Infrastructure

A meticulously careful selection of services to use for everything from securing connections on public WiFi, over storing data to retrieving e-mails. I’ve put together a collection of services that I use for personal and business purposes while on the go.

Infrastructure

Internet

Let’s start with the basics: Access to the internet. In many places today one can find prepaid SIM cards and free WiFi. For data connections over 3G/LTE I use a Netgear Nighthawk M2 router with local prepaid SIM cards. Depending on the usage limits, I get multiple cards to make sure I don’t run out of data. Also, some carriers are better than others depending on the region I’m currently in.

Apart from that, I run an OpenWrt router that manages my own private network, no matter whether I connect to the internet though the Netgear or a cable connection.

SIM Cards

I prefer to purchase and top-up local SIM cards in cash. In a lot of countries it’s possible to walk into small shops or kiosks and get prepaid SIM cards no questions asked. It is worth checking carriers’ pop-up stalls on the streets and in malls, as they might even give away prepaid cards for free.

I have a large collection of various SIM cards from all over the worlds, some of which even offer roaming options for other countries. Within the EU it’s possible to use the data volume of a SIM card in other EU member states outside of the country the SIM card was purchased in. Effectively this means that you can pick up the cheapest card with most data volume while in a low-income EU country and use it for extended periods of time, under the same conditions, inside a different, much more expensive EU country, where the same data volume would cost a lot more. While it’s possible to anonymously purchase SIM cards in the US, in Central- and Latin-America as well as in Asia, it’s not that easy in Europe. Most countries have implemented strict rules that require showing a passport upon purchase or activation the very least. However, there are still places in less-developed European countries that allow purchasing and activation of data SIMs without KYC requirements. Usually newspaper kiosks, tobacco shops and tiny grocery shops are the places to check for that.

For everyone who’s not looking to swap SIM cards in every country there are providers that offer global SIM cards. With such cards one can roam through multiple countries without the need to purchase individual local SIM cards on arrival, usually at a much higher overall cost though. Here is a list of options for international SIM cards:

Keep in mind though, that apart from Google Fi – which is only available to people with a US bank account/address – most of these SIM cards are pretty expensive for what they offer. 99% of the times you’ll be cheaper (and enjoy better privacy) with a locally purchased SIM card.

Alternatively, to avoid the hassle of finding local shops that would sell SIM cards without KYC, there are services for that. Depending on the country and the required data/call options it can get pretty expensive, though. One example is
silent.link. If you just care to have an anonymous virtual phone number for calling and SMS, check JMP, Crypton or Hushed, which do not require KYC.

WiFi

Free WiFi can be found through various resources on the internet. For example WiFi Map has iOS and Android apps that show publicly accessible access points on a map.

VPN

I use VPNs for most of the things I do online. A VPN is one of multiple measures that can be implemented to give corporate surveillance (Amazon, Facebook, Google, Twitter, …) a harder time. A VPN might also be helpful when downloading Linux ISOs via BitTorrent. However, keep in mind that they’re by no means privacy silver-bullets and they are definitely not going to protect from state surveillance – unless maybe you invest a good amount of effort and roll your own VPN, but even then …

Speaking of which: I run my own VPN infrastructure based on Wireguard, which I share with a handful of people. The infrastructure consists of VPS instances that are spread across the globe, which I can auto-provision through a minimal but super efficient Terraform + Ansible setup that I implemented for that purpose. Not only does it allow me to spin-up new or turn-off existing VPN servers – all within a matter of minutes – it also makes it possible to flip servers (and thereby IPs) for new ones every couple of hours/days.

Instances that are used for everyday browsing usually run on whatever cloud VPS provider offers the best price-features-ratio. However, instances geared towards privacy solely run on cloud providers that offer anonymous payments via XMR and are provisioned through multiple layers of jump-hosts and Tor proxies.

