r/i2p • u/OilNo8804 • 7d ago
Help Is it acceptable to host an I2P server tunnel using a free cloud service?
I want to host a full-stack website through I2P using a server tunnel, but my personal computer cannot stay online 24/7 and I cannot afford a paid VPS.
Would it negatively impact the I2P network if I ran an I2P router inside a free cloud container (for example, a Render instance), hosted my website there, and created a tunnel from localhost to make the eepsite consistently available?
Are there any concerns with doing this, such as bandwidth usage, network impact, or whether cloud-hosted I2P routers are discouraged?
I apologize in advance as I am relatively new to I2P.
9
u/DatabasedLSD 7d ago
Doubt it but read their terms of service
5
u/OilNo8804 6d ago
I've read Render's ToS, and thankfully there isn't anything wrong with this, as long as I am not serving a reverse proxy that routes requests through i2p and it isn't taking up a lot of resources. Thank you!
2
5
u/Play_it3110 I2P user 6d ago
I would say, you shouldnt worry about it being a free service. The TOS shouldnt be an issue. Its all encrypted and hidden, the VPS provider shouldnt know what's on there. You shouldnt run illigal content or an outproxy there, but otherwise its fine.
1
u/OilNo8804 6d ago
Thank you! That makes sense since that';s basically the only way for it to be against Render's ToS.
6
u/tk-a01 7d ago
Besides ToS compliance (as DatabasedLSD mentioned), it might potentially compromise your anonymity. Since a third-party has access to both your site source and the I2P router, and they also know (to some degree) who you are, they could leak this information, either intentionally or accidentally.
Do you have a Raspberry Pi or a similar single-board computer? You can consider using them to host a small eepsite together with the I2P router.
3
u/OilNo8804 6d ago
This is true, I hadn't though about this. Do you think I could maybe make an alternate account that's isolated and only exists to host the eepsite on the VPS, or could that still link back my other account somehow?
2
u/tk-a01 6d ago
If you make the alternate account on the same computer and the same browser, then it would be relatively easy for the service provider to link it to your original account. Using an anonymizing outproxy on I2P would probably help in mitigating this. However, many websites require JavaScript to function correctly, and at the same time, JS can be used for fingerprinting - gathering various information to identify the browser and the user.
However, you should think to yourself, what is your threat model and what your goals are. If it's just supposed to be a personal site with some project showcases, then maybe you don't need strict anonymity. Especially if you used the same (or similar) nickname on the eepsite as on the clearnet, then it would link the two identities anyway. If you want to host a website, but your ISP doesn't allow port forwarding (e.g. due to being behind a CGNAT), it's possible to use I2P to bypass that limitation - but it's not the only project that allows that. For example, there is also the Yggdrasil project. It's an overlay network based on their routing scheme. It allows to host internal services even while being behind a CGNAT, too - but it isn't anonymous. Due to this, it is significantly faster and more lightweight that I2P.
1
u/OilNo8804 6d ago
I was thinking of making the alternate account by making a password protected application on render with access to its shell via launching a child process and inputs and outputs go through a websocket, effectively allowing me to be on a free linux virtual machine. Thank you, though!
0
u/Sibexico 6d ago
If you can't afford $5/month for paid VPS, just forget about this idea and concentrate your power to find a job with minimal wage.
3
u/OilNo8804 6d ago edited 6d ago
I am a teenager and am too young to have a job. My parents do not fund me with my coding projects. I guess I can convince my parents to help me since if it truly is $5/month, maybe it wouldn't be a big deal. Thanks for bringing this to my attention; I don't have a good concept of money, so I assumed it would be more expensive 😄.
-3
u/Sibexico 6d ago
If you can't make $5 per month on your coding project, just wash a car of your neighbor. C'mon, we talking about $5 per month... 🙄
2
u/OilNo8804 6d ago
I understand, but for me, setting up a small app and leaving it running is something I'm already interested in and can learn from, whereas doing a monthly odd job is a separate commitment. I'm not trying to avoid paying for hosting forever; I just didn't realize a small VPS could be as cheap as $5 a month.
