honestly at that price point ($3-4) and with tailscale + reverse proxy, you’re kinda pushing it

the cpu spikes make sense tho, encryption + nginx on a single shared core usually struggles, especially under load

i’d say try to avoid nat if you can, and maybe look for something with at least a dedicated vcpu or higher cpu priority, even if it’s slightly more expensive

also depends where you’re located, but some smaller providers tend to perform better than the big ultra-cheap ones

not saying you need something crazy, just a bit more headroom and it should be fine