Run a Monero node on a VPS that asks for nothing

# Monero CLI 0.18.5.1 "Fluorine Fermi". Sources for every step:
#   https://www.getmonero.org/downloads/
#   https://docs.getmonero.org/running-node/monerod-systemd/

apt update && apt install -y curl bzip2 ufw

# 1. Download the binaries and the signed hash list, then compare.
cd /tmp
curl -LO https://downloads.getmonero.org/cli/linux64
curl -LO https://www.getmonero.org/downloads/hashes.txt
sha256sum linux64
# curl -LO on /cli/linux64 saves the tarball under the name "linux64", so the
# filename differs from the manifest. Compare the hash you just printed against
# the monero-linux-x64-v0.18.5.1.tar.bz2 line in hashes.txt.
# hashes.txt is canonical only once its GPG signature checks out against
# binaryfate's key in the source tree:
# https://github.com/monero-project/monero/blob/master/utils/gpg_keys/binaryfate.asc

# 2. Unpack and install the binaries.
tar -xjf linux64
mv monero-x86_64-linux-gnu-v0.18.5.1/* /usr/local/bin/.

# 3. Service account, data directory, log directory.
useradd --system monero
mkdir -pm 750 /var/lib/monero
mkdir -pm 750 /var/log/monero
chown monero:monero /var/lib/monero /var/log/monero

# 4. Configuration. prune-blockchain must be set BEFORE the first sync: added
#    later it prunes the old data only logically, without shrinking the file.
mkdir -p /etc/monero
cat > /etc/monero/monerod.conf <<'EOF'
data-dir=/var/lib/monero/bitmonero

prune-blockchain=1
sync-pruned-blocks=1

log-file=/var/log/monero/monero.log
log-level=0
max-log-file-size=2147483648

check-updates=disabled
enable-dns-blocklist=1

p2p-bind-ip=0.0.0.0
p2p-bind-port=18080
no-igd=1

# Admin RPC stays on localhost. Reach it over an SSH tunnel.
rpc-bind-ip=127.0.0.1
rpc-bind-port=18081

out-peers=12
in-peers=48
limit-rate-up=1048576
limit-rate-down=1048576
EOF
chown monero:monero /etc/monero/monerod.conf

# 5. systemd unit, taken from the Monero docs.
cat > /etc/systemd/system/monerod.service <<'EOF'
[Unit]
Description=Monero Daemon
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/monerod --config-file /etc/monero/monerod.conf --non-interactive
Restart=always
RestartSec=30
User=monero
Group=monero
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable monerod
systemctl restart monerod

# 6. Firewall: SSH plus the P2P port. Nothing else.
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 18080/tcp
ufw enable

# 7. Watch the first sync. It is bound by validation and disk speed, not by
#    the network link; a spinning disk costs 4 to 8 days (ditatompel).
journalctl -u monerod -f
/usr/local/bin/monerod status

# A. PRIVATE (recommended). RPC never leaves the box.
#    From your own machine, tunnel 18081 and point a wallet at it:
ssh -N -L 18081:127.0.0.1:18081 root@YOUR_SERVER_IP
monero-wallet-cli --daemon-address 127.0.0.1:18081 --trusted-daemon
#    --trusted-daemon is automatic for localhost and enables commands that
#    rely on the daemon being yours. Reference:
#    https://docs.getmonero.org/interacting/monero-wallet-cli-reference/

# B. PUBLIC. Serve the RESTRICTED RPC only. Never expose 18081.
#    Add to /etc/monero/monerod.conf, then restart monerod:
#      rpc-restricted-bind-ip=0.0.0.0
#      rpc-restricted-bind-port=18089
#      public-node=1     # optional: advertise the node to wallets
ufw allow 18089/tcp
#    Restricted RPC is view-only and "do not return privacy sensitive data":
#    https://docs.getmonero.org/interacting/monerod-reference/

# C. TOR. Broadcast your own transactions over a hidden service.
apt install -y tor
cat >> /etc/tor/torrc <<'EOF'
HiddenServiceDir /var/lib/tor/monero/
HiddenServicePort 18084 127.0.0.1:18084
EOF
systemctl restart tor
cat /var/lib/tor/monero/hostname     # this is YOUR_ONION

#    Then add to /etc/monero/monerod.conf and restart monerod:
#      tx-proxy=tor,127.0.0.1:9050,16
#      anonymous-inbound=YOUR_ONION:18084,127.0.0.1:18084,24
#    Config shape from the official example and from:
#    https://github.com/monero-project/monero/blob/master/docs/ANONYMITY_NETWORKS.md

Guides on this

Related use cases