# Host the hub on one VPS

**The current network budget is $0 in new charges.** Start on an existing authorized machine or an explicitly donated site. The VPS comparisons below document the earlier $30 scenario in case paid hosting is approved later. [Free network topology](network-topology.md)

For an initial European B2B pilot, choose **Vultr Frankfurt, 2 vCPUs, 4 GiB RAM and 80 GB SSD**. The regular Cloud Compute plan costs **$24/month before tax** with automatic backups and the ordinary primary public IPv4. That leaves $6 of the $30 ceiling for tax and variable charges. If the pilot customers are in Southeast Asia, choose Singapore at the same price. Use client latency measurements and any data-location commitments to select the region. Both locations listed this exact plan as available when checked on November 4, 2026. [Plan catalog](https://api.vultr.com/v2/plans?type=vc2) · [Frankfurt availability](https://api.vultr.com/v2/regions/fra/availability?type=vc2) · [Singapore availability](https://api.vultr.com/v2/regions/sgp/availability?type=vc2) · [Backup price](https://docs.vultr.com/support/platform/billing/how-much-does-it-cost-to-enable-automatic-backups)

## Compare monthly costs

Estimates assume one Linux VM for the full month, its included local disk, one primary IPv4 and traffic within the plan. Prices are in USD. The billing address determines applicable taxes. The table excludes paid DNS plans, additional disks, off-site storage and external model or transcription calls. These integrations have separate accounts and usage.

| Provider and locations | CPU, memory, local disk | Monthly server + backup | Transfer and availability |
|---|---|---|---|
| Vultr Cloud Compute `vc2-2c-4gb`, Frankfurt or Singapore | 2 vCPUs, 4 GiB, 80 GB SSD | $20 + $4 = **$24**. Choose a daily schedule. The primary IP lasts for the lifetime of the instance. | Plan lists 3,072 GB. Excess outbound transfer costs $0.01/GB. Both regions listed the plan. [Price and plan](https://api.vultr.com/v2/plans?type=vc2) · [Primary IP](https://docs.vultr.com/support/products/compute/how-do-i-get-a-vultr-compute-instance-dedicated-ip-address) · [Backups](https://docs.vultr.com/vps-automatic-backups) · [Transfer](https://docs.vultr.com/support/products/load-balancer/how-is-bandwidth-charged-for-vultr-load-balancers) |
| DigitalOcean Basic Regular, Frankfurt FRA1 or Singapore SGP1 | 2 vCPUs, 4 GiB, 80 GiB SSD | $24 with bundled IPv4 + $4.80 weekly backup = **$28.80**. Daily backups raise the subtotal to **$31.20**. | Includes 4,000 GiB. Additional outbound transfer is $0.01/GiB. A weekly schedule leaves $1.20 for tax and extras. [Droplet prices, IPv4 and backups](https://www.digitalocean.com/pricing/droplets) · [Regional availability](https://docs.digitalocean.com/products/droplets/details/availability/) · [Transfer](https://docs.digitalocean.com/platform/billing/bandwidth/) |
| AWS Lightsail Linux Medium, Frankfurt or Singapore | 2 vCPUs, 4 GB, 80 GB SSD | $24 with IPv4 + $0.05 per GB-month of snapshots. **$26** if total billable snapshot storage averages 40 GB. Seven daily snapshots use a variable amount of storage. | 4 TB allowance. Both directions count towards the allowance. Excess public outbound traffic costs $0.09/GB in Frankfurt and $0.12/GB in Singapore. [Bundle](https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-bundles.html) · [Snapshots](https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-faq-snapshots.html) · [Regional transfer charges](https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-faq-data-transfer-allowance.html) |

A cheaper option is OVHcloud VPS-2 with 4 vCores, 8 GB and 75 GB NVMe. On the ASIA USD price list, the month-to-month VM was $10 plus $2.20 for the seven-day backup option, or **$12.20 before tax** with the primary IPv4 and local disk. The advertised $8.50 base rate requires a 12-month upfront commitment. The public stock API returned `linuxStatus: out-of-stock` for Singapore and Germany at the time of review. In Singapore this SKU includes 1 TB/month and throttles to 10 Mbps beyond it. Recheck the billing subsidiary and live Linux stock before relying on this plan. [Public plan and add-on prices](https://ca.api.ovh.com/v1/order/catalog/public/vps?ovhSubsidiary=ASIA) · [Linux stock by datacenter](https://ca.api.ovh.com/v1/vps/order/rule/datacenter?ovhSubsidiary=ASIA&planCode=vps-2027-model2) · [Singapore offer and transfer cap](https://www.ovhcloud.com/asia/vps/vps-singapore/) · [Included IPv4](https://docs.ovhcloud.com/en/guides/bare-metal-cloud/virtual-private-servers/configure-ipv6)

## Keep the invoice within $30

At checkout, select one on-demand Linux VM, its default primary IPv4, the quoted backup tier and no optional licenses. Confirm the **tax-inclusive recurring total**, any up-front debit and the remaining allowance for transfer. For example, $24 plus an illustrative 20% tax leaves $1.20 of room. If the final quote already exceeds the ceiling, defer provisioning. A provider invoice can also include other resources in the same account.

