Run your own AI router on a $5/month VPS

Running kRouter locally is great for solo developers. But if your team shares a quota pool, a single $5/month VPS makes more sense — everyone's IDE hits the same endpoint, the same combos, the same dashboard.

Here is the full setup. Should take 20 minutes.

The VPS

Any of these work:

• Hetzner CX11 — €3.79/month, 1 vCPU, 2GB RAM, 20GB SSD
• DigitalOcean Basic — $4/month, 1 vCPU, 512MB RAM (tight)
• OVH VPS Starter — $3.50/month, 1 vCPU, 2GB RAM
• Vultr Cloud Compute — $5/month, 1 vCPU, 1GB RAM

We use Hetzner CX11 because it has the best price-to-RAM ratio. 2GB is overkill for kRouter but you may want to run other things alongside.

Step 1: Provision

# SSH in
ssh root@your-vps-ip
 
# Install Node 22
curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
apt-get install -y nodejs
 
# Create a non-root user
adduser krouter
usermod -aG sudo krouter
su - krouter
 
# Install kRouter
sudo npm install -g @sifxprime/krouter

Step 2: Run as a systemd service

Create /etc/systemd/system/krouter.service:

[Unit]
Description=kRouter AI router
After=network.target
 
[Service]
Type=simple
User=krouter
WorkingDirectory=/home/krouter
ExecStart=/usr/bin/krouter -t
Restart=on-failure
RestartSec=5
Environment=NODE_ENV=production
 
[Install]
WantedBy=multi-user.target

Then:

sudo systemctl enable krouter
sudo systemctl start krouter
sudo systemctl status krouter

kRouter is now running on port 20128, persisted across reboots.

Step 3: nginx in front

Install nginx and front kRouter with TLS:

sudo apt-get install -y nginx certbot python3-certbot-nginx

/etc/nginx/sites-available/krouter:

server {
    listen 443 ssl http2;
    server_name router.your-domain.com;
 
    ssl_certificate     /etc/letsencrypt/live/router.your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/router.your-domain.com/privkey.pem;
 
    # SSE / streaming-friendly defaults
    proxy_read_timeout 600s;
    proxy_buffering off;
    proxy_cache off;
    proxy_http_version 1.1;
    chunked_transfer_encoding on;
 
    location / {
        proxy_pass http://127.0.0.1:20128;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable, certbot, restart:

sudo ln -s /etc/nginx/sites-available/krouter /etc/nginx/sites-enabled/
sudo certbot --nginx -d router.your-domain.com
sudo systemctl reload nginx

You now have https://router.your-domain.com serving kRouter. SSE streaming works because of the proxy_buffering off line — that is the part most people miss.

Step 4: Lock it down

By default the dashboard would be exposed on the public internet. Do not leave it that way.

Two options:

Option A: Tailscale-only access (recommended)

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Then in kRouter's dashboard settings, disable public dashboard access and only allow Tailscale IPs. Your team installs Tailscale, joins the tailnet, and router.your-tailnet.ts.net resolves locally. No public exposure.

Option B: Basic auth + IP allowlist

If you cannot use Tailscale, lock down nginx:

location /dashboard {
    allow 1.2.3.4;       # office IP
    allow 5.6.7.8;       # home IP
    deny all;
 
    auth_basic "kRouter";
    auth_basic_user_file /etc/nginx/.htpasswd;
 
    proxy_pass http://127.0.0.1:20128/dashboard;
}

The /v1 API endpoint can stay open (it requires the OPENAI_API_KEY you set in kRouter), but the dashboard should never be public.

Step 5: Team IDE config

Each team member configures their IDE:

OPENAI_BASE_URL=https://router.your-domain.com/v1
OPENAI_API_KEY=sk-krouter-team-key

Everyone hits the same router. Quotas pool. Combos apply uniformly. The dashboard shows team-wide spend and savings.

