If I was going to do it I would only host the site on tor or i2p. I’d only host magnet links with minimal metadata and aim to have the site work without JavaScript. Maybe a small flask application or something to populate the pages using templates. Very basic, light weight and secure.

I would also release a monthly dump of the site to allow it to survive in the event of a takedown .

This way you have a minimal attack surface , you are protected from legal threats as they dont know where or who is hosting and they dont have a hosting provider to send the notices to.

With regular dumps of the site , taking it down becomes futile as there are copies out there in the wild, that can spring up the next day if needed. Its like a diversified seed bank if you will 😉.