VPS is the default pick for self-hosted privacy infrastructure that needs predictable resources without the cost or complexity of a dedicated chassis. The xmrhost VPS catalog is sized for the workloads the audience actually runs: a single-operator Matrix homeserver, a Mastodon instance, a personal Tor relay (middle, not exit — exits run on dedicated for the bandwidth headroom), a self-hosted WireGuard endpoint, a Discourse forum, an OSS CI runner, a SecureDrop intake (vps-2 minimum per the journalism playbook). Tiers scale on vCPU + RAM + NVMe; bandwidth and IPv4/IPv6 allocation are uniform across tiers.
What VPS is not the right pick for: GPU inference (use /node/gpu), high-traffic Tor exit relays (use /node/dedicated for the dedicated bandwidth), bare-metal cryptography needing access to true RNG hardware (use /node/dedicated), workloads that want to run their own kernel (use /node/dedicated). Lift to dedicated is mechanical — the customer panel exposes an upgrade path with the data-migration runbook.
Pricing reflects the operator's cost (Iceland hydroelectric / geothermal power, Romania low-cost EU power, RIPE PI v4/v6 allocations, KVM-virtualized headroom that does not oversubscribe vCPUs). The catalog is the same Plan record across siblings on the catalog-base side, so price floors track the network — what differs is the surfacing, the AUP narrative, and the hardening defaults documented at /hardening.
// TIER COMPARISON
$ diff /etc/xmrhost/tiers.d/*
vps-1 (1 vCPU / 2 GB) is the baseline — sized for a single workload (one Tor relay, one WireGuard endpoint, one small Mastodon instance). vps-2 (2 vCPU / 4 GB) is the recommendation for a Matrix Synapse homeserver supporting 1-50 users, a Discourse forum at low-to-mid traffic, or a SecureDrop intake. vps-4 (4 vCPU / 8 GB) is the recommendation for journalism-grade workloads (Synapse + Postgres + media repo + reverse proxy on the same box) or for an OSS CI runner that compiles non-trivial codebases.
vps-8 (8 vCPU / 16 GB) and vps-16 (16 vCPU / 32 GB) are sized for operators running multiple services on a single box — a Matrix homeserver alongside a forum and a personal VPN, or a multi-instance Mastodon relay. Above vps-16 the right pick is dedicated; the per-vCPU cost flips below the dedicated tier price floor at that point.
// FAQ
$ faq -t vps
Q.What's the difference between xmrhost VPS and a normal cloud VPS?
A.Three things. (1) Jurisdiction — the box is in Iceland or Romania; the operator is not subject to US-style takedown-without-court-order processes. (2) Billing — XMR / BTC / Lightning / LTC / ETH / USDT, no card surface, no fiat rail, no KYC. (3) Hardening defaults — KSPP kernel baseline, sshd / fail2ban / auditd preconfigured (the runbooks at /docs); the operator does not ship a clean Ubuntu image and call it secure. Documented in full at /hardening.
Q.Can I run a Tor exit relay on a VPS tier?
A.Permitted by the AUP (/legal/aup), but the right pick for a real-traffic exit is /node/dedicated for the bandwidth headroom — VPS bandwidth is shared across the host, an exit relay saturating its share will compete with neighbours. For a low-traffic exit or a non-exit middle relay the VPS tier is fine; the runbook at /docs/run-non-exit-tor-relay covers both shapes.
Q.Is bandwidth metered or unmetered?
A.Soft-metered. The operator does not throttle below the contracted rate, and does not bill overage. Egress patterns that look like a saturating attack against a third party (egress sustained at line rate for hours) trigger the operator-contact AUP path before any throttling — the conversation precedes the action.
Q.What's the IPv4 / IPv6 allocation?
A.1 IPv4 + IPv6 /64 routed to the guest by default. Additional v4 addresses are available on request (/contact); RIPE assignment is on a justified-need basis per the RIPE allocation policy. v6 /64 is enough for any reasonable subnetting inside the box.
Q.Can I bring my own kernel or distro image?
A.On VPS: limited — the KVM hypervisor accepts standard cloud-init-bootable images. Common alternatives (Alpine, Arch, NixOS, OpenBSD, Whonix Gateway template) are preinstalled in the customer panel; bring-your-own-ISO is supported on request via /contact. On dedicated, full custom kernel + grub LUKS is in scope by default.