Claude VPS Setup Prompt
github.com/deniurchak/claude-vps-setup-prompt- Category
- Developer Tools
- Rank
- No. 3972Tools index
Previous survey · No. 3743 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Deployment & Operations · Security & Identity
- Interfaces
- Agent Skill / Plugin
- Builder
- @denisyurchak
- GitHub
- 163 stars
- Date
About
An interactive Claude Code prompt that automatically sets up a hardened Ubuntu 24.04 VPS with security configurations including SSH hardening, fail2ban, UFW firewall, and optional Tailscale. Simply feed the prompt file to Claude Code and it walks you through the entire server setup process.
What it does
A single Markdown runbook written for an AI coding agent rather than a person. You open it in Claude Code on a fresh Hetzner box, the agent asks three questions one at a time (login name, public key, whether to join a Tailscale private network), then runs a fixed sequence of shell commands as root: new admin account, key-only login, a ban list for repeated failed logins, a deny-by-default firewall, automatic security patches. There is no installer and no code; the agent is the interpreter.
Why it's ranked here
It is a clean example of a pattern worth knowing: a server checklist turned into an agent prompt, with the questions it needs asked up front and a verification step at the end. The content is short enough to audit in one sitting, and every command is visible before it runs. Against that, it is one prompt file with no license named, no tests, and no way to rerun it safely on a box that is already configured. Useful as a template to read and adapt, thin as a maintained tool.
What's good
The steps are explicit shell, so you can check exactly what will change before the agent touches anything. It warns twice about lockout: keep the current session open until a new login works, and only close the public SSH port after private-network access is confirmed. The SSH settings go beyond the usual two lines, also turning off agent forwarding, tunnelling and X11, and limiting logins to the one named account. It ends with a checklist that tests each service and runs a dry check of the SSH config before you walk away.
Tradeoffs
The new account gets passwordless sudo for everything, so a stolen key is full root. The SSH config is overwritten wholesale rather than edited, which discards anything the host image put there. Public port 22 stays open by default. The Tailscale auth key is pasted into the agent chat and then onto a command line, so it lands in the conversation log. SSH allows ten attempts per connection while the ban triggers at three failures. It targets Hetzner and Ubuntu 24.04 only, and nothing guards against running it twice.
How to use it well
Best for a solo developer standing up one personal box for side projects or an agent sandbox. Read the prompt first, as its own README says, and decide on the sudo policy before you run it; giving the account a password and dropping the passwordless rule is a small edit. Use a one-time, short-lived Tailscale key rather than a reusable one. It stops at a locked-down empty server: no web server, no backups, no monitoring, no container runtime. Pair it with whatever deploys your actual workload.
Technical notes+
hetzner-public.md opens with a CLAUDE INSTRUCTIONS block that tells the agent to collect three answers before acting, then substitutes them into placeholders across eleven numbered sections. Sudo is granted by writing a NOPASSWD:ALL line to a per-user file under /etc/sudoers.d, and the account is created by useradd with no password set. Section 5 replaces /etc/ssh/sshd_config with a heredoc (PermitRootLogin no, PasswordAuthentication no, AllowUsers, AllowTcpForwarding no, MaxAuthTries 10, LoginGraceTime 30). The fail2ban jail.local sets a 1h default ban and a 24h, three-strike sshd jail. Auto-updates are enabled through 20auto-upgrades. Tailscale installs via its curl-piped install script and runs tailscale up with --authkey and --ssh; an optional block swaps the public UFW port 22 rule for one bound to the tailscale0 interface.
Observed
- Format
- Agent prompt in Markdown, run by opening it in Claude Code; no executable code in the repository
- Repository contents
- Two Markdown files: README.md and hetzner-public.md
- Target platform
- Ubuntu 24.04 LTS on a Hetzner VPS
- License
- None named in README.md
- Privilege model
- Commands run as root; created account gets passwordless sudo (hetzner-public.md)
- Components configured
- OpenSSH, fail2ban, UFW, unattended-upgrades, optional Tailscale with Tailscale SSH
- Tests
- No test files in the repository tree; manual verification checklist in hetzner-public.md
Read from README.md, hetzner-public.md.
What it can do
Set up Ubuntu 24.04 VPS from scratch
Fresh VPS instance on Hetzner → Fully configured Ubuntu 24.04 server
Harden SSH configuration
Default SSH settings → Secured SSH configuration with hardened settings
Configure fail2ban intrusion prevention
Server without intrusion protection → Active fail2ban service monitoring and blocking malicious access attempts
Set up UFW firewall rules
Server with default firewall settings → Configured UFW firewall with security rules
Install and configure Tailscale VPN
User selection for Tailscale setup → Working Tailscale VPN connection on the server
Guide users through interactive server setup
User responses to setup questions → Step-by-step configuration process completion
Tags
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.