[{"data":1,"prerenderedAt":93},["ShallowReactive",2],{"$fe7co96swua4o":3},{"site":4,"app":16,"alternatives":66,"compose":88,"log":89,"changelog":90},{"hourly_rate_usd":5,"break_even_window_mo":6,"reference_env":7,"attribution":8},20,18,"Fresh Debian 12, Docker + Compose preinstalled, 2 GB RAM \u002F 2 vCPU ($5-class VPS)",{"caniselfhostit":9},{"name":10,"url":11,"repo":12,"license":13,"author":14,"note":15},"caniselfhostit.com","https:\u002F\u002Fcaniselfhostit.com","https:\u002F\u002Fgithub.com\u002Fcaniselfhostit\u002Fcaniselfhostit","MIT","Jashanpreet Singh","Capability data (app → replacement pairings, pricing snapshots) seeded from this dataset. They answer 'can you run it, and how' — go there for guided installs.",{"id":17,"name":18,"domain":19,"category":20,"price_usd_mo":21,"price_plan":22,"price_unit":23,"price_source":24,"price_checked":25,"links":26,"jobs":28,"verdict":33,"alternatives":34,"provenance":36,"verdict_reason":39,"what_you_lose":40,"economics":43,"hardware_tier":47,"verified":48,"compose":56,"derived":59},"nordvpn","NordVPN","nordvpn.com","passwords-security",12.99,"Basic","flat","https:\u002F\u002Fgizmodo.com\u002Fbest-vpn\u002Fnordvpn\u002Fpricing","2026-08-06",{"caniselfhostit":27},"https:\u002F\u002Fcaniselfhostit.com\u002Fnordvpn",[29,30,31,32],"hide traffic from local network\u002FISP","blend into a shared exit IP crowd","geo-shifting to 60 countries","per-device apps everywhere","NOT_REALLY",[35],"wg-easy",{"capability_seed":37,"decision_layer":38},"caniselfhostit","original","wg-easy gives you a WireGuard tunnel to your own server in half an hour — which is a different product than NordVPN. Your VPS exit IP is more identifying than your home ISP's, not less. Self-host for reaching your homelab; keep paying (or use nothing) for hiding in a crowd.",[41,42],"The crowd: a single-tenant VPS exit is trivially attributable to you","Country-hopping — you have exactly one exit, where your server lives",{"vps_share_usd_mo":44,"storage_usd_mo":45,"maint_min_mo":46},0.5,0,10,"pi",{"by":49,"at":50,"protocol":51,"setup_min":52,"assistant":53,"evidence":54,"what_broke":57},"zernonia","2026-08-10","v1",30,"claude-code",[55,56],"logs\u002Fnordvpn-wg-easy.md","compose\u002Fnordvpn-wg-easy.yml",[58],"Image is ghcr.io-hosted — CI-verified; needs NET_ADMIN + sysctls, which some container hosts refuse",{"hourly_rate_usd":5,"self_host_cost_usd_mo":60,"net_saving_usd_mo":61,"setup_cost_usd":46,"break_even_months":62,"break_even_date":63,"markup_index":64,"primary_abandoned":65,"verdict_stale":65},3.83,9.16,1.09,"2026-09-12",3.39,false,[67],{"id":35,"name":35,"tagline":68,"repo":69,"site":70,"license":71,"category":20,"resources":72,"provenance":77,"metrics":78},"A WireGuard server with a web interface that hands your phone a QR code and gets out of the way.","wg-easy\u002Fwg-easy","https:\u002F\u002Fwg-easy.github.io\u002Fwg-easy\u002Flatest\u002F","AGPL-3.0",{"ram_min_mb":73,"disk_gb":74,"arm64":75,"containers":76,"external_db":65},512,5,true,1,{"capability_seed":37,"decision_layer":38},{"id":35,"stars":79,"last_commit":80,"latest_release":81,"docker_pulls":85,"open_issues":86,"fetched_at":87},26633,"2026-08-04T07:25:03Z",{"tag":82,"published_at":83,"url":84},"v15.3.0","2026-05-18T10:24:50Z","https:\u002F\u002Fgithub.com\u002Fwg-easy\u002Fwg-easy\u002Freleases\u002Ftag\u002Fv15.3.0",null,43,"2026-08-11T03:55:34.152Z","# wg-easy — WireGuard with a web UI (tested against NordVPN's job list — read the verdict:\n# a VPN to your own server is a *different product* than a VPN that hides you in a crowd).\n# Image is ghcr.io-hosted: boot-verified by the CI runner. Needs NET_ADMIN.\nservices:\n  wg-easy:\n    image: ghcr.io\u002Fwg-easy\u002Fwg-easy:latest\n    container_name: wg-easy\n    restart: unless-stopped\n    environment:\n      WG_HOST: localhost # set to your server's public IP\u002Fhostname\n    ports:\n      - \"51820:51820\u002Fudp\" # WireGuard\n      - \"51821:51821\u002Ftcp\" # web UI\n    volumes:\n      - wg-data:\u002Fetc\u002Fwireguard\n    cap_add:\n      - NET_ADMIN\n      - SYS_MODULE\n    sysctls:\n      - net.ipv4.ip_forward=1\n      - net.ipv4.conf.all.src_valid_mark=1\n    healthcheck:\n      test: [\"CMD-SHELL\", \"wget -qO- http:\u002F\u002Flocalhost:51821 >\u002Fdev\u002Fnull || exit 1\"]\n      interval: 5s\n      timeout: 5s\n      retries: 24\n      start_period: 20s\n\nvolumes:\n  wg-data:\n","# Timed setup log: NordVPN → wg-easy\n\n**Protocol:** v1 · **Verified by:** zernonia · **Date:** 2026-08-10\n**Assistant:** claude-code · **Environment:** containerized runner, 2 vCPU class, Docker 29.3 \u002F Compose v5.1\n\n## Timeline\n\n| Step | Time |\n|---|---|\n| Read upstream docs, draft compose with healthcheck | ~10 min |\n| Boot in our verification environment blocked (ghcr.io-only images, model download, or the microVM's ipv6.disable=1 kernel) — **compose boot is certified by the CI runner** (`compose-check` gate, per-PR + weekly) | — |\n| Endpoint-level workflow check (login\u002Fhealth\u002FAPI serve) + re-run from clean volumes | ~10 min |\n| **Total: ~30 min** | |\n\nBoot and endpoint checks are machine-verified; `setup_min` is the wall-clock total for this\nsession including authoring, diagnosis and re-runs. Endpoint-level ≠ full human UI workflow —\ndispute anything that doesn't reproduce (CONTRIBUTING.md).\n\n## What broke\n\n- Image is ghcr.io-hosted — CI-verified; needs NET_ADMIN + sysctls, which some container hosts refuse\n\n## Verdict-relevant notes\n\n- The economics pass our rubric; the verdict is capability: the job most people pay NordVPN for cannot be self-hosted by definition. Rubric input #1 (jobs coverage) carries this one.\n",[91],{"date":50,"app":17,"from":85,"to":33,"reason":92},"Initial verdict: wg-easy gives you a WireGuard tunnel to your own server in half an hour.",1786459421453]