Self-Hosting vs VPS
Chapter 8 — Self-Hosting vs VPS
You've built a working home server with public access via Cloudflare Tunnel. Now the question is: when does it make sense to move to a VPS, and when is self-hosting the right call? This chapter is honest about the trade-offs — cost, reliability, control, and the ISP restrictions that make home hosting harder than it should be. It also covers the hybrid approach: keeping your home server for most things while using a cheap VPS for what it's actually better at.
What this chapter covers: What self-hosting and VPS hosting really mean day-to-day. Complete pros and cons for both. Real cost comparison including electricity, hardware, and time. Best-value VPS providers in 2026. The hybrid approach (VPS as jump server or tunnel endpoint). Decision framework — when to switch and when to stay. First five steps when you spin up a VPS for the first time. Course summary.
What Each Option Actually Means
Self-hosting (what you have now):
Your home │ Your server │ Your Apache │ Your files
broadband ───┤ (Linux box) ├──────────────▶│ /var/www/
(dynamic IP) │ running 24/7 │ port 80/443 │ osztromok.com
│ │ │
└── Cloudflare Tunnel ──────────┴── bypasses ISP block
VPS (renting a slice of a data centre):
Data centre │ Your VPS │ Your Apache │ Your files
(1 Gbps │ (Debian VM) ├──────────────▶│ /var/www/
fibre, UPS, │ static IP │ port 80/443 │ osztromok.com
generators) │ no ISP block │ │
│ 99.9% uptime │ │
The core difference is who provides the infrastructure. Self-hosting means you own the hardware, pay the electricity, and your ISP's policies are your ceiling. A VPS means renting compute in a data centre — you get a static IP, no ISP restrictions, and someone else worries about power, cooling, and network redundancy.
Self-Hosting — The Full Picture
Advantages
- Effectively free — hardware you already own + ~£5–10/month electricity for a Pi or mini PC. No ongoing subscription.
- Unlimited storage — add a hard drive, not a pricing tier. A 4TB drive is a one-time cost.
- No bandwidth caps — Virgin Media gives you a home broadband allowance. Serve as much as you want within it.
- Full hardware control — GPUs, USB devices, cameras, sensors — things a VPS can't touch.
- Privacy — your data never leaves your home. No cloud provider can access it.
- Learning value — every problem you solve on home hardware teaches you something a managed service would hide.
- Local network speed — internal services (NAS, Plex, Home Assistant) run at LAN speeds, not through the internet.
Disadvantages
- ISP restrictions — Virgin Media blocks inbound port 80/443. Cloudflare Tunnel works around it, but it's a workaround.
- Dynamic IP — DDNS required for direct access (Chapter 7). Tunnel makes this irrelevant for web traffic.
- Single points of failure — power cut, router reboot, ISP outage, hardware failure → site goes down. No SLA.
- Upload speed — Virgin Media home broadband upload is typically 10–20 Mbps. Fine for a personal site, limiting for high traffic.
- Security exposure — an internet-connected device at home means a compromised server is on the same network as everything else.
- No IPv6 support on some Virgin Media plans, complicating modern deployment.
- Time cost — hardware breaks, you fix it. Nobody else's problem.
VPS — The Full Picture
Advantages
- Static public IP — no DDNS, no Cloudflare Tunnel needed. Direct port 80/443 with no ISP interference.
- Data centre reliability — UPS, generator backup, redundant network. 99.9%+ uptime guarantees typical.
- Fast symmetric bandwidth — 1 Gbps is standard. Upload as fast as download.
- Isolated from home network — a compromised VPS doesn't put your home devices at risk.
- Easy to snapshot and restore — most providers let you take a full VM snapshot in one click.
- Spin up / down on demand — resize, clone, destroy with no physical hardware involved.
- IPv6 included — all major VPS providers assign a public IPv6 address.
Disadvantages
- Ongoing monthly cost — £3–10/month indefinitely. Small, but it adds up over years: £36–120/year.
- Storage costs money — base VPS typically 20–40GB SSD. Extra storage billed separately.
- Your data on someone else's hardware — provider can theoretically access it. Encryption helps.
- Still your responsibility — the OS, security patches, Apache config, backups — all still you. A VPS is not a managed service.
- Bandwidth limits — usually 1–3 TB/month on cheap plans. Fine for most sites; heavy traffic incurs overage charges.
- No physical access — can't plug in a USB drive, GPU, or USB key. Everything remote.
Real Cost Comparison
| Cost Item | Self-Hosting | VPS (Hetzner CX22) |
|---|---|---|
| Monthly fee | £0 | ~£4.50/month |
| Electricity (idle server) | ~£5–12/month (5–15W × 24hr) | Included |
| Hardware | Already owned (Raspberry Pi / mini PC). Replace every 4–7 years. | None |
| Bandwidth | Home broadband (already paid) | 20 TB/month included — far more than needed |
| Storage | Cheap — add HDDs as needed | 40GB SSD. Extra costs £0.04/GB/month. |
| Static IP | Not available (Virgin Media). Use Tunnel. | Included |
| Uptime SLA | None — depends on your hardware + ISP | 99.9% SLA (network) |
| Time to fix outages | You, immediately, whatever time it is | Hardware managed by provider |
| Realistic monthly total | £5–12 (electricity only) | £4.50 (fixed) |
The costs are surprisingly close. If your server draws 10W and electricity is 25p/kWh, that's £1.80/month — cheaper than any VPS. But a desktop draws 50–150W, adding £9–27/month. Power consumption is the make-or-break factor for home hosting economics. A Raspberry Pi or a modern mini PC (N100/N305) running at 5–8W is genuinely cheaper than a VPS. A desktop PC left on 24/7 is not.