Note: The fewer users a VPN has, the easier it gets for peers to identify individual users based on patterns. Rolling your own VPN only makes sense for specific purposes, e.g. setting up an actual virtual private network between peers for the purpose of sharing data/communicating over the internet. If all you care about is YouTube not being able to shadow-profile your love for Telenovelas, you’re better off just using a commercial VPN and making sure your browser is hard enough to fingerprint.

For commercial VPNs, I would go for one that accepts cash or XMR. Some examples include:

As a general rule of thumb, adjust the use of VPNs based on the task that is to be performed and the content that is to be transferred. Also keep in mind that, even though every VPN provider has a no log policy, they nevertheless are able to see the source IP you’re connecting from all the time.

Travel caution: The use of Tor/VPNs by individuals is banned/blocked in the following countries: Belarus, Iran, Iraq, Oman, Turkey, Uganda and the United Arab Emirates. In China and Russia only VPN services that get a government approval are officially allowed. In North Korea, Cuba, Egypt, Vietnam, Bahrain, Turkmenistan, Myanmar, Syria, Libya and Venezuela there are no official bans, but due to their strict internet censorship, using Tor/VPNs might not be possible and come with risks.

Always make sure to check the laws when traveling to places that are in political turmoil or known for their controversial stance on privacy and free speech. This doesn’t mean you shouldn’t use VPNs or Tor in these regions, it just means you should figure out how to do it in order to not get into trouble.

Self-contained networks / Decentralized Networks / Darknets

At times when a VPN is insufficient from a privacy-standpoint or I cannot find the required information on the clearnet, I use ZeroNet, IPFS, I2P, and the Tor networks. Some ISPs might try to prohibit use of such networks and block them – for example, during my time in Spain, Vodafone didn’t want people to use IPFS, so it required a few workarounds to access the network.

FYI: This site is also available as a hidden Tor service, via the onion URL linked in the footer. I’m also currently testing availability via IPFS.

DNS

With DNS being a leaky pipe it’s important to make sure that even though a VPN or P2P network is active, no DNS requests are being split-tunneled.

I use encrypted (and ideally anonymized) DNS whenever possible. For this, I have DNSCrypt configured and use public DNSCrypt servers that do not have logging enabled. DNSCrypt on its own won’t prevent DNS leaks. Its sole purpose is to encrypt DNS traffic and prevent attacks like DNS spoofing / MitM. In addition, my dnscrypt-proxy2 setup performs DNS queries via Tor for added privacy (DoHoT).

Hint: Firefox already uses a technology called DoH to protect DNS requests. However, by default it makes use of the Cloudflare DNS. This should be changed to a different one or disabled altogether in preference of a dedicated DNSCrypt setup.

Firewall

On my workstations all ports are blocked and outgoing connections are explicit. Kill-switches for VPNs are built using iptables scripts. Additionally, the whole network is secured using OpenWrt’s built-in firewalling.

For Linux desktops in general check out OpenSnitch.

On macOS Little Snitch in alert mode does the trick. However, Apple’s own services don’t seem to always respect firewall configurations or VPNs, so better make sure to block communication on a dedicated firewall (e.g. router).

Browsing

For my day-to-day browsing I use ungoogled Chromium, as well as Firefox on workstation. For things that require a higher level of privacy I solely use Tor Browser on a non-persisting Tails VM.

In Chromium I use the following extensions:

In Firefox I use the following extensions:

Keep in mind that extensions contribute to your browser fingerprint. Make sure to test your browser every once in a while to make sure it’s not too unique.

Additionally, I use the following Firefox about:config/user.js settings:

