Architecture, Safety, and Basic Commands
WSL2 initiates SSH and stores the user private key. The VPS runs sshd, stores authorized_keys, and owns system, firewall, and Docker configuration. Label command blocks [LOCAL: WSL2] and [REMOTE: VPS]; verify whoami and hostname instead of trusting a window title.
An SSH login needs routing, an allowed TCP 22 path, a listening sshd, a trusted server host key, successful user authentication, and a permitted Linux account. A successful ping proves only part of the network path. A surviving old session does not prove that a new session can pass the firewall.
whoami; hostname; uname -a
command -v ssh
ssh -V
ssh-keygen -lf "$LOCAL_SSH_PUBLIC_KEY"
whoami; id; hostnamectl
cat /etc/os-release
uname -a
nproc; free -h; df -h /
ip -brief addr
ip route
systemctl --failed --no-pager
Use this change loop: inspect current state, define the desired state, decide how to verify it, add the replacement before removing the fallback, then test from a fresh client. Prefer idempotent operations such as mkdir -p, dedicated configuration snippets, and checking before adding a rule.
sudo hostnamectl set-hostname infra-01
sudo timedatectl set-timezone America/Toronto
sudo apt update
sudo DEBIAN_FRONTEND=noninteractive apt full-upgrade -y
sudo apt install -y git curl ca-certificates jq ufw
apt update refreshes metadata; it does not install upgrades. Review the full-upgrade summary because dependency changes may be proposed. Check /var/run/reboot-required afterward. Ubuntu phased updates intentionally defer some ordinary updates; a deferred phased package is not the same as a failed upgrade.
Stop if identity or resources do not match, a secret must be exposed, critical packages would be removed, a fresh SSH test fails, firewall meaning is ambiguous, or existing storage conflicts with the plan. Preserving a recoverable state is more important than finishing a checklist.