To set up a repository, first choose the machine on which you want to store the revision history of the source files. CPU and memory requirements are modest, so most machines should be adequate.
To estimate disk space requirements, if you are importing RCS files from another system, the size of those files is the approximate initial size of your repository, or if you are starting without any version history, a rule of thumb is to allow for the server approximately three times the size of the code to be under CVS for the repository (you will eventually outgrow this, but not for a while).
The repository should be accessible (directly or via a networked file system) from all machines which want to use CVS in server or local mode; the client machines need not have any access to it other than via the CVS protocol. It is not possible to use CVS to read from a repository which one only has read access to; CVS needs to be able to create lock files.
To create a repository, run the cvs init command. It will set up an empty repository in the CVS root specified in the usual way. For example,
cvs -d /usr/local/cvsroot init
cvs init is careful to never overwrite any existing files in the repository, so no harm is done if you run cvs init on an already set-up repository.