Create a separate server and subdomain
GlobaLeaks should be installed on a separate, isolated VPS rather than on the same server as your main website. This is important because it handles confidential whistleblowing reports and requires root access to manage system services, firewall rules, Tor, HTTPS, and ports 80 and 443.
Using a dedicated VPS also prevents conflicts with cPanel, Apache, Nginx, WordPress, email services, and other websites. It reduces the risk that a security issue affecting the main website could compromise the reporting platform.
The recommended VPS configuration is:
Debian 13
2 virtual CPU cores
2 GB RAM
20–40 GB SSD storage
Dedicated public IPv4 address
Root SSH access
Automated encrypted backups
Do not install cPanel, WordPress, email hosting, or unrelated applications on this server. It should be used exclusively for GlobaLeaks.
Next, create a dedicated subdomain, for example:
reporting.mysite.com
Add or update the subdomain’s DNS A record so that it points to the public IP address of the new VPS.