Self-hosted VPN

A Self-Hosted VPN, Set Up by One Command

Q: Is this fully self-hosted?

No. The VPN server is yours: your VPS, your IP address and your root access. ProofKit's coordinator issues user keys and import links, meters traffic, handles payouts and runs checks, and the agent updates itself from ProofKit's image.

Q: What does it cost?

Your VPS, plus 1 TON per node locked as a stake and returned when you delete the node. If the node's price is 0, nobody pays per GB, olcRTC included. If it has a price, everyone who uses it pays that price plus the 20% network fee, you included. olcRTC traffic is the exception: from 20 November 2026 it has one network-wide price per GB, read when the traffic moves.

Q: Can I keep it just for myself and friends?

Yes. Make the node private: it is hidden from the marketplace and only people you invite with a code or a link can connect. You can revoke any of them at any time.

Q: Which transports does it serve?

VLESS Reality on TCP 443, always. Hysteria2, XHTTP and, on exit nodes, olcRTC, which carries traffic inside a video call, are switches in the node's settings.

Q: Does the server keep logs?

By default the agent writes no access log: Xray logs warnings only and nginx has its access log off. It is your server, so you could change that; the agent reports such changes and the node loses its config-verified badge.

Install the ProofKit agent on a server you rent and control. It sets up censorship-resistant transports, and everyone who connects uses their own credentials. Keep the node private for people you invite, or list it on the marketplace and earn TON.

Start self-hosting Setup guide

Server

your VPS

Transports

up to 4

Private mode

optional

Stake / node

1 TON

Who runs what

On your server: the agent's container with Xray (exit node) or nginx (entry node) and WireGuard, on your IP address, at the provider and in the country you chose, with your root access.

On ProofKit's coordinator: accounts, user keys and import links, metering and billing, payouts, network checks, and the agent image your server updates from.

Where the line is, in detail

By hand or with the agent

	VPN server set up by hand	ProofKit agent on your VPS
Setup	You install and configure the VPN software	One command installs and configures it
Transports	Whatever you configure	VLESS Reality always; Hysteria2, XHTTP and olcRTC are switches
People	You create and send each config	Invite codes or links; each person signs in and gets their own link, which you can revoke
Updates	You update	The agent checks for a new version every 6 hours
Depends on	Only your server	A ProofKit account and ProofKit's coordinator
Costs	Your VPS	Your VPS, 1 TON stake per node (refundable), per-GB charges unless the price is 0

Keep it private

Switch Private node on and the node is hidden from the marketplace. Invite people with a one-time code, a reusable link, a link limited to a number of uses, or a link that expires, and revoke anyone later. Each person signs in to ProofKit with email or Telegram and sees your node in their own list.

Set the node's price to 0 in its settings and your invitees use it for free: a free node needs no balance. To use the node yourself, sign in with a separate user account and invite it like anyone else, because operator accounts manage nodes and do not connect. More on the private node page.

Or list it and earn TON

Leave the node public and anyone can pick it in the marketplace. You set the price per GB; users pay it plus a 20% network fee, and on a direct session you receive 80% of what the user is charged (olcRTC traffic from 20 November 2026 earns 80% of the olcRTC price instead). Earnings are claimed on-chain to your TON wallet. The operator guide covers prices, payouts and the stake.

What the server logs

The agent configures Xray with log level warning and no access log, and nginx on entry nodes with its access log off and errors only at the crit level. The agent's own log goes to the system journal. It also sends the coordinator a signed report that those settings are unchanged; if someone turns logging on, the node loses its config-verified badge in the marketplace.

That report is a deterrent, not a guarantee: whoever has root on a server can change its software.

What you need

An x86-64 Linux VPS with a public IPv4 address and root access. ARM servers are not supported today.
Kernel 5.6 or newer. The Docker mode runs on any distribution and installs Docker if needed; the systemd mode is for AlmaLinux and CentOS Stream 10+.
A free TCP port 443, and the node's ports open in your hosting panel's firewall.
A TON wallet with TonConnect, and 1 TON per node deposited as stake. The stake applies to private nodes too and comes back when you delete the node.
At least 1 vCPU and 1 GB of RAM; 2 vCPU and 2 GB are recommended.

The dashboard prints the install command with your node's token; run it as root:

your VPS · install (Docker)

$ bash <(curl -sSL https://proofkit.org/install.sh) --mode=docker --type=origin --token=YOUR_TOKEN

# files and settings end up in /opt/proofkit-dvpn

The ports to open and every install step are in the operator guide.

Trade-offs to know

It is not fully self-hosted. Without a ProofKit account and its coordinator there are no user keys, import links or billing.
The agent updates itself from ProofKit's image, and the platform can trigger an update.
Your server's IP is where your users' traffic leaves when it is an exit node. Complaints about that traffic reach you.
One server runs one node type: an exit or an entry.

// faq

Self-hosting questions

Is this fully self-hosted?

No. The VPN server is yours: your VPS, your IP address and your root access. ProofKit's coordinator issues user keys and import links, meters traffic, handles payouts and runs checks, and the agent updates itself from ProofKit's image.

What does it cost?

Your VPS, plus 1 TON per node locked as a stake and returned when you delete the node. If the node's price is 0, nobody pays per GB, olcRTC included. If it has a price, everyone who uses it pays that price plus the 20% network fee, you included. olcRTC traffic is the exception: from 20 November 2026 it has one network-wide price per GB, read when the traffic moves.

Can I keep it just for myself and friends?

Yes. Make the node private: it is hidden from the marketplace and only people you invite with a code or a link can connect. You can revoke any of them at any time.

Which transports does it serve?

VLESS Reality on TCP 443, always. Hysteria2, XHTTP and, on exit nodes, olcRTC, which carries traffic inside a video call, are switches in the node's settings.

Does the server keep logs?

By default the agent writes no access log: Xray logs warnings only and nginx has its access log off. It is your server, so you could change that; the agent reports such changes and the node loses its config-verified badge.

// next step

Set up your server

Create an operator account, deposit 1 TON, register the node as private or public, then run the command the dashboard prints on your VPS.

Start self-hosting Private nodes

// related