Check your server's actual power draw: plug it into a smart plug with energy monitoring (Tapo P110, Shelly Plug S) and read the real wattage. Multiply by 24 × 30 × £0.25 to get the monthly electricity cost. That number tells you whether self-hosting is cheaper than a VPS.
Best-Value VPS Providers (2026)
Hetzner Recommended
£3.60–5/mo
German provider, excellent reputation. CX22 (2 vCPU, 4GB RAM, 40GB SSD, 20TB traffic) is the sweet spot. Data centres in Nuremberg, Falkenstein, Helsinki, Ashburn. No UK DC, but latency from Germany is fine (~20ms). Best value in EU by a large margin.
Oracle Cloud Free forever
£0
Genuinely free — Always Free tier includes 4 ARM CPUs + 24GB RAM (split across up to 4 instances) + 200GB storage. Catch: sign-up requires a credit card, instances can be reclaimed if "idle." Hard to provision due to capacity. Worth trying — remarkable specs at zero cost.
Vultr UK DC
~£4.50/mo
Has a London data centre — useful if UK latency matters or if GDPR requires UK data residence. $6/month starter is 1 vCPU / 1GB RAM / 25GB SSD. Good control panel, hourly billing. Slightly pricier than Hetzner for equivalent specs.
DigitalOcean UK DC
~£5.50/mo
Excellent developer UX, great documentation. $6/month Droplet (1 vCPU / 1GB / 25GB). London data centre. Better-known than Hetzner, slightly more expensive. Great if you want a polished dashboard and one-click apps (WordPress, LAMP stack etc.).
Contabo
~£4/mo
Very cheap specs — 4 vCPU / 8GB RAM for ~£5. European data centres. Trade-off: shared resources, slower support, less polished experience. Good for hobbyist workloads where raw specs matter more than reliability guarantees.
Linode (Akamai)
~£4.50/mo
Reliable, long-established. Now owned by Akamai. Nanode plan: 1 vCPU / 1GB / 25GB / 1TB traffic for $5/month. Good documentation, predictable pricing. London DC available. Similar to DigitalOcean in feel.
Pricing changes. These figures are approximate as of mid-2026. Always check the current pricing page before signing up — providers adjust prices regularly. Hetzner in particular sometimes changes its Euro pricing, which affects the GBP equivalent.
The Hybrid Approach
You don't have to choose one or the other. Many home hosting setups use a small cheap VPS for the specific things a VPS is better at, while keeping the home server for storage-heavy or hardware-dependent workloads. Three practical hybrid configurations:
Decision Framework — When to Move, When to Stay
Is your home server drawing more than 20W continuously?
YES → Electricity cost is £8+/month. A VPS is probably cheaper. Consider VPS.
NO → Home power cost is under £4/month. Self-hosting wins on cost.
Does your site need 99.9%+ uptime (customers, revenue, commitments)?
YES → Home hosting can't reliably deliver this. ISP outages, router reboots, power cuts.
Move to VPS — uptime is non-negotiable for production services.
NO → Personal/hobby sites tolerate occasional downtime. Stay home.
Do you need more than 20 Mbps sustained upload?
YES → Virgin Media home upload typically maxes out around 10–20 Mbps. High-traffic video, large downloads, API-heavy services will hit this ceiling.
VPS — data centre bandwidth solves this.
NO → A personal site with a few thousand monthly visitors uses well under this. Stay home.
Is Cloudflare Tunnel working reliably for your use case?
YES → You've bypassed the Virgin Media restriction elegantly. No reason to move.
NO (non-HTTP needs, performance issues, reliability concerns) →
Consider VPS or hybrid (Option B — self-hosted reverse proxy).
Is this primarily for learning / homelab?
YES → Stay home. Home hosting teaches you more. The constraints are the lesson.
Keep the home server. The problems you hit are features, not bugs.
For your specific situation — learning project, Virgin Media, Cloudflare Tunnel working — the home server is the right answer right now. The tunnel solved the ISP restriction problem. A £3 Hetzner VPS is worth having alongside it purely as an SSH jump box or for a second experimental environment.
First Steps When You Spin Up a VPS
If you do go the VPS route — whether for a jump box, a hybrid setup, or full migration — these are the first things to do on a fresh Debian/Ubuntu VPS before anything else.
1
Add your SSH public key and disable password login. Most providers let you add an SSH key at provisioning. If not:
ssh-copy-id root@vps-ip, then edit /etc/ssh/sshd_config and set PasswordAuthentication no. Reload sshd. Password-based SSH is attacked constantly — key auth is not optional.
