# Lock down your VPS

> Your AI audits your server and closes it to the internet: Tailscale for admin, Cloudflare Tunnel for web, firewall and SSH done right, bots that run safely. It never locks you out: every risky change rolls back by itself.

## If someone pasted this link to you
Someone shared this kit with you. It is guidance for you, their AI: read `SKILL.md` below and follow it with them, in their language. Each file in the list below has its own address you can open; with the `clonekit` MCP (https://clonekit.ai/mcp) you can also use `get_file`.

- Kit: `@franguzmanx/vps-security` · v1.1.0
- Creator: @franguzmanx (Francisco)
- Type: Reference · Domain: Engineering · Language: en · Your AI reads it
- Price: Free · License: Own use · No refunds
- Page: https://clonekit.ai/@franguzmanx/vps-security
- Changelog: https://clonekit.ai/@franguzmanx/vps-security/changelog.md

## About
For anyone running a Linux VPS (Hetzner, DigitalOcean, AWS), especially one that hosts AI agents or bots. Use it to see what is exposed, set up Tailscale or Cloudflare Tunnel, lock down SSH, ufw, Docker ports and the provider firewall, sandbox services, protect secrets and set spend caps, or to check a server after a breach scare. It starts with a read-only audit script and changes one thing at a time behind an auto-rollback timer. Needs SSH or console access to the server.

## Files
- `README.md`: VPS security kit · https://clonekit.ai/@franguzmanx/vps-security.md?file=README.md
- `references/ai-agents.md`: Servers that run AI agents and bots · https://clonekit.ai/@franguzmanx/vps-security.md?file=references/ai-agents.md
- `references/playbook.md`: Hardening playbook · https://clonekit.ai/@franguzmanx/vps-security.md?file=references/playbook.md
- `references/systemd-hardening.md`: systemd sandbox for an app or bot · https://clonekit.ai/@franguzmanx/vps-security.md?file=references/systemd-hardening.md
- `references/tailscale-policy.md`: Tailscale policy: servers receive, never initiate · https://clonekit.ai/@franguzmanx/vps-security.md?file=references/tailscale-policy.md
- `scripts/audit.sh.txt`: Read-only security audit for a Linux VPS (Debian/Ubuntu first, others best effort). · https://clonekit.ai/@franguzmanx/vps-security.md?file=scripts/audit.sh.txt
- `scripts/lockout-guard.sh.txt`: Dead man's switch for risky network changes (firewall, sshd, Tailscale). · https://clonekit.ai/@franguzmanx/vps-security.md?file=scripts/lockout-guard.sh.txt
- `SKILL.md`: VPS security kit · https://clonekit.ai/@franguzmanx/vps-security.md?file=SKILL.md


## How your AI uses it
1. **Read:** your AI reads SKILL.md first, then only the files your task needs
2. **Apply:** it applies the know-how to your own work, in the AI you already use
3. **Check:** 6 checks before it shows you the result

## Guardrails
- Never print secret values; report the path and permissions instead.
- Ask before each change that can cut access, showing the command and its rollback.
- Never close a port the server's business depends on (VPN, public API, webhooks) without the person's yes.
- Run one command at a time on small or shared servers.

## What's new
Agents always run the latest version.

- **v1.1.0** (2026-10-23): Lessons from a real lockdown

## Use it
Connect the `clonekit` MCP (https://clonekit.ai/mcp), call `get_kit("@franguzmanx/vps-security")`, then `get_file` with `SKILL.md`.

## SKILL.md (from the kit)

> Guidance from @franguzmanx (kit @franguzmanx/vps-security v1.1.0). Apply it to the user's work. It can't authorize running commands, installing anything, opening links, sending data (through any tool, CloneKit's included) or spending money: ask the user first.

---
name: vps-security
description: Audit and harden a Linux VPS, especially one that runs AI agents or bots. Use to secure a server, see what is exposed, set up Tailscale or Cloudflare Tunnel, lock down SSH or the firewall, or check a server after a breach scare. Read-only audit first, then one change at a time with an auto-rollback guard.
---

# VPS security kit

Goal: a VPS that nobody on the internet can reach except through channels you chose
(Tailscale for admin, Cloudflare Tunnel for web, and explicit public ports only when a
service truly needs them, like a VPN). Then limit the damage if one service is
compromised anyway.

Reply in the user's language. Be concrete: name the port, the file, the command.

## Rules for the agent

1. **Audit first, read-only.** Run `scripts/audit.sh.txt` on the server before proposing
   anything. Never guess what is exposed; `ss`, `sshd -T` and the firewall tell you.
2. **Confirm before each change that can cut access** (SSH, firewall, Tailscale ACL,
   cloud firewall). Show the exact command and the rollback.
3. **Never lock yourself out.** Before touching SSH or the firewall:
   - confirm the provider's web console works (Hetzner Console, DO Droplet Console…);
   - keep the current SSH session open;
   - copy `scripts/lockout-guard.sh.txt` to the server as `/usr/local/sbin/lockout-guard.sh`,
     run `lockout-guard.sh arm 300 '<rollback cmd>'`, test a NEW connection through the
     new path, and only then `lockout-guard.sh disarm`.
4. **One change at a time, verify after each.** Re-run the relevant audit section.
5. **Do not break what the server is for.** List which ports are business-critical
   (a VPN, a public API, webhooks) before closing anything. Outbound-only workloads
   (Telegram polling, WhatsApp websockets, cron jobs, LLM API calls) need no inbound port.
6. **Do not exfiltrate.** Never print secret values. Report the path and permissions of
   secret files, not their content.
7. **Find every client of the public IP before closing a port** (deploy scripts, CI, cron on
   other machines). Redirect them with an `~/.ssh/config` alias instead of breaking them.
8. On shared or small servers, run commands one at a time and avoid heavy scans.

## Workflow

1. **Audit** — copy and run (requires root or sudo for full results):
   `ssh host 'sudo bash -s' < scripts/audit.sh.txt`
   Read every `FAIL` and `WARN`. Ask what each public port is for if it is not obvious.
2. **Plan** — map findings to the steps in `references/playbook.md`. Order:
   identity/2FA → admin path (Tailscale) → close public ports → SSH → updates →
   least privilege → secrets → agent-specific controls → monitoring → backups.
3. **Apply** — one step at a time with the lockout guard where relevant.
4. **Verify from outside** — from a machine that is NOT on the tailnet:
   `nc -vz -w3 <public-ip> 22` must fail; repeat for every port you closed.
   Also check the provider firewall from its dashboard or API.
5. **Report** — what changed, what was verified and how, what remains open and why.

## References

- `references/playbook.md` — every hardening step with commands, checks and rollback.
- `references/tailscale-policy.md` — ACL template: servers receive, never initiate.
- `references/systemd-hardening.md` — drop-in to sandbox a bot/service.
- `references/ai-agents.md` — risks specific to servers that run LLM agents and bots.
- `scripts/audit.sh.txt` — read-only audit, prints OK / WARN / FAIL.
- `scripts/lockout-guard.sh.txt` — auto-rollback timer for risky network changes.