Host an Umbrel-style node in the cloud: umbrelOS on a VPS, Tor-only access, and the honest storage math

What people actually want from "Umbrel in the cloud"

umbrelOS and Start9’s StartOS are app-store operating systems for home servers: a dashboard, one-click installs of Bitcoin Core, Lightning, Nextcloud, Vaultwarden, Jellyfin and a few hundred other things, with Tor access built in. People ask about running them on a VPS for three reasons: they do not want hardware at home, they want a static IP and real upstream bandwidth, or they want a node that is not physically tied to their address. All three are legitimate. The catch is that both projects are built on the assumption that they own the whole machine, and a VPS is not quite that.

Two facts shape this guide, both checked in October 2026. First, umbrelOS 1.x is a standalone operating system; the old "curl umbrel.sh on Ubuntu" installer was retired with 1.0 and the supported routes are Umbrel hardware, a Raspberry Pi image, or booting the installer ISO on a PC or VM. Our servers are provisioned from stock Linux images (Ubuntu 24.04 by default), and the umbrelOS installer image is not one of the choices, so the officially documented VM method is out. What works on a stock Ubuntu VPS is the community container image dockurr/umbrel, which runs umbreld inside a privileged container using the host’s Docker daemon; Umbrel staff point people at it on their forum when a provider cannot boot a custom ISO, but it is not an Umbrel-supported configuration.

Second, StartOS 0.4 is likewise a full distribution shipped as installer images. Start9’s FAQ says a VPS works when the provider lets you boot their ISO, which again is not what you get here. What Start9 does ship for a VPS is StartTunnel, a WireGuard reverse tunnel for Debian 13 that gives a StartOS box at home a public IPv4 front door. That is a genuinely good use of a $10 server and is covered at the end. The rest of this guide is Umbrel.

Sizing, and the storage math nobody likes

umbrelOS itself wants 4 GB of RAM minimum (8 GB recommended) and 32 GB of disk before any app. The Bitcoin Node app with a full, unpruned chain needs about 1 TB in 2026 and grows roughly 60 GB a year. The largest NVMe disk on our plans is 960 GB, on a 48 vCPU dedicated plan that costs $1550 a month; the next is 600 GB at $950. Neither is a sensible way to store a blockchain. So the honest statement is: a full archival Bitcoin node on umbrelOS here is not practical. What is practical is a pruned node, or an app-only Umbrel that runs everything except the chain.

Pruning in the Umbrel Bitcoin Node app is a setting (Settings, Optimization, Prune Old Blocks, in GB). It still downloads and validates the entire chain, so budget about 750 GB of inbound traffic once (inbound is free here) and a day or two of sync. Pruning disables txindex, which means Electrs and other apps that need arbitrary transaction lookups will not work; wallets that connect to your node directly over its RPC or P2P interface are fine. If you later turn pruning off, the whole chain is downloaded again.

Prepare the server

Everything below assumes a fresh Ubuntu 24.04 image and a root shell (prefix sudo if you created a user). Patch first, then lock down SSH and the firewall before anything else is listening.

apt update && apt full-upgrade -y
apt install -y ufw unattended-upgrades curl gnupg

# SSH: keys only. Put your public key in /root/.ssh/authorized_keys first and
# confirm you can log in with it before disabling passwords.
cat > /etc/ssh/sshd_config.d/00-keys-only.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
EOF
sshd -t && systemctl restart ssh

# Firewall: deny everything inbound except SSH for now.
ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw --force enable

Install Docker and start umbrelOS in a container

Install Docker from Docker’s repository. Then, because Umbrel apps are started by the host Docker daemon and publish their own ports, set the daemon’s default publish address to 127.0.0.1 before anything is installed. Without this, every app port would be reachable from the internet and would bypass ufw. With it, the only way in is SSH, a tunnel, or Tor.

# Docker Engine + Compose plugin from Docker's own repository (not the Ubuntu snap).
apt install -y ca-certificates curl
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
  > /etc/apt/sources.list.d/docker.list
apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
docker version && docker compose version

cat > /etc/docker/daemon.json <<'EOF'
{
  "ip": "127.0.0.1",
  "log-driver": "journald"
}
EOF
systemctl restart docker

mkdir -p /opt/umbrel && cd /opt/umbrel
cat > compose.yaml <<'EOF'
services:
  umbrel:
    image: dockurr/umbrel
    container_name: umbrel
    pid: host
    privileged: true
    ports:
      - "127.0.0.1:80:80"
      - "127.0.0.1:443:443"
      - "127.0.0.1:2000:2000"
    volumes:
      - ./umbrel:/data
      - /var/run/docker.sock:/var/run/docker.sock
    restart: always
    stop_grace_period: 1m
EOF
docker compose up -d
docker compose logs -f    # first start takes a few minutes; Ctrl-C when it settles

privileged: true and pid: host are what the image requires; it is managing containers and networks on your behalf, so it is effectively root on the box. That is acceptable on a single-purpose server and is the reason not to run anything else on it. The /opt/umbrel/umbrel directory is the whole state of your Umbrel: apps, settings, Bitcoin data. Keep it on the main NVMe disk and do not move it later without stopping the container.