What about updates?

sudo npm install -g @sifxprime/krouter@latest
sudo systemctl restart krouter

Or, for automated updates, a daily cron:

sudo crontab -e
# Daily at 4am UTC:
0 4 * * * /usr/bin/npm install -g @sifxprime/krouter@latest && /bin/systemctl restart krouter

Monthly cost breakdown

For a team of five sharing one router, that is $0.80/dev/month of infrastructure cost. The token savings dwarf that by orders of magnitude.

What about Docker?

kRouter publishes multi-platform images (linux/amd64 + linux/arm64) to both Docker Hub and GitHub Container Registry:

docker run -d \
  -p 127.0.0.1:20128:20128 \
  -v "$HOME/.krouter:/app/data" \
  -e DATA_DIR=/app/data \
  --name krouter \
  --restart unless-stopped \
  sifxprime/krouter:latest

Bind to 127.0.0.1 so it is not directly exposed. nginx and Tailscale handle access. The DATA_DIR env var tells kRouter where to persist its SQLite database, certs, and runtime configs inside the container.

Data layout under the volume:

$HOME/.krouter/
  db/
    data.sqlite       # main database (accounts, combos, settings)
    backups/          # automatic daily backups
  certs/              # MITM CA if enabled

Update to latest:

docker pull sifxprime/krouter:latest
docker rm -f krouter
# re-run the command above

Also available via ghcr.io/sifxprime/krouter:latest if you prefer GitHub Container Registry.

How the Zenith Score Engine helps team routing

On a team VPS, the Zenith Score Engine is particularly valuable. When five developers hit the same router simultaneously, Zenith ranks every provider account by live TTFB latency and remaining quota percentage. It heavily penalizes accounts under 30% quota and mathematically pre-selects the healthiest account for each request.

Before Zenith (the old "fill-first" strategy), the router would hammer one account until it hit a 429, then fall to the next. With five developers, this meant everyone hit the same 429 wall at the same time. Zenith distributes load across accounts proactively, so 429s become rare events rather than predictable bottlenecks.

The HealthCache RAM Layer makes this fast: all account health data lives in memory with sub-1ms reads. When a 429 does hit, the lock is written to RAM instantly and the SQLite persistence fires asynchronously in the background. No disk I/O in the hot path.

RTK savings multiply with team size

RTK Token Compression saves 20-40% on input tokens by compressing tool outputs, pasted code, and repetitive context before it reaches the billing meter. On a solo setup, that might save $5-10/month. On a team of five, the same compression saves $25-50/month -- more than the VPS costs.

The compression is transparent. Each developer's IDE sends normal requests; kRouter compresses on the wire. The dashboard shows per-developer and aggregate savings so you can prove the ROI.

Caveats

1. Provider rate limits scale per account, not per node. Running kRouter on a VPS does not magically multiply your Kiro free tier. Stack multiple accounts (covered in Multi-account routing) to scale across your team.
2. Streaming requires nginx tuning. The proxy_buffering off line is essential. Without it, SSE responses queue up server-side and arrive in chunks instead of streaming token-by-token.
3. OAuth tokens live in SQLite. Back up $HOME/.krouter/db/ regularly. Losing it means re-OAuth-ing every provider. kRouter creates daily backups in db/backups/, but you should also back up off-server.
4. MITM mode is per-machine, not per-VPS. If team members need MITM interception (for Claude Desktop or Antigravity), each developer runs a local kRouter instance that points at the team VPS as an upstream. The VPS handles routing and compression; the local instance handles MITM certificate trust.

Install local + remote

Many devs run kRouter both locally (for offline coding and MITM) and remotely (for team routing and shared quota pools). Same install command, different endpoint. Use a per-machine combo so each one routes differently based on context.

# On VPS (team endpoint):
npm install -g @sifxprime/krouter && krouter -t
 
# On laptop (local MITM + remote upstream):
npm install -g @sifxprime/krouter && krouter -t
# Dashboard -> Settings -> Upstream: https://router.your-domain.com/v1

Full deploy docs at /docs/deploy. Docker reference at /docs/docker.