Very smart to pause and weigh things. There was a lot more to it than I thought when I started mine.
- Renting a server is not cheap, but it's not expensive either. Most VPS' will be able to host it fine. You will need to invest effort into swapping data over to S3, volume storage is what really costs money if you use it incorrectly.
- I'll say do you want to have an individual/known user instance (like family and friends you deeply trust), or do you want to allow randos? The thing you don't mention at all is liability. I don't know where you're hosted but in most countries you are responsible for reporting material on your server. CSAM? Guess what, you are responsible. You can look at my server, it's based out of the USA and any server is automatically a "mandatory reporter". I am legally obligated to report CSAM that makes it to my instance, if I don't I am legally complicit.
- Note that this has been drastically reduced with the image proxying, where if someone on say, .world posts CSAM it's proxied through my server but not hosted by my server. So, liability is still a thing, but as long as the admins of .world take action then i'm protected with them. If proxying is disabled then the CSAM would live on my server too - and that means I'm legally required to report it.
- NEVER allow open signups. Spam is real here on the fediverse, and bots are actively trying to sign up for accounts. If you allow signups you need to require a captcha, and I recommend either email verification or asking for a signup message "Why do you want to sign up?". This gets rid of 99.9% of spammers.
- This is also a huge reason for not selfhosting an instance. I started hosting mine in my home until I learned that since it's in a home, the feds seizing an instance literally means they bust down your door and take your servers. I decided that I didn't vibe with that, and opted for a hosting provider. If for some reason someone hijacks my server and starts hosting horrible stuff, the seizure will be with my cloud provider, not my front door.
My suggestion is to start a personal instance first. Get the feel for it, see how you like it. Maybe create one community on there that you're passionate about and advertise that it's there to the fediverse (since they won't know about it until you tell them about it). Then judge your risk level and see how much you're willing to do. For me, I host a bunch of swifties, it's well within my risk tolerance. I approve everyone that comes in, and most have to ask to join. (Fight the urge to just create a ton of communities. You'll just end up with dozens of empty communities, there's no way you have the effort to kickstart a lot of communities. Pick one, maybe two, and really advocate for them. Shameless plug them, there's no harm in that here).
None of this is meant to scare you off, obviously I still host and I'm glad for it. My Swiftie Community has over 1,000 subscribers now! I'm very happy to host our little niche community, but I also have learned a lot on the way.