# The small server your site lives on — your first VPS (Kit 7)

Every kit so far has been an account and a key. This one is the first time you rent an actual computer.

Your laptop is great, but it sleeps, it moves, it closes. The things you build want to stay up: a website people can reach at 3am, a script that checks something every hour, a place your email sends from. For that you want a small computer that lives in a datacenter, is always on, and does one job: run your stuff. That's a VPS. The nice part is you almost never touch it directly. You hand Claude a way in, and Claude drives it.

So this kit gets you a server, gets Claude connected to it safely, and locks the front door before anything is even on it. Next kit, we finally put something online.

## What a VPS actually is (read this once)
VPS stands for "virtual private server." Strip the jargon and it's just **a computer you rent by the month, sitting in a datacenter, on 24/7, that only you can log into.** You get a fresh Linux machine (we'll use Ubuntu), an IP address, and full control. It isn't shared like cheap web hosting. It's your own box.

Two things to hold onto:
1. **It's always on.** That's the whole point. Your laptop can close; the server keeps running whatever you left it running.
2. **You reach it over SSH**, a secure remote terminal. You (and Claude) log in from your own machine and run commands as if you were sitting in front of it. No screen, no mouse, just a command line.

That's it. A rented, always-on Linux box you talk to over SSH.

## Which host, and why I use Contabo
Most guides point you at Hostinger, DigitalOcean, Vultr, or Linode, and honestly they're all good. Any of them will run everything in this kit. Pick the one you like and Claude will work with it.

I use **Contabo**. The pricing is hard to beat for what you get, the speed and reliability have been rock-solid, and I've genuinely had zero issues across the boxes I run on it. That's the only reason, not a knock on anyone else. If you already have a host you trust, keep it. If you're starting fresh and want the most machine for the money, that's why I land on Contabo.

## Prerequisite
- Kit 1's terminal and Claude Code, so Claude can do the setup and drive the server.
- Kit 3's Cloudflare account. We use it for the security upgrade at the end (the good part).
- A safe home for the login details (the vault from the 5.1 note is perfect). A server login is exactly the kind of secret you never paste into a file you commit.
- A card. The entry plan is only a few dollars a month, but a VPS isn't free the way the earlier tiers were.

## How to use it (any OS)
- **Quick:** hit Copy, open Claude Code, paste this in, and say the line below.
- **Most reliable:** hit Download, then tell Claude:
  *"read ~/Downloads/vps-server-setup.md and set it up with me."*

Either way, say:

> "Help me set up my first VPS so my projects have an always-on home. I'm using Contabo (or tell Claude the host you picked). Walk me through creating a small server on the current Ubuntu LTS (26.04 right now) and tell me exactly which clicks are mine. Once it's up, set up access the right way: create a non-root user with sudo, generate an SSH key on my machine, install the public key on the server, then DISABLE root login and password login so the box is key-only. Add me an SSH shortcut so I connect by name, not by typing the IP. Turn on the firewall (allow SSH, deny the rest) and enable automatic security updates. Install a process manager (pm2) so anything we run stays up and restarts on reboot. Store the server details in my vault. Then, using my Cloudflare account from Kit 3, put SSH behind a Cloudflare Tunnel so the server has NO open ports at all. Before any change that could lock me out, validate it and arm an auto-revert first, and tell me the break-glass console option for my host in case I ever get locked out."

## What it sets up

**1. A small Ubuntu server.** You pick a plan (start small, you can size up later) and choose **the latest Ubuntu LTS** (26.04 right now) as the OS. The host emails you an IP and a temporary root password. That's the raw machine; everything below turns it into something safe to use.

**2. A non-root user with sudo.** Logging in as `root` all the time is like doing everything as administrator: one wrong command hits everything. So Claude makes you a normal user that can still do admin work when it asks (`sudo`). You live as that user, not root.

**3. Key-only login, no passwords.** Claude generates an **SSH key** on your machine: a private half that never leaves your laptop and a public half that goes on the server. From then on the server only opens for that key. Then Claude turns **root login and password login off entirely.** This one step removes the single biggest way servers get broken into, bots guessing passwords, because yours has no password to guess.

**4. A shortcut so you connect by name.** Instead of remembering an IP, Claude adds an entry to your SSH config so `ssh myserver` just works. Small thing, but you'll use it constantly.

**5. A firewall and automatic updates.** The firewall allows the ports you actually use and blocks the rest. Automatic security updates keep the OS patched without you thinking about it. Set-and-forget hardening.

**6. A process manager (pm2).** When you run something on a server, a web app or a worker, you want it to stay running after you log off, and to come back if the server reboots. pm2 does that: it keeps your processes alive and restarts them on boot. It's what makes "always on" actually true.

**7. The upgrade I run: zero open ports (Cloudflare Tunnel).** This is the part I'm proudest of in my own setup. Normally your server has SSH listening on a public port, and bots knock on it all day. Instead, using your Cloudflare account from Kit 3, Claude runs a **Cloudflare Tunnel**: a small program on the server dials *out* to Cloudflare, and you reach the box *through* Cloudflare. The result is a server with **no open ports at all**. Nothing to knock on, nothing to brute-force. It's more setup than plain SSH, so if you want to keep Kit 7 simple, the key-only and firewall path above is genuinely fine to start, and you can add the tunnel later. But it's how I run everything, and it's worth it.

## Security — the part not to skip
- **Key-only, never passwords.** If Claude set it up as above, you're already here. A key can't be guessed the way a password can.
- **Never log in as root.** Use your sudo user. Least privilege on the machine itself.
- **Guard the private key like a house key.** It lives on your laptop only. Don't copy it into a repo or a chat. If a laptop is ever lost, remove that key from the server (Claude can) and make a new one.
- **Know your break-glass BEFORE you need it.** Every host has a console (Contabo has a VNC console in its panel) that reaches the machine even when SSH is broken. Note where yours is. The one time you fat-finger the SSH config, that console is a 60-second fix instead of a rebuild.
- **Change SSH settings the safe way.** Editing the SSH config and reloading blindly can lock you out. The rule: validate the change first, and arm an auto-revert that undoes it in a minute unless you cancel, so a mistake fixes itself. Tell Claude to always do it this way, and it will.
- **A note on fail2ban.** It's a popular tool that bans an IP after repeated failed logins, and on a plain public-SSH server it's a reasonable add-on. But if you took the Cloudflare Tunnel route above, skip it: with no public port there's nothing to brute-force, and because tunneled connections reach the box as if from localhost, fail2ban can end up banning your own access. Key-only login plus the tunnel already closes the door it was built to guard.

## Cost, straight
The entry Cloud VPS runs a few dollars a month, around five for a small always-on Linux box with room to run several projects (Contabo's entry plan is under five; some hosts start a couple dollars higher). If you outgrow it, you move up to a bigger plan instead of starting from scratch. This is the first monthly bill in the series that's worth it on day one: it's the actual home everything you build from here lives in.

## Make it stick
Server up, key-only access, Claude connected by name, processes set to stay alive, and (if you did the upgrade) not a single open port for bots to find. You now own the one thing every project needs and most people rent piecemeal: a place that's always on and answers only to you.

You're done when: your server runs Ubuntu, `ssh myserver` logs you in with your key (and password and root login are off), and a test process you started with pm2 is still running after a reboot.

That's Kit 7. You've got the machine your work lives on, locked down before anything's even on it. Next up, the payoff: we put something online, on your own server, at your own domain.

-- Cliff (connectwithcliff.com)