Just finished my first sysadmin stuff. As a Unix hobbyist, I’ve always wanted to setup my own instance that runs several services. I purchased $6/month VPS instance from Vultr which provides 1c shared CPU, 1GB RAM, 25GB NVMe, and 2TB/month network bandwidth.

Services I set up:
- Web server: Let’s Encrypt SSL + Nginx + HTTP/3 in jail.
Adopted “modern” level of Mozilla SSL configuration
- Tor relay: Tor in jail
- ZNC: Let’s Encrypt SSL + ZNC in jail as a IRC bouncer
- Wireguard: if_wg

Since the instance comes with 1 ipv4 and 1 prefix 64 ipv6 range, I tried to assign only static ipv6 to each jail so they can have its own address. That didn’t work well since Tor relay and ZNC expected ipv4 address, so I switched to cloned interface (bastille0). PF rules are almost same as Bastille-generated one except that I added rules for Wireguard, ICMP, and SSH brute force protection.

I used BastilleBSD for jail setup because it is the most user-friendly jail management tool. Thanks @BastilleBSDBastilleBSD !