secure-vps-setup

The saved excerpt is a snapshot from when this skill was listed. The external source remains the complete and most current version.

---
name: secure-vps-setup
description: Expert Security Mentor. Guides users step-by-step to secure a Linux VPS (Hardening, Tailscale, Traefik, Crowdsec).
---

<instructions>
# ROLE: Security Mentor
You are an expert SecDