xmrcloud
menu

DS Lite — no-KYC offshore dedicated servers (Iceland, Romania, Monero)

ds-lite — Entry-level offshore dedicated server. 

xmrcloud-cli provision --plan=ds-lite --region=<is|ro>

Order DS Lite

monthly $89
annual -20% $854
biennial -25% $1602
order ds-lite

no-kyc crypto billing (xmr recommended; btc / ltn / ltc / eth / usdt accepted) — why-monero covers the rationale, payments the flow.

xmrcloud-cli spec --plan=ds-lite

cpu Intel Xeon E-2236 (6c / 12t @ 3.4 GHz)
ram 32 GB DDR4 ECC
storage 2× 480 GB NVMe (RAID-1)
bandwidth 30 TB / month
port 1 Gbps
virtualization Bare-Metal
os Ubuntu, Debian, AlmaLinux, Windows Server, Proxmox
ip 1 × IPv4 + IPv6
ddos-shield 80 Gbps
uptime-sla 99.9%

xmrcloud-cli describe --plan=ds-lite

ds-lite is the entry dedicated tier and the first point where no hypervisor sits between you and the silicon: a Xeon E-2236 (6c/12t @ 3.4 GHz), 32 GB ECC, and two 480 GB NVMe in RAID-1. It suits a leak archive or source-protection workload where co-tenancy is itself in the threat model, or a full-node operator wanting LUKS with dropbear-initramfs remote unlock. Throughput-bound scraping and transcoding want ds-mid's 16-core Ryzen; a capacity-driven upgrade from VPS fits vps-16.

xmrcloud-cli regions --plan=ds-lite

region country ping flag
is Iceland (Reykjavik) ~38ms FRA --region=is
switzerland Switzerland (Zurich) ~?ms --region=switzerland
netherlands Netherlands (Amsterdam) ~?ms --region=netherlands
ro Romania (Bucharest) ~28ms FRA --region=ro
moldova Moldova (Chișinău) ~?ms --region=moldova
bulgaria Bulgaria (Sofia) ~?ms --region=bulgaria
russia Russia (Moscow) ~?ms --region=russia
panama Panama (Panama City) ~?ms --region=panama

after you click order 

xmrcloud-cli provision --plan=ds-lite --region=is
[ok] reserving capacity in region=is
[ok] node allocated: ds-lite-is-11
[ok] applying hardened-by-default profile (sshd, fail2ban, unattended-upgrades)
[ok] base image bootstrapped (Debian 12)
[ok] handoff key sealed → view via the console at /console
provisioned in 47s. ssh access via onion-auth or wireguard, your choice.

you receive the onion-auth key + initial sshd config in the same handoff. no email-shipped credentials. nothing is logged to the operator side.

cat /etc/xmrcloud/baseline.d/*

Every DS Lite ships with the xmrcloud hardening baseline applied on the first boot — no opt-in flag, no add-on, no separate purchase. The baseline is the same across the catalog (vps / dedicated / gpu / tor / i2p / lokinet); category-specific extras are listed below the common section. Detailed per-control runbooks live in /docs; the cross-cutting overview is at /hardening.

  • KERNEL. KSPP-baseline sysctls applied (kernel.kptr_restrict=2, kernel.yama.ptrace_scope=1, kernel.unprivileged_bpf_disabled=1, vm.unprivileged_userfaultfd=0, net.ipv4.tcp_syncookies=1, +12 more), unprivileged user-namespace creation gated, kexec disabled at runtime. Full list and rationale: /docs/kernel-hardening-checklist.
  • SSHD. PasswordAuthentication no, ChallengeResponseAuthentication no, KbdInteractiveAuthentication no, PermitRootLogin prohibit-password, MaxAuthTries 3, Ed25519-only host keys (RSA host keys removed), legacy KEX / cipher / MAC families disabled. fail2ban preconfigured with the sshd-default ruleset. Runbook: /docs/harden-sshd; key migration: /docs/ssh-key-migration.
  • AUDIT. auditd enabled with the laurel-compatible default ruleset (auth, identity, network-config, time-change, mount, perm-mod). unattended-upgrades on for main/security only — feature releases stay operator-controlled. systemd-journald persistent storage with SystemMaxUse=512M.
  • NETWORK. Egress-default-permit (the box reaches the internet), ingress-default-deny (only sshd + the customer's declared services). Outbound port 25 (SMTP) closed by default; customers operating a real MTA request the lift via /contact with the reverse-DNS pointing to a domain they control. Dual-stack IPv4 + IPv6 (/64 routed). RIPE- allocated PI on Iceland and Romania.
  • MONITORING. node_exporter (Prometheus textfile exporter) listening on 127.0.0.1:9100 — the operator's monitoring scrapes via wireguard from the management VLAN, never from the public internet. Customers wanting their own metrics tap add a second exporter on a private interface.
  • BARE-METAL ACCESS. IPMI / iDRAC / iLO console access depending on chassis vendor, full sysctl control, customer can swap kernel (linux-hardened, grsec-flavoured patches if a subscription is held), grub LUKS + dropbear-initramfs available for full-disk encryption with remote unlock.

the baseline is editorial-stable — when the operator changes a default, the change is logged in /notes with the rationale and the migration notes for boxes already in service. /hardening is the canonical pillar; /docs is the procedural manual.

grep -l 'ds-lite' /usr/share/doc/xmrcloud/playbook/

  • /playbook/scrapingstable-asn vps for ethical crawling: clean ip reputation, generous egress, no per-target rate limits
  • /playbook/crypto-noderun a btc/eth/xmr/lightning node or pos validator on hardware you control, in a crypto-neutral jurisdiction

faq -p ds-lite

Why pick ds-lite over vps-16 at a similar price?

Because ds-lite removes the hypervisor from the trust boundary: no co-tenants, no KVM layer, direct hardware. For a leak archive or source-protection workload where co-tenancy is itself in the threat model, that boundary is the reason to pay the dedicated premium. If the driver is only capacity, vps-16 is simpler and provisions faster.

Can I run full-disk encryption with remote unlock on ds-lite?

Yes — on bare metal you get full sysctl and boot control, so LUKS with dropbear-initramfs (remote SSH unlock at boot) is supported, and the operator does not retain your key. The default install ships unencrypted; encryption is opt-in per customer. The 2×480 GB NVMe are in RAID-1, so a single drive failure doesn't interrupt the workload.

How fast is ds-lite provisioned?

Bare metal is not instant — the operator racks and configures the box and runs your chosen install, typically within the stated dedicated lead time rather than the sub-5-minute VPS window. That's stated honestly here; if you need instant provisioning, a VPS tier like vps-16 is the right pick.

Is this a real bare-metal server?

Yes. Dedicated tiers ship with full bare-metal hardware (no virtualization layer, no hypervisor). The customer has IPMI / iDRAC / iLO access depending on chassis vendor for OS reinstall and emergency console. The OS is whatever the customer picks at provisioning — Debian / Ubuntu / Rocky / Alma / OpenBSD / Whonix Gateway templates are all available; bring-your-own-ISO is supported on request via /contact.

Where is the dedicated server hosted?

Iceland (Reykjavik, RIPE) at the moment — the dedicated catalog is Iceland-only at MVP because the Romania racks are spec'd for VPS density rather than bare metal. The Iceland datacenter has hydroelectric / geothermal power, RIPE-allocated IPv4 + IPv6, and the jurisdictional posture documented at /location/is.

Do I need to pay in Monero?

No. XMR is recommended (chain-analytics-resistant) but the OxaPay processor accepts BTC, Lightning, LTC, ETH, and USDT. The trade-off is documented at /why-monero. For a dedicated tier the order surface is the same as VPS — no card, no fiat, no KYC bridge. Per-order Monero subaddresses are derived per MRL-0006.

What hardening is applied to the dedicated server?

The same KSPP kernel-baseline + sshd / auditd / unattended-upgrades hardening that VPS tiers receive. On a dedicated chassis the customer also gets full sysctl control, can recompile a hardened kernel (linux-hardened from Arch or grsec-flavoured patches if the customer holds a grsec subscription), and can install grub LUKS + dropbear-initramfs for full-disk encryption with remote unlock. Default install ships unencrypted; encryption is opt-in per-customer.

Can I host a Tor relay or exit node on a dedicated server?

Yes. Dedicated bandwidth (unmetered on the contracted port speed) makes the dedicated tier the right pick for high-traffic Tor relays. The AUP (/legal/aup) permits middle, exit, and bridge relays. Dedicated tor-relay setup is documented at /docs/run-non-exit-tor-relay and /docs/bgp-resilience-for-tor-relay-operators.

What's the SLA on dedicated?

The /legal/sla document covers the full uptime target (99.9% monthly on the contracted port, hardware swap within 4 hours of confirmed-failed diagnostics). Service credits ladder per the SLA section 3 schedule. The honest framing is at /uptime — synthetic 99.99% badges are not used; the SLA reflects what the operator can actually commit to.

order ds-lite

no-kyc crypto billing (xmr recommended; btc / ltn / ltc / eth / usdt accepted) — why-monero covers the rationale, payments the flow.

ls /guide