin paths. Test restores. Resist installing tools nobody will update.
Closing: the Vanguard $26.50 Zurich hub runs WireGuard, vault and optional Matrix — fewer services, media parked on Storage, exits split, XMR renewals. Quiet and patched beats clever and abandoned.
List every public port in a private note. Test restores quarterly. Delete tools without an owner.
Extra: calendar the Matrix and vault upgrades, move media to Storage early, and refuse exit relays on the personal hub IP. Vanguard at $26.50 in Zurich remains the sized default for a maintained privacy stack.
Stack sprawl
Unable to name the threat a tool addresses? Remove it. Quiet hubs outlast clever ones.
Capacity planning: vault versus Matrix media
WireGuard costs nothing; Matrix media costs plenty. Open on Vanguard ($26.50) in Zurich for the hub, shift media to Storage as the NVMe fills with thumbnails, and never co-locate a Tor exit with the personal VPN on one IPv4. Fewer patched services outrank a vanity mesh. Authenticate admin paths, test restores, pay XMR, record every public port in a private note.
A build order that leaves escape room
WireGuard first, then encrypted DNS, then Vaultwarden behind TLS, then a Snowflake or bridge when contribution feels right. Vanguard ($26.50) in Zurich keeps headroom; Ranger ($12.50) fits a lean personal stack. Snapshot before every addition. Push Tor exit work to another IP later — never mix exit reputation with the vault.
Recommended setup
Plan: Vanguard — 8 vCPU Xeon Gold 6430, 24 GB DDR5 ECC, 400 GB NVMe, $26.50/mo (the whole stack idles; headroom is for TLS bursts and future tools). Location: Zurich — the natural flag for a personal privacy hub. Related: own VPN vs subscription.
Privacy-stack VPS from $26.50/mo in Zurich.
Launch nowMore rankings and guides
- Anonymous VPS opsec guide
- Full opsec checklist
- How to run a Tor exit relay
- Best privacy jurisdictions 2026
- Best VPS outside the 14 Eyes
- How to buy an anonymous VPS
Is this stack legal?
Yes — VPNs, Tor and password managers are lawful tools in every jurisdiction this catalog covers; the law reaches conduct, not tooling.
One box or four?
Start with one and split only when a single tool’s failure would take its neighbors down — Tor bridges move off the hub first.
Why Vanguard for light tools?
Headroom: $26.50 buys TLS-burst margin and RAM that a multi-user household outgrows on Ranger.
Ranger or Vanguard for the hub?
Ranger covers WireGuard and a vault; Vanguard earns its price once Matrix media and git CI join.
Can Storage hold the media?
Yes - attach a Storage VPS or keep media on Vanguard NVMe until 400 GB starts to hurt.
Ready to launch?
Build the box — VPS, storage or bare metal — create the password, pay the invoice that follows.