I am planning on creating a new Tor service. It will be a website made in PHP/Laravel/Symfony, a database like MySQL and there will be a payment system for Monero transactions.
I'm already familiar on how to host a website and how to deploy it as a onion service. The question I have is if the measurements I will be taking are sufficient to hide my identity.
I will buy a dedicated laptop and install Linux on it together with the required development tools. After that the system proxy will be configured to run through Tor by default. So all connections are going through Tor.
However, the laptop will be airgapped the whole time during development. If I need to go online to e.g deploy it, everything will go over Tor. I will never use this laptop for anything personal or login to a personal account.
When the service is deployed. The laptop will be destroyed and thrown away.
Cleaning the project files
I will remove the meta-data from all files and images including in the project using exiftool.
Purchasing the VPS
To put the project online I will search for a off-shore VPS-company which accept Bitcoin. To avoid monthly transactions I will buy the VPS for a long amount of time. I will download the required Bitcoin on the dedicated laptop and delete it again when the transaction for the VPS is done.
Purchasing the VPS will be done using Tor and of course with a temporary-email.
My service will accept Monero transactions. I will download a Monero wallet on my dedicated wallet and memorize the 25 word-seed by memory before deleting the wallet again. I will receive transactions in my wallet but will not access the wallet for a long time.
My service also needs to use Monero's JSON-RPC to validate a transaction. Is it okay to call JSON-RPC directly from my VPS?
Maintaining and administrating the service My intention is to publish the service on my VPS and to not access it again. The laptop used for development will be destroyed immediately after deployment. So if in a worst-case scenario a update is required, I will buy a new laptop, download the files from the VPS, update them and upload it back to the VPS.
Some administration/support must be delivered on the service. However, I will log in as few times as possible and the only support I will deliver is by answering basic chat messages. No files or URLs allowed in the chat.
Is this sufficient? Are these measurements sufficient to hide my identity to deploy a Tor Service anonymously? Are there other things I should consider?