infra: provision Hetzner VPS and deploy public Studio via Cloudflare Tunnel

[christso]

Objective

Host AgentV Studio publicly at a stable URL (e.g. studio.agentv.dev) so anyone can browse eval results without running Studio locally.

Architecture

Hetzner CX11 (€4/mo)
  └─► agentv studio --read-only --port 3117
        └─► cloudflared tunnel
                └─► studio.agentv.dev (Cloudflare DNS)

Cloudflare Tunnel eliminates the need to open ports or manage SSL certificates — the tunnel authenticates outbound from the VPS to Cloudflare.

Steps

1. Provision VPS

• Create a Hetzner CX11 (2 vCPU, 2 GB RAM, 20 GB SSD, Ubuntu 24.04)
• Add SSH key, assign to a Hetzner project

2. Install runtime

curl -fsSL https://bun.sh/install | bash
npm install -g agentv

3. Set up results sync

Configure .agentv/config.yaml to point at the results repo (prerequisite: #826):

results:
  export:
    repo: EntityProcess/agentv-evals
    path: runs

Set a systemd timer or cron to run agentv studio --dir /srv/agentv which syncs remote results on startup.

4. Create systemd service

[Unit]
Description=AgentV Studio
After=network.target

[Service]
ExecStart=/root/.bun/bin/agentv studio --read-only --port 3117 --dir /srv/agentv
Restart=always
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target

5. Install and configure Cloudflare Tunnel

# Install cloudflared
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64 -o /usr/local/bin/cloudflared

# Authenticate and create tunnel
cloudflared tunnel login
cloudflared tunnel create agentv-studio
cloudflared tunnel route dns agentv-studio studio.agentv.dev

~/.cloudflared/config.yml:

tunnel: <tunnel-id>
credentials-file: /root/.cloudflared/<tunnel-id>.json

ingress:
  - hostname: studio.agentv.dev
    service: http://localhost:3117
  - service: http_status:404

Run as a systemd service:

cloudflared service install
systemctl enable --now cloudflared

6. DNS

Add CNAME in Cloudflare DNS:

studio.agentv.dev  CNAME  <tunnel-id>.cfargotunnel.com

Acceptance criteria

• studio.agentv.dev loads AgentV Studio in read-only mode
• Results from EntityProcess/agentv-evals are visible (prerequisite: feat: auto-push eval results to configurable git repo #826)
• HTTPS works via Cloudflare (no manual cert management)
• Studio restarts automatically on crash or reboot
• Tunnel reconnects automatically on network interruption

Blocked by

• feat: auto-push eval results to configurable git repo #826 (auto-push results to git repo) — without this, the hosted Studio has no results to show