Vultr offers a $0 card-linking option. The bank can place a temporary authorization hold. Other payment methods can require an initial deposit. A separately reserved IP starts at $3/month and is unnecessary for this pilot. DigitalOcean can place a temporary card hold for up to seven days and requests a $5 authorization when connecting PayPal. [Vultr account setup](https://docs.vultr.com/platform/create-an-account) · [Reserved IP prices](https://docs.vultr.com/product-overviews/reserved-ips) · [DigitalOcean payment verification](https://docs.digitalocean.com/platform/billing/manage-payment-methods/)

Keep transfer usage, invoices and free disk visible to the operator. Compare projected charges with the tax-adjusted $30 ceiling and allow for reporting delay. Cap or suspend public downloads before exhausting the included transfer. A $24 estimate and billing alerts do not enforce a hard spending limit. Count off-site storage and restore traffic in the same budget if they generate a new charge.

## Publish discovery and keep management private

Use `daedro.hub.rokenshi.com` for the public marketplace and handbook. A DNS check on November 4, 2026 returned NXDOMAIN for the requested hostname for both A and AAAA. DNS can change independently of this guide. Before a planned cutover, verify the intended origin IP, DNS zone access and certificate issuer. Publish an IPv6 record only when the origin also serves working IPv6.

- **Visitors** connect to the public hostname on HTTPS port 443. Caddy terminates public TLS and forwards only to the separate `public` listener on loopback port 8793. Set its canonical origin to `https://daedro.hub.rokenshi.com`. Give the public service its own OS identity, read-only configuration and no Docker socket, operator keys or managed-state access. Route all public paths to that one process. Its catalog describes external services without disclosing their credentials.
- **Team members** access the managed listener on the VPS at `127.0.0.1:8792` through authenticated SSH local forwarding. On their device the tunnel must also listen at `127.0.0.1:8792`. Use `https://127.0.0.1:8792/workspace` or the instance's MCP path, verify the installation CA out of band and use a named caller token. Restrict SSH by keys and source network. A forwarding-only account can be restricted to that one destination without shell or Docker permissions. [Operator setup and certificate trust](operations.md)
- **The operator** runs the managed process under a dedicated OS account with access to the private installation directory and local Docker Unix socket. Workers have no published ports. The managed server enforces a loopback Host with the actual port, checks browser origins, and requires TLS 1.3 for authenticated requests. An internet proxy rewriting Host to bypass that boundary would expose the upload and administration surface. Keep 8791, 8792, 8793 and the Docker API closed to the internet. [Service trust model](../SECURITY.md)

This topology separates processes and credentials on one host. Host administrators, the kernel and Docker remain trusted. Only approved packages from the trusted team belong on this pilot. Public arbitrary-code execution requires a separately isolated worker environment and another cost estimate. A generic Compose file with the Docker socket mounted into a web-facing service would cross that boundary. For this deployment, use two supervised processes with distinct OS identities.

## Size the worker pool and plan recovery

Begin with two active replicas, each limited to 500 CPU millicores and 256 MiB, with aggregate budgets of 1,000 millicores and 512 MiB. This is a starting configuration to measure with representative tools. It leaves room on a 4 GiB machine for the controller, Docker, package validation and the public listener. Time representative requests, monitor host memory and disk, and verify HTTP 429 under saturation before increasing the budget. The hub starts extra **containers on this VPS**. It cannot provision another billable VM. The local disk holds images, admitted packages and Docker layers as well as the operating system. [Deployments and resource budgets](operations.md)

A provider snapshot can contain the encrypted state **and** the key used to open it. Limit account and backup access, protect the account with MFA, and keep an independently protected copy of the encrypted journal and upload registry. Store recovery key material separately. Test restoring one isolated installation with a single controller, the same limits and the approved image content. Include any additional block storage in a separate backup plan. Vultr keeps the latest two automatic backups in the original datacenter and excludes attached block storage. [Vultr backup retention](https://docs.vultr.com/vps-automatic-backups) · [Hub recovery](operations.md)

## Read-only checks

Inspect public stock and DNS before changing anything. The following checks use public services and require no provider API key.

```sh
dig daedro.hub.rokenshi.com A +noall +comments +answer
dig daedro.hub.rokenshi.com AAAA +noall +comments +answer
curl -fsS 'https://api.vultr.com/v2/plans?type=vc2' |
  jq '.plans[] | select(.id == "vc2-2c-4gb") | {id, vcpu_count, ram, disk, bandwidth, monthly_cost, location_cost}'
curl -fsS 'https://api.vultr.com/v2/regions/fra/availability?type=vc2' |
  jq '.available_plans | index("vc2-2c-4gb") != null'
```

After deployment, check public HTTPS from outside and the managed endpoint through an established tunnel. The second command should return **401**. A valid certificate chain is required for both requests.

```sh
curl --fail --silent --show-error --output /dev/null --write-out '%{http_code}\n' https://daedro.hub.rokenshi.com/docs/
curl --silent --show-error --cacert "$HUB_CONFIG/ca.crt" --output /dev/null --write-out '%{http_code}\n' https://127.0.0.1:8792/api/v1/instances
```