2
Create a non-root user.
adduser philip → usermod -aG sudo philip → copy your SSH key to the new user → test login → then disable root SSH login (PermitRootLogin no in sshd_config). Never work as root day-to-day.
3
Update everything.
sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y. Then configure unattended security upgrades: sudo apt install unattended-upgrades -y && sudo dpkg-reconfigure unattended-upgrades. A VPS that installs security patches automatically is dramatically safer than one that doesn't.
4
Set up the firewall.
sudo apt install ufw -y → sudo ufw allow ssh → sudo ufw allow 80/tcp → sudo ufw allow 443/tcp → sudo ufw enable. UFW defaults to deny all inbound. Open only what you need. A VPS without a firewall is exposed to the entire internet on every port.
5
Install fail2ban.
sudo apt install fail2ban -y → sudo systemctl enable fail2ban && sudo systemctl start fail2ban. Default config bans IPs with 5 failed SSH attempts for 10 minutes. On a public-IP VPS, you'll have hundreds of brute-force attempts per day — fail2ban handles them silently.
6
Install Apache and point DNS at the VPS IP.
sudo apt install apache2 -y. The VPS has a static public IP — go to Cloudflare DNS, add an A record pointing your domain at that IP (orange cloud for CDN/SSL, or grey cloud for direct). No tunnel needed. Apache on port 80 will be publicly reachable immediately.
# Quick "is the VPS ready?" checklist — run after initial setup
$ ssh philip@vps-ip "whoami && sudo ufw status && sudo systemctl status fail2ban --no-pager | head -3"
philip
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
443/tcp ALLOW Anywhere
● fail2ban.service - Fail2Ban Service
Active: active (running)
Course Summary — What You've Built
You've worked through everything required to understand, configure, and maintain a complete home web hosting setup — and you know exactly when and why you'd move beyond it. Here's what this course covered:
Chapter 1
DNS Fundamentals
Resolution chain: recursive → root → TLD → authoritative.
A, CNAME, MX, TXT, NS records. TTL strategy.
A, CNAME, MX, TXT, NS records. TTL strategy.
Chapter 2
Managing DNS at IONOS
Registrar vs DNS host. @ notation. Adding A, CNAME, MX, TXT records. Pitfalls and propagation.
Chapter 3
Moving to Cloudflare
Orange vs grey cloud. NS transfer, CNAME flattening at apex. Migration without downtime.
Chapter 4
Cloudflare Tunnel
Outbound architecture bypasses ISP block. cloudflared install, config.yml, ingress rules, systemd service.
Chapter 5
Apache Virtual Hosts
sites-available/enabled, a2ensite. ServerName, DocumentRoot, Directory block, AllowOverride, per-site logs.
Chapter 6
Subdomains End-to-End
Two-part requirement: DNS + server. Deployment checklist, www redirect, wildcard, reverse proxy (ProxyPass).
Chapter 7
Dynamic DNS
DuckDNS cron script. ddclient + Cloudflare API. Systemd timer. When tunnel makes DDNS unnecessary.
Chapter 8
Self-Hosting vs VPS
Real cost comparison. Provider options. Hybrid approaches. Decision framework. VPS first-steps checklist.
What's covered in the companion course — Securing Your Web Server: HTTPS with Let's Encrypt, enforcing HTTPS redirects, UFW firewall in depth, fail2ban tuning, SSH hardening (key auth, port change, AllowUsers), Apache security headers (HSTS, CSP, X-Frame-Options), ClamAV malware scanning, and ongoing monitoring and maintenance. Security is the natural next step from everything in this course.
Quick Reference — Chapter 8
| Situation | Recommendation |
|---|---|
| Personal / learning project | Self-host. The constraints are the learning. Cloudflare Tunnel handles Virgin Media. |
| Server draws >20W continuously | Electricity > VPS cost. Switch to VPS or get a low-power mini PC (N100/Pi). |
| Need 99.9% uptime | VPS. Home hosting cannot guarantee this. |
| Need large cheap storage | Home server. HDDs are far cheaper than VPS storage pricing. |
| Need reliable SSH from outside | Cheap VPS as SSH jump box (£3/month) or DDNS + grey-cloud A record. |
| Want to reduce Cloudflare dependency | Hybrid Option B: self-hosted WireGuard + VPS reverse proxy. |
| Best all-round cheap VPS | Hetzner CX22 (~£4.50/month). UK latency fine, excellent value. |
| Want free VPS | Oracle Cloud Always Free (ARM, 4 CPU/24GB RAM). Hard to provision, worth trying. |
| VPS first-steps command | Purpose |
|---|---|
| ssh-copy-id philip@vps | Copy your SSH public key to the VPS — enables key-based login |
| PasswordAuthentication no | In /etc/ssh/sshd_config — disable password SSH after key auth works |
| sudo ufw allow ssh/80/443 | Open only the ports you actually need before enabling the firewall |
| sudo ufw enable | Activate the firewall — default deny all inbound |
| sudo apt install fail2ban -y | Automatic IP banning for brute-force SSH attempts |
| sudo apt install unattended-upgrades -y | Automatic security patches — essential on a public server |