accessibility.typeaheadfind.flashBar = 0
app.shield.optoutstudies.enabled = false
beacon.enabled = false
browser.contentblocking.category = strict
browser.safebrowsing.downloads.remote.enabled = false
browser.safebrowsing.malware.enabled = false
browser.safebrowsing.phishing.enabled = false
browser.send_pings = false
browser.sessionstore.privacy_level = 2
browser.urlbar.speculativeConnect.enabled = false
browser.newtabpage.activity-stream.feeds.telemetry = false
browser.ping-centre.telemetry = false
browser.tabs.crashReporting.sendReport = false
browser.newtabpage.activity-stream.section.highlights.includePocket = false
services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includePocket = false
extensions.pocket.enabled = false
toolkit.telemetry.enabled = false
toolkit.telemetry.server = ""
toolkit.telemetry.unified = false
datareporting.healthreport.uploadEnabled = false
media.gmp-widevinecdm.enabled = false
media.navigator.enabled = false
network.cookie.cookieBehavior = 5
network.dns.disablePrefetch = true
network.dns.disablePrefetchFromHTTPS = true
network.http.referer.XOriginPolicy = 2
network.http.referer.XOriginTrimmingPolicy = 2
network.http.sendRefererHeader = 0
network.IDN_show_punycode = true
network.predictor.enable-prefetch = false
network.predictor.enabled = false
network.prefetch-next = false
privacy.donottrackheader.enabled = true
privacy.firstparty.isolate = true
privacy.resistFingerprinting = true
privacy.resistFingerprinting.letterboxing = true
privacy.trackingprotection.cryptomining.enabled = true
privacy.trackingprotection.enabled = true
privacy.trackingprotection.fingerprinting.enabled = true
privacy.trackingprotection.socialtracking.enabled = true
webgl.disabled = true
pdfjs.enableScripting = false
security.ssl3.rsa_des_ede3_sha = false
security.ssl.require_safe_negotiation = true
geo.enabled = false

More settings and info can be found here.

While I know that especially security-focused people and projects(https://grapheneos.org/usage#web-browsing] recommend against using Firefox and prefer ungoogled Chromium, and while I’m also constantly getting annoyed about the various glitches and especially slow speeds on Firefox, I nevertheless stick to it as my secondary browser out of multiple reasons:

  • Competition: We need multiple browsers. Everything these days is basically Chromium, so it’s important to support alternatives.
  • Extensions: One of the most important for me, Tridactyl, is not available for Chromium-based browsers (yet?) and even simple things like changing the user-agent have become increasingly difficult and unreliable with the latest updates.
  • Availability: I get the latest updates and security patches right away from the official Gentoo repos and compiling takes a few minutes at most. For ungoogled Chromium I have to rely on a third-party repository that I have to trust with patching the code and providing updates to security flaws in time.
  • Privacy focus: ungoogled Chromium has made a clear statement for what their project goals are. Clearly, becoming the Bromite of Linux is not. While they do include some of the patches that Bromite has introduced, their main focus is offering a plain, ungoogled version of the Chromium browser.
  • Company politics: Manifest V3

I keep JavaScript off by default (via uBlock) and I only enable it for (to me) known and trusted sites. Of course, there is more attack surface besides the JavaScript engine, yet by minimizing the surface, the cost/benefit ratio of attacks gets disproportional enough that the theoretical risk might never manifest in real life.

Search Engines

For online search I use Startpage, Brave Search, Qwant, and Searx.

I don’t use Google, Bing, nor DuckDuckGo anymore, because they have questionable privacy protection. Also, DuckDuckGo announced the introduction of censorship, under the excuse of protecting people from Russian disinformation.

For image searches I use Yandex, which is a privacy nightmare, but has some of the best results in that specific area.

Maps

I mainly use OpenStreetMap for address lookups and navigation. On my phones I use OsmAnd. I keep Google Maps installed on iOS for emergencies only. However, I have the precise location setting for Google Maps disabled.

Communication

Communication makes a big part of my digital life. In order to keep in touch with friends as well as business contacts I use a variety of messengers, video-conferencing tools, social networks and other platforms.

E-Mail

As detailed in an entry I wrote a while ago, e-mail to me is more of a temporary storage for documents. I use different services with varying privacy settings for that matter. In addition, I share accounts with other people for less important kind-of-team-mail-things.

I run my own mail servers, which, as with the VPN infrastructure, I share with a handful of people I know. E-mail has become the scourge of humanity and the “privacy respecting e-mail” market is snakeoil – expensive snakeoil.

For business email I still use a hosted service, mainly because its mail servers’ reputation guarantees that important business mail won’t end up in someone’s spam folder. Unfortunately mail server reputation has become a lever for big providers to maintain their power. Not only are mails from lesser known domains/providers more likely to end up in the recipient’s spam folder, but as can be seen with the recent Tutanota situation, even just having an @tutanota.com e-mail address might prohibit you from accessing other services.

Beware of private e-mail providers like ProtonMail, as they lock you into their service and make it really hard to migrate elsewhere – even if that sometimes seems to be involuntary.

If you’re looking for options, here is a non-comprehensive list of services that might be of interest. For added anonymity, use via Tor:

If you don’t care too much about privacy or lock-in and simply want to move away from Google Mail and the likes, here are some additional options:

Messaging

Direct & Small-Group Messaging

For the past decade I was using Messages (formerly iMessage) and Signal (formerly TextSecure) for the means of instant messaging. While Messages catered to professional communication (e.g. with clients and business partners), Signal handled my private communication with friends.

Since the end of 2021 I’ve started moving as far away from both messengers as possible, due to privacy concerns. Neither Messages nor Signal are to be trusted. Apple is continuing to weaken the little privacy they had left and Moxie Marlinspike (the initial Signal founder) is not to be trusted either, having some really odd and conflicting opinions on decentralization, cryptocurrency and the way how Signal should operate.

While it’s naive to think that a messaging app could protect one’s privacy while it’s running on a closed-source platform that has tracking and spying built right into its core – as it is the case with iOS and Android – I nevertheless try to limit the reach of proprietary communication tools.

I have replaced both of these apps with other, more privacy respecting alternatives. All of phone numbers, apart from a single, business-related mobile number have been removed from Messages and FaceTime. Likewise, I have deactivated Signal on my private phone numbers and have moved my most important personal communication over to XMPP and Matrix.

Community- and Group-Messaging

I have been idling on the IRC for the past decades. I keep ZNC running as a bouncer and even have ZNC Push configured to send me push notifications via Pushover when someone mentions me while being afk.

I’m mainly on OFTC, the Pine64 IRC, a couple of niche networks as well as an own instances that’s solely available as an Onion v3 hidden service. My ZNC in general only connects via Tor to either of the networks. It runs on a machine that has nothing else on it, that doesn’t store logs and that I only connect to through VPNs.

In the old days, I was a resident of Freenode, up until the network imploded and most projects moved to Libera. I gave Libera a try for an extended period of time but ultimately found out that it’s not what Freenode had been, and that it has become increasingly difficult to find and engage in interesting conversations. Besides, part of the Libera operators team seem to uphold opinions that I do not agree with, especially in terms of misconduct on the network.

Additionally, I have been using Matrix (via the Element client) for a long time now. While I don’t like Element (the client software) and wish there was a way to use my irssi setup on Matrix – spoiler, seems to be – I do like the privacy Matrix offers over plain-text IRC, thanks to E2EE. I recently moved from the awful Electron-based desktop app to nheko, a C++17/Qt5-based Matrix client.

Voice- & Video-Calling

See Messaging. Additionally, in case there’s a need for conference calls with room links, moderation, screen-sharing, et al., I prefer to use Jami and Jitsi over Google Meet or Microsoft Teams. Unfortunately in the corporate world it’s hard to replace well-established products, mainly because people are comfortable using them and don’t like change too much in general. Hence I’m forced to use that sort of spyware from time to time.

In these cases I make sure to allow these websites or apps to access my microphone only temporary. I also make sure they don’t have access to neither my camera nor my desktop unless it’s required. Even then, I remove access to all these things afterwards or even delete the apps altogether, until the next conference call comes up.

I never use nor install Skype or Zoom in particular. I also never install any other video conferencing software that is not OSS on my workstation. I don’t mind installing Google Meet or the Microsoft Teams app on my business phone, since it’s running spyware (iOS) already anyway.

Unless I have to call a hotline I don’t do plain phone calls. Not only is the quality of calls miserable; Phone calls offer the least amount of privacy possible. I also auto-reject plain phone calls, simply because I, too, hate telephones and 99.99% of these calls are unsolicited. In fact, phone is on airplane mode every time I’m near WiFi, so reaching me is solely possible through authenticated/authorized methods like Matrix or FaceTime Audio calls.

On a side note, I have recently discovered EasyEffects, an audio effects application for PipeWire on Linux. With EasyEffects it’s possible to alter the sound of the voice in order to make it harder to be identified by machine learning using on platforms like Google Meet, Microsoft Teams, etc. While it allows pitching it up to Chipmunk level or down to sound like Darth Vader, it’s usually sufficient to add a handful of compressor, filter and reverb plugins and randomize the values from call to call, to make it harder for your voice to become a fingerprint when using proprietary voice calling software.

Recommendations

Here’s of list of platforms/messengers I would recommend for private, end-to-end encrypted communication, sorted by preference:

  1. XMPP
  2. Matrix
  3. SimpleX
  4. Briar
  5. Session
  6. Status
  7. Signal

Social Networks

Apart from my regular posts on Superhighway84 and sporadic submissions on keebtalk, as well as on Reddit, I don’t use any social network. Even my activity on Reddit has declined significantly over the past year and I mainly became a lurker for interesting posts.

I had used Mastodon until sometime in 2021, but I eventually gave up. The instances I was registered on did not work out for me and even though I gave it another try using a self-hosted Pleroma instance, I ultimately felt that it adds no value to my life in any way. While there are a number of accounts that post interesting things from time to time, I found that it is better to just subscribe to their feeds through other means and contact them directly (e.g. e-mail) in case there’s really something valuable that I would like to share with them.

Every now and them I’m checking hackernews, either to find out about cool new open source projects and tools, or to see who’s to blame for my Plausible graph peaking again and what people are commenting.

A while ago I gave SSB another try via the Manyverse client. Unfortunately the client randomly stopped working and I seem to be unable to recover my account using the mnemonic phrase, meaning that I’m currently locked-out of the account.

I have also registered on Joshua Stein’s plan.cat and use a .zshrc function to update it from time to time.

Contacts, Calendars and Tasks

I’m running my own Baïkal server that allows me to connect any device using the infamous CalDAV and CardDAV protocols. These protocols are supported by virtually every operating system and contacts- or calendar-app and allow for syncing appointments, events and contact details across multiple platforms.

I have set up Baïkal on an OpenBSD instance that runs a minimal but reliable httpd + PHP-FPM setup. I share the instance with a few people who also didn’t enjoy having all their contacts and calendar entries stored at Google, Apple or any other surveillance capitalism profiteurs.

For tasks I’m using Taskwarrior’s taskd, which is a daemon that allows to sync tasks between devices. I use taskwarrior-tui on Linux and Foreground on my phone.

I found out about Tasks.org and am in the middle of migrating from Taskwarrior to it. The main reason for that is simplicity: Tasks.org uses my existing Baïkal server, sparing me the need to run yet another service. I’m still figuring out a way to make taskwarrior-tui play nicely with it, though.

Documents & Data

Keeping data secure and private is important for someone who is constantly on the move. And while not everyone can carry a fully-encrypted and remotely backed-up data center with them all the time, there are nevertheless ways to retrieve, send and store data in ways in which things won’t blow up in the event of disaster.

An important note upfront: I always make sure that every device I carry with me has hard-drive encryption turned on. On macOS it’s called FileVault, on Linux it’s OpenZFS’s native encryption or Dm-crypt. Smartphones usually have hardware full-disk encryption turned on by default.

An important topic when using encrypted devices is plausible deniability. Gregory Alvarez wrote a good piece on that, which I recommend reading.

Version Controlled Data

Much of my critical data is version controlled, meaning that I maintain it within a git repository. In addition, if the data is by any means confidential, I use git-crypt to transparently encrypt and decrypt it using my GPG key. Depending on the type of data, my git remote is either a public or private GitHub repository or a private git server that I run on my own infrastructure.

Additionally, I use git for collaborating, since it’s possible to give other people access to individual repositories.

Keep in mind that version control makes sense for changing data where you want to keep a revisions history. For everything else it might end up being a waste of disk space.

Synchronized Data

Data that doesn’t need to be version controlled and might not even require to be readily available at all times goes here. For example documents that might be kept for compliance reasons. For this sort of data, I use Syncthing.

Syncthing takes care of syncing everything I need between my workstation and my mobile devices.

Office Suite

Instead of Google Docs or Microsoft Office 365 I use pure text form data, which I then convert into other formats like PDF. For documents I mostly use NeoVim + Pandoc, for spreadsheets sc-im. For everything more sophisticated I might resort to LaTeX or even a full-blown LibreOffice.

Collaborative work usually happens on either a Git repository, using pure text form data, or CryptPad.

Diagrams

I either draw ASCII diagrams manually in NeoVim or I write PlantUML and render it to either format.

Everything else I do in Diagrams.net (formerly Draw.io).

Note: On macOS there is Monodraw, unfortunately it’s not available on any other platform.

When I need to draw sophisticated service architecture diagrams, I use Cloudcraft.

Backups

Since most of the important things that I work with are already pushed to remote Git repositories or synced over Syncthing, I do not need to backup much. Nevertheless, I still run Duplicacy, which supports on-the-fly encryption.

Security

Apart from obvious things like encryption and strong passwords, I also use methods to make sure that in case my data was compromised, I notice it and maybe get some clues about what happened. Honeypots and canary traps help with this.

While honeypots are more complicated to set up and run, canary traps can easily be generated using services like CanaryTokens.org and “BlueCloudDrive”. These traps can then be added to …

  • file-systems, as website bookmarks or as tags included in HTML files
  • e-mail services (e.g. by having a mail titled “Important documents” in your inbox that contains an obfuscated link to the token
  • digital address books, by adding the link as website of a (fake) contact that might be of interest for others
  • calendars, by adding a recurring meeting with the token link as meeting URL
  • physical objects, e.g. to phones, credit cards and even printed documents, either as very short text-links or as QR codes

More info on canary tokens here

In addition, I make sure that I’m in full control of the things that happen within my HAN and that I get notified whenever something might start to smell fishy. While a full blown IDS like Snort would be over-engineered for my HAN/LAN, I do nevertheless log and periodically analyze connections and things that happen within my local network.

Cloud

In order to be able to work online I need infrastructure that runs somewhere in a well-connected and ideally heavily guarded environment. For simple things like websites, I use CDN-based storage. Amazon S3, Google Cloud Storage or GitHub Pages are sufficient for that purpose. For more complex setups and services, though, it can be tricky to strike a good balance between cost, comfort, privacy and availability.

Infrastructure Providers

For a long time I have been using Amazon Web Services and Google Cloud Platform as cloud providers for my cloud infrastructure. I cut ties with AWS, because GCP turned out to be cheaper for what I was doing. And even though GCP sucked (and in parts still does), I was able to migrate everything without too much effort.

When I began cutting ties with Google a year ago, I started experimenting with other cloud providers. One important requirement for me is an API for which Terraform has a provider plugin. This allows me to do (at least) the most basic things through code and have a certain degree of reproducibility.

Additionally, since I was running many things on AWS Lambda (later Google Cloud Functions), I was eager to find a provider that would offer a serverless environment to which I could migrate.

Unfortunately there is still no competition to Google and Amazon on the serverless playing field, which meant that I would have to go for the second best option: DIY.

I ended up on DigitalOcean, mainly because it was the cheapest cloud infrastructure provider at that time that had a working Terraform implementation. I migrated all my services into containers and pods and ran them on DO’s managed Kubernetes service, using the smallest available node sizes and horizontal auto-scaling enabled. Unfortunately it turned out to be more expensive and require more maintenance than everything I used on AWS and GCP before.

Today I have partially returned to AWS for everything serverless, while using mainly Vultr for everything else, including K8s.

Not much has changed and there still is no mature alternative to Lambda/Cloud Functions on the market. Here is a list of providers that offer at least a bare-minimums integration with Terraform and that I tried and found to be working well in general:

A honorable mention is OpenBSD Amsterdam, even though it does not have a Terraform provider integration.

A not-so-honorable mention is OVH. OVH is one of the worst services I came across to this very day. I gave it a try once and immediately fled the service after having to deal with technical issues and bad customer service right from the very beginning. If you are considering OVH and thinking *"… but is OVH really that bad?", I [can][https://www.reddit.com/r/ovh/comments/1040r35/rant_ovh_has_the_worst_support_ever_dont_use_it/] [assure][https://www.reddit.com/r/webhosting/comments/fubphw/is_ovhcloud_that_bad/] [you][https://www.trustpilot.com/review/ovh.it] [that][https://www.trustpilot.com/review/ovhcloud.com] [it][https://lowendtalk.com/discussion/186195/ovh-is-terrible] [truly][https://forum.ovh.com/showthread.php/78318-OVH-worst-service-provider-I-ever-had-since-my-first-server-in-1998] [is][https://www.reddit.com/r/ovh/comments/e0to5z/bad_experience_with_ovh_customer_service/] [that][https://community.ovh.com/en/t/support-is-awesomely-terrible-at-ovh/1606] [bad][https://www.techradar.com/news/ovh-says-it-doesnt-hold-backups-for-some-systems-affected-by-data-center-fire].

Additionally, there are a couple of special use-case providers that I’m either actively using or keep using from time to time. They offer raw VPS instances without bells and whistles and require much more administrative work. Also they’re not exactly cheap. However, in return, these services operate in ways that value privacy and free speech and make it hard for anyone to interfere with whatever operation is being run on their systems. Here are some interesting options:

  • Njalla: Based in Nevis, hosted in Sweden, payment via Monero possible
  • orangewebsite: Based and hosted in Iceland, payment via Bitcoin possible
  • 1984 Hosting: Based and hosted in Iceland, payment via Bitcoin possible
  • FlokiNET: Based and hosted in Iceland, payment via Monero possible
  • Privex: Based in Belize, hosted in Sweden, Finland, Germany, Netherlands and the US, site available via Tor and I2P, accepts XMR, BTC, LTC and more
  • Icy Evolution: Based and hosted in Mauritius, no cryptocurrency payment options
  • NiceVPS: Based in Dominica, hosted in Switzerland or Netherlands, KVM VPS with full disk encryption support, Tor hosting supported, payment via Monero possible
  • Cockbox: Based and hosted in Romania, Tor hosting supported, payment via Monero possible, 69.69% availability though
  • Impreza: Based in Romania, hosted in Romania, Ukraine, Iceland or Finland, Tor hosting supported, payment via Monero possible
  • CryptoHO.ST: Based and hosted in Romania, payment via Monero possible
  • Full list of hosters that offer crypto payments
  • Tor Project’s list of good and bad companies

The key to privacy here isn’t necessarily the jurisdiction, but more the fact that by using Monero as payment option it’s going to be harder for people to find out who’s running the service. However, obviously concealing a full operation requires more than just an anonymous payment option and a jurisdiction that’s less likely to interfere. Various posts on Dread (Tor) provide valuable insights into the OpSec topic, regardless of the service that’s being run.

A different approach can be taken with a service like Fleek. Fleek allows you to host static websites on a web CDN and additionally makes them available over IPFS. Fleek can be used completely anonymous since they have a free plan that only requires a (burner) GitHub account to set up. While Fleek is prone to censorship due to the jurisdiction it operates in, your actual website is able to live on even after it was taken down, when distributed over IPFS.

Last but not least, I sometimes partner with business contacts who happen to run actual hardware in data-centers and rent several Us of processing power. While this is an expensive approach, it’s the only option in cases in which the service/data is required to comply with regulations that prohibit cloud usage.