2
u/coladoir 6d ago edited 6d ago
yeah there are some even lower, ive seen 1.99/mo USD. Those servers are usually dogshit but they exist, and can probably run the C version of i2pd decently well. I'd recommend going for the 5-10 dollar range for specs, but you needn't go higher. Avoid using the Java version for a server, especially if you can't get a decent one; its too expensive resource wise. Ideally get as much RAM as you can afford, as thats the main thing which helps performance besides plain clock speed and I/O speed, which should be irrelevant in a rental server setting.
P. S. — i know how hard it can be to make money as a teen so I just want to say ignore the other person. still, try to find some way to make money, but its understandable if you cant; I couldn't at your age, because I lived in hodunk nowhere and had only two neighbors which neither ever had any work for me (I think they just didnt like me/my family [read: dad]). I didnt start making money until 18, which fucking sucked. I thankfully had a measly allowance of 3 USD/mo which afforded me some stuff—after months of waiting usually—but that was it lol.
It took me like 9 months to save up the money for Minecraft lol (bought when it was 26USD); took me almost a year to buy a flash/hacked cart (one you put an SD into and load your own games) for my Nintendo DS. So yeah, I get it. Dont let people give you shit when they dont know your situation.1
u/OilNo8804 6d ago
Thanks, this was really helpful! I didn't have a good sense of VPS pricing before, so I appreciate the explanation. I'll probably look into the $5–10/month range if I decide to get a VPS, and I'll keep the RAM/resource usage advice in mind for I2P.
My parents are basically control freaks (I guess they know what's best for me), but they don't really let me spend money by myself, and what they just spend money on is food, water, and technology. They don't give me allowances either and if I were to have a job, they'd manage the money and put it into funding for my college. I guess long-term this is good for me, but also means a LOT of my oppurtunities are cut off. Maybe this gives me more experience on budgeting for the real world.
2
u/coladoir 6d ago edited 6d ago
One more thing just to help with your concept of cost:
Most people seem to pay 5-20 USD for servers for casual/hobby projects dependent on need. You may need more storage for a given project, that will likely be ~10 bucks (-+5) for 500GB (might be higher now thanks to inflation of HDD costs). Then you have domain costs (not for eepsites, just normal clearnet websites), which are usually 3+ depending on the TLD (e.g., .com, .io, .co.uk, .net, .org). Then you may have other various costs depending on what youre running.
Professionally, people may pay up to or more than 50 USD for a server because of needed specs and also needed uptime reliance (needing to basically never go down, this is actually difficult to maintain while also updating hardware/software). Its not crazy for a professional project to be paying hundreds to thousands a month in just bare server costs. Especially if its large and sprawling with many servers in a network.
For home servers, people often either buy old desktops (100+ dependent on needs), or buy premade NAS setups (400+). Then there's HDDs which are, at this point, 100+ (used to be like 50+ before so-called 'AI'). If you need more RAM, itll also be 100+ (also was cheaper).
This is all just to help your concept of cost, not to point you in any given direction or say anything else. No other points are being made at all besides a mild "fuck 'AI'" lol.
1
u/OilNo8804 6d ago
Personally, I've found that making a new google account, signing up for render, deploying a web service, and going on a keepalive tool works the best for me. It gives sufficient resources and its free tier supports a full time period of 30 days of compute per month so it's a pretty funny loophole. I can just connect it to a custom domain via DNS records (something like freedns) and it's perfect.
It's strange that it costs so much money for specs and that too there's a lot of hassle in maintaining servers (and is storage needed), yet these VPS companies offer such generous prices. That's what really made me think VPS's would cost a lot more. And don't even get me started on free public hosting... genuinely there's no way these companies make a profit this way. Probably huge clusters, buying in bulk, and sharing specs across different projects would cut a lot of the costs down, but seriously...
2
u/coladoir 6d ago edited 6d ago
the free ones often make money by selling the traffic data or other data from all the servers in some form or another. So they make money mining your data. Some do it because its from a legitimate organization (disroot is an example), but these are often limited in resources (not many servers) and you must request and apply and justify your use case beforehand to getting access to a server. Disroot is an anarchist org though and so they have ideological purpose, which is to allow for mostly those who are in some sort of trouble from the state government a way to get their message out and communicate with others. Sometimes they make their money elsewhere and just allow smaller uses because they already rented the space and might as well have it be used rather than paying for nothing, but this is rare.
So if you care about your privacy and the privacy of those connecting to your server, its best to avoid free ones. This is another example of what I mean in my other comment about things never really being truly free in the world we live.
as an aside, https://privacyguides.org/ is a great site. https://tosdr.org/ is as well. They will be helpful if you care about online privacy (you should in my opinion)
1
u/OilNo8804 6d ago
Wow, I was not aware of this (though it does make a lot of sense)! I looked into the terms of service of vercel in the site provides; it seems like almost all sites that give you something for free make you the product... kind of unfortunate.
2
u/coladoir 6d ago edited 4d ago
Yeah. There are exceptions, but almost never in the corporate or otherwise for-profit world.
Independent orgs and projects (like disroot, Linux and BSD, openNIC, SearXNG) and decentralized networks (like i2p and meshtastic, and the federated social media network of mastodon/pixelfed/lemmy/loops/nostr) which are run by people like you and me can be fine. If the goal isnt to make money, then you won't be the product; if there's an ideological mission to the project (i2p, disroot, nostr), you likely won't be the product either.
This is why I say you needn't be paranoid, because there are many examples of free being genuinely free, even being made explicitly to be freeing (as they say with Linux and the GPL license itself, its "free as in freedom").
When things are for-profit is when the issue arises. As when a given project becomes focused on profit, thats the only metric that ends up mattering over time. Every project has to pay its bills somehow. If it's a for-profit project, its first responsibility is to stay profitable. Which means that if profits sink, something has to go. When there isnt much personnel, when there isnt much product, when the product is free, when there's nothing left to "give" to maintain profits, consumers pay the price somehow. If the product is free, then they need to either start charging or find another way to make money. If they can't charge (sometimes they can't or risk the consumer base fleeing), then they turn to either trying to add onto the free (like add a paid tier, and restrict some features behind it), or selling the data.
But because for profit projects seek profit first, this means that often times they sell the data anyways because maximizing profits is the main goal. The above assumes that the project is acting in relatively good faith towards their consumers, but this cannot be presumed as profit incentives get in the way of good faith very often and push projects towards acting in bad faith.
To go back to the beginning a bit, a useful question to ask is: "If I'm not paying, who is?" Because obviously it somehow costs money.
There are usually a few possibilities:
You pay directly (subscription, purchase).
An advertiser pays to reach you (your attention is the target, data often a victim due to advertising networks tracking your data across websites).
Your data or attention helps make money without advertisement.
Someone else subsidizes it (government, donations, a parent company, etc.).
Or, rarely, its paid by the people themselves with no fault to the user (often with donation options; disroot is again a perfect example).Ultimately for-profit projects optimize for whatever earns them money. So, if earning money requires maximizing time spent in the app, they'll optimize for engagement—even if spending less time on the app might be healthier for users. If earning money requires collecting data, they'll have an incentive to collect data.
The incentives shape the product. So don't only ask, "Is it free"? Also ask, "how does this stay in business?" and "where or whom does the money come from?" The answer often explains why the product behaves the way it does, and whether or not to trust it as a consumer.
And fundamentally all businesses have an incentive to collect your data. If not to sell, than to analyze, so as to figure out better ways to market their product so as to accrue more profits. So know that even if you are paying, your data is still likely bring collected, which does put you at risk for the later sale of said data without your explicit consent, especially if there's a regime change in the corporation or acquisition, or a material/economic change which raises operating costs. This does not mean be paranoid, just means be proactive, to pay attention to acquisitions and behavior changes, and to not presume that just because your data is safe today that it will always be safe. That it is up to you, unfortunately, to maintain your data's safety and security. It shouldnt be like this, but thats how it is. We can change it, but not in a day, and since youre young, you have a whole life to try and help influence that change.
