Replying to myself, I accepted what Vultr had to say and killed the server. Wasn’t really worth me investigating too deeply and I took them on their word.

I did the default Streisand install with all services, and disabled password based login on the box (keys only).

It seems Streisand has some issues updating some components according to their issues board and it seems like the maintainer might have abandoned it.

Next time I’ll probably use algo instead. I just need wireshark anyways ;)