☁️ vps-setup

Overview

Setting up a virtual private server.
The provisioning and hardening are automated using Ansible.

This repository was inspired by the following videos:

• 10 Tips for Hardening your Linux Servers
• Setting up a production ready VPS

Pre-requisites

The following tools are needed to reproduce the setup:

• 1Password CLI for secret management
• Just for running commands
• Uv for managing python packages like Ansible
• Tailscale for secure networking
• Netdata for resource monitoring
• And a VPS running Ubuntu 26.04

Note

The solutions use 1Password's CLI to retrieve sensitive data.
The secret references in .env.op must be updated. More information here. See .env.op.example for the expected variables.

Python Virtual Environment

After cloning the repository create a python virtual environment and install the requirements:

just install

VPS Setup

If you are me, and have access to the private overlay repository, initialize it and restore the local symlinks with:

just setup-vps-setup-private

For a standalone setup, create and populate the files manually from the examples:

cp .env.op.example .env.op
cp ansible/inventory.example.ini ansible/inventory.initial.ini
cp ansible/inventory.example.ini ansible/inventory.provision.ini

The initial run connects over the public ip as root, while the provision run connects over the tailscale ip as ansible.
Update the ansible_host, ansible_user and ansible_ssh_private_key_file variables in each file accordingly.

Consider also setting the system hostname at the vps provider's panel so that tailscale can use it.

The vps-setup playbook can be run with the following command:

just ansible-initial

It is recommended to reboot the machine after the playbook has finished running.

For later runs call:

just ansible-provision

---

⭐ Star the repository if you found it useful ⭐
Repository Template | Reusable Workflows | Development Environment