Skip to main content

Personal VPS Fundamentals

This series builds a safe baseline before deploying applications: verify the machine, preserve remote access, create a private management path, close public SSH, and install a container runtime.

[WSL2: OpenSSH client + user private key]
       -> [Windows Tailscale connectivity]
       -> [Ubuntu VPS: sshd + public-key authentication]
          |-- UFW: public 80/443, SSH only on tailscale0
          |-- Docker Engine and Compose
          `-- /srv service directories

Three layers matter: network reachability, the OpenSSH protocol and host identity, and user public-key authentication. Tailscale supplies the private network path here; Ubuntu OpenSSH still listens on port 22 and authenticates the user. The separate Tailscale SSH product is not enabled.

Vocabulary​

TermMeaning here
VPSA virtual Linux machine supplied by a cloud provider
Public IPAn address routable from the Internet
Tailscale IPA private 100.x.x.x address inside a tailnet
PortA network service entry point, such as TCP 22 for SSH
daemonA long-running service such as sshd, tailscaled, or dockerd
UFWUbuntu's host-firewall frontend
image / containerA read-only template / a running instance of that template
ComposeA Docker plugin describing applications in YAML

Reading path​

  1. Architecture and safety
  2. SSH access and hardening
  3. Tailscale networking and OpenSSH
  4. UFW without lockout
  5. Docker Engine and Compose
  6. Operations runbook
  7. Practical Tmux
  8. Adding services beside an existing bot

Safety invariants​

  • Label every command as local WSL2 or remote VPS.
  • Never remove the last verified SSH path.
  • Test changes with a fresh connection; an old session can survive a broken firewall rule.
  • Never publish passwords, private keys, tokens, recovery codes, real addresses, or fingerprints.

Examples use placeholders:

VPS_USER=ubuntu
VPS_PUBLIC_IPV4=<public-ip>
TAILSCALE_IPV4=<100.x.x.x>
LOCAL_SSH_PUBLIC_KEY="$HOME/.ssh/id_ed25519.pub"

The baseline ends with a patched Ubuntu host, key-only SSH over Tailscale, public 80/443, Docker and Compose, empty /srv directories, Tmux skills, and a repeatable way to add isolated services. Directories are not backups, and an installed runtime is not an application deployment.