Minecraft on a VPS: full control and the bill that comes with it

On a managed plan, the 4GB in the contract exist for the game process. On a VPS, those same 4GB pay for the kernel, systemd, sshd, the MariaDB you installed and only then the JVM. Anyone who sets Xmx4G on a 4GB machine watches the server run fine for a few hours and vanish overnight.

Vanish is the right word: with no memory left, the kernel kills the largest process, with no crash report, just the log stopping mid line. Reserve from 1GB up to a quarter of the RAM before setting Xmx, because the JVM still spends memory outside the heap on metaspace and thread stacks.

Minecraft resolves world logic on a single thread, and that thread clock is what becomes TPS. On a 1 vCPU VPS that thread shares the processor with the garbage collector, with the Nginx serving your site and with the three in the morning cron job.

An empty server hides all of that. It shows up when thirty players generate chunks at once and the collector takes a pause: the tick blows through and the console warns that it cannot keep up. Past twenty players with plugins, the second vCPU weighs more than the extra gigabyte.

The panel has a watchdog: the process died, it brings it back. On a VPS that comes from a file in /etc/systemd/system/minecraft.service, with Restart=on-failure and RestartSec. Without it, a closed screen session means the server is offline until somebody wakes up.

And then a decision is missing. Restarting a server in a loop after a corrupted world only multiplies the damage: cap the attempts with StartLimitBurst and send the alert off the machine. External monitoring on port 25565 tells you more than any uptime promise.

A lobby and a survival behind a proxy require online-mode turned off on the backends. That is only safe if they listen on 127.0.0.1 or are blocked in the firewall: an open backend port with no session check is an invitation to log in with the administrator nickname.

Modern forwarding with a shared secret solves the player identity, not the firewall rule. Before you announce the IP, check with ss which address each java process listens on, and keep the database on the local socket.