Open the dashboard through an SSH tunnel from your own machine, create the Umbrel account, and set a strong password: this is the password for the Linux user inside umbrelOS as well.

# On your laptop. Then browse to http://localhost:8800
ssh -L 8800:127.0.0.1:80 [email protected]

Tor-only access and keeping the clearnet door shut

umbrelOS has Tor built in. In the dashboard go to Settings, Advanced settings, Remote Tor access, and enable it; it shows a .onion address for the dashboard, and each installed app gets its own onion address visible in the app’s settings. Open those in Tor Browser (or any Tor-routed browser) from anywhere. Because every port on the host is bound to localhost and ufw only allows SSH, the Tor hidden services are the only public entry point, and they reveal neither the server’s IP to visitors nor the visitor’s IP to the server.

• Day-to-day administration: Tor for the dashboard and apps, SSH (keys only, as set up in the prep section) for the host. Consider moving SSH itself behind an onion service too; the Tor guide on this site shows how.
• Faster alternative without exposing ports: install the Tailscale app from the Umbrel store, or run WireGuard on the host, and reach the dashboard over the VPN. Tor stays as the fallback.
• Do not reach for a reverse proxy with a public domain to make Umbrel apps clearnet-reachable unless you have a reason; the moment you do, the IP of your node and the apps on it are linked to that domain.
• Umbrel’s Bitcoin Node app can be set to Tor-only peers in its settings. On a VPS that is the right default: your node’s IP is a datacenter address with your hosting bill behind it, and there is no reason to advertise it to the P2P network.

Tradeoffs versus hardware at home

The cloud version wins on uptime, bandwidth and not having a device at your address. The home version wins on storage, cost over time and the strongest form of sovereignty: the disk is in your hands. A common compromise is both: the archival node and Lightning at home, and a cheap VPS running the apps you want reachable from anywhere (and, if you use StartOS, the StartTunnel front door).

Start9: StartOS and StartTunnel

As checked in October 2026, StartOS is installed from Start9’s own installer images onto a whole machine; there is no package that layers it on an existing Ubuntu or Debian install, and running it on a VPS needs a provider that boots custom ISOs. If you want StartOS, buy or build the hardware. Where a VPS fits into a Start9 setup is StartTunnel: a small self-hosted WireGuard reverse tunnel that runs on a Debian 13 VPS with a dedicated public IPv4 address and lets your home StartOS server publish services on the clearnet without revealing your home IP or opening router ports.

• Order the server with Debian 13 instead of Ubuntu (both are offered). The smallest plan is enough; StartTunnel has minimal resource needs.
• Every plan here includes a dedicated public IPv4 and IPv6 address, which StartTunnel requires for published ports.
• StartTunnel must be the only thing on the box: its installer disables ufw and manages iptables itself. Follow the installing page at docs.start9.com; it is a one-line installer run as root followed by web-based setup, and it reports as the start-tunneld systemd service.
• There is no coordination server or phone-home; if Start9 disappears, the tunnel keeps working.

Operations: updates, backups, monitoring, firewall

• umbrelOS updates: the dashboard offers OS updates and app updates. With the container image, the OS layer is the image: docker compose pull && docker compose up -d in /opt/umbrel updates umbreld itself. Take a backup first.
• Host updates: unattended-upgrades handles Ubuntu and Docker security updates. Reboot occasionally for kernels; Umbrel restarts with Docker.
• Backups: the state is /opt/umbrel/umbrel. Stop the container (docker compose stop), snapshot the directory with restic to somewhere off-box, start it again. Exclude the Bitcoin chain data (app-data/bitcoin) if you want a small backup; it is replaceable by resync, your Lightning channel state and app data are not. Lightning channel backups (static channel backups) should additionally be exported from the app.
• Monitoring: docker ps shows the app containers; docker stats shows which app is eating RAM; df -h /opt/umbrel tells you when the prune target or your Nextcloud is outgrowing the plan.
• Firewall: ufw status should list OpenSSH only. docker ps should show every published port as 127.0.0.1:PORT, never 0.0.0.0:PORT. If an app shows 0.0.0.0, the daemon.json setting was applied after it was created; reinstall that app.
• Renewal: the server is deleted at the end of the prepaid period. Extend before the reminder email expires; a deleted node with Lightning channels open is an expensive lesson.

Which plan to pick

For an app-only Umbrel (password manager, Nextcloud, bridges, Tor-reachable dashboards) choose BVCX33 (4 vCPU, 8 GB, 80 GB, from $16/mo) or BVA21 on Arm. For a pruned Bitcoin node plus apps, start at BVX31 or BVA31 (160 GB, from $32 or $40/mo); for Lightning on top, BVX41 or BVA41. Leave the full archival node at home. Configure a server with Ubuntu 24.04 (or Debian 13 for a StartTunnel box), pay in Bitcoin or Monero, and lock it to Tor and SSH before you install the first app.