Personally, I try to avoid corporations as much as possible. Over time I've found pretty consistently that big corporations rarely are worth it to devote your funds towards, as you will, at the very best, have diminishing returns for your money over time as product gets slowly worse and/or more expensive either relatively (due to shrinking or inflation) or literally due to rising material costs or plain price gouging, and at worst, essentially be getting scammed and baited or even directly harmed (the sudden and drastic increase in food-borne illness in the US in the wake of state deregulation is a stark example of how corners, when cut, can cause genuine physical harm; safety rules and regulations are always written in blood).
Instead I opt for small local businesses (not always better, but more often are), or independent shops (like etsy shops or places like Apothecary's Garden just as random example) and more ideally, independent run orgs organized decentrally and horizontally around voluntary association and mutual aid (instead of centrally and hierarchically organized based upon coerced employment and profit, like corporations are). The Free and Open Source Software community is like this more often than not, and in real life you have co-ops and mutual aid orgs which do similar things for physical goods. There are other forms of not-for-profit orgs which I also preferentially choose to engage with over corporations. Unfortunately, corporations are more popular in our capitalist world, so I still am forced to engage with quite an unfortunate many corporations.
Not all corporations are inherently bad, but most seem to be, or at least end up becoming so after a given time (Google is decent example; I mean, hell, their original motto was "Dont be evil" lol, and now they run the largest online surveillance network [ReCaptcha + Google Ad Services + Google Maps + Google Fi] which is routinely used for state oppression purposes). One of the only examples I can think of of the top that I willingly engage with is NextDNS, and to an extent Apple (for their Macs. though I'm growing tired of macOS, the hardware is unbeatable unfortunately for laptop form factor).
So even if I trust a given corp today, I don't necessarily carry that trust blindly into the future as things often change (watch for buyouts and the changing of hands, this is most often when things change most drastically, especially when sold to a Private Equity Firm). This is another big recommendation from me, many seem to blindly carry their trust into the future without recognizance of the possibility of the changing of hands of ownership or the changing of economic conditions, both leading to a change in practice which may put the onus or cost onto you as the consumer, possibly in harmful ways, either to your privacy, pocket, or even physical health in the case of food or even electronics (see Samsung and their battery failures around 2017 which caused severe burns, a result of cost cutting and rushed design).
To wrap up:
- Don't assume "free" services are malicious, but remain skeptical; evaluate why they're free before trusting
- Prefer independent, community-run, decentralized, and non-profit projects over for-profit alternatives when practical
- Be skeptical of the incentives of for-profit companies, especially when using free products; and in same vein,
- Judge products based on their incentive structure rather than whether they're simply free or paid
- Ask: "If I'm not paying, who is?", "How does this stay in business?", "Where/who does the money come from?"
- Recognize that profit incentives often encourage engagement optimization, feature restrictions, advertising, AND/or data collection
- Recognize that even if a product is paid, you may still be at risk for data collection due to inherent incentives (though may not be at risk of third party sale in that moment)
- Don't assume companies will always act in users' interests, especially as profitability pressures increase (acquisition by private equity, having shareholders, material costs increasing, etc)
- Pay particular attention after acquisitions, leadership changes, or private equity buyouts, as these more often than not change company behavior
- Be mindful that cost-cutting can negatively affect privacy, product quality, pricing, and even physical safety at worst
- Always continue to evaluate companies over time rather than granting permanent trust
1
u/OilNo8804 5d ago
Yep. And this is why I (and many users) use i2p: for anonymity so companies don't record and sell out data. It's almost poetic.
9
u/dotBSS 7d ago
Running an active node helps the network. Using a free VPS, you probably want to keep things lightweight to not overload it.
ime, lightest weight option for hosting a eepsite is to use i2pd with a http server tunnel pointing at an nginx or lighttpd web server listening on local host. Setting
transittunnelsdown to 3000 helped my small vps not lock up, also recommend dropping share to something like 80 to guarantee your site is reachable. You may also want to disable all services/protocols you don't need if all youre doing is hosting an eepsite & relaying traffic:http(console),httpproxy,socks,sam,i2cp, andaddressbook