Domains

Domains are an important part of web privacy. The majority of registrars offer paid privacy guard subscriptions for individual domains, that replace personal contact details with generic provider info in the data that’s being transmitted to ICANN. However, a simple phone call or a cease and desist letter will suffice to find out who is behind a guarded domain.

A better approach to this is using a provider like Njalla, which lets you register domains in their name, making them the owners of that domain. Since registrations on Njalla are possible over VPN/Tor and payment via Monero is available, Njalla can be used as truly private domain registrar, so that even if they would ever pass on customer data to whoever might be requesting it, it would be of little use to them.

Git

I use GitHub, as well as my own Gitea infrastructure for projects. I used to run an own version of SourceHut but eventually gave it up. Sometimes clients have obscure requirements (read Bitbucket or AWS CodeCommit), in which case I use services other than GitHub or my own infrastructure.

Web

The web stack for nearly everything I do is as lean as possible. Landing pages and websites that used to run on WordPress and Ghost have all been converted to static Hugo sites. For everything that requires more functionality I tend to use as little JavaScript as possible. I run a few heavy-weight front-ends that make use of Angular, but I’m working on replacing those with more lightweight implementations, using stacks like Svelte.

I often run web projects on services like Render. Even though for example Cloudflare allows to run static sites on their infrastructure, I refrain from it due to their already big enough influence on the internet and their utterly broken hcaptcha for everyone who’s visiting a Cloudflare-hosted website over VPN or Tor.

This Site

Since many people keep asking me about this site, I decided to document the setup. The primary focus for my journal was to make it as available and cost efficient as possible. Since I had to deal with several HackerNews hugs of death, I decided against hosting it on e.g. an OpenBSD VPS. Instead I found it a lot cheaper – $0 most of the time – and resilient to host it on Render.

This site is a Hugo-based static site that I maintain inside a private GitHub repository. Why GitHub? Because it allows me to connect it to Render and have the site deploy as soon as it commit something into the master branch. Hence, I usually write new posts on the develop branch and eventually merge develop into master to have the current version published. Render takes care of building the Hugo site and pushing it onto their CDN.

In addition I nevertheless run an OpenBSD VPS, but solely for the Tor version of this site. The VPS is sufficient for handling onion traffic. I use a GitHub workflow to build and publish the site to the Tor server. Fun fact: I have a dedicated configuration for Tor which allows me to publish Tor-exclusive content.

The look of this website is a Hugo theme that I custom built from scratch.

APIs & Services

As mentioned before in the Infrastructure Provider part, I prefer to use serverless architectures over containerized services, because it’s more efficient. However, since the serverless cloud provider market is a de facto oligopoly there’s not a lot of a choice:

Either stick to one of the big cloud providers or migrate to a different technology stack. There are DIY serverless infrastructure projects around, for example Kubeless and OpenFaaS, but these unfortunately won’t help cutting costs or decreasing DevOps needs.

Analytics

I’m using a privacy-respecting, open source analytics platform called Plausible on many websites. Previous to that I used Fathom, which I recommend as well.

For more sophisticated projects like eCommerce websites Matomo is a more powerful choice.

Push Notifications

I use Pushover for retrieving push notifications about status changes of individual cloud services. For example, when CI runs for deploying this journal complete, I retrieve a push notification with the status. Pushover is a minimalist service and offers integration for a wide variety of environments.

With my move to GrapheneOS on mobile, I have implemented a pushover-to-xmpp bridge that would forward Pushover notifications to my XMPP account, so that I can read them on the XMPP client on my phone. The reason for that is the lack of Pushover’s support for non-GSF/FCM/GCM phones.

Dead Man’s Switch

TODO: Build dead man’s switch for data and cloud infrastructure.

Further Reading


Enjoyed this? Support me via Monero, Bitcoin, Lightning, or Ethereum!  More info.

Published on 2021-03-27 and updated on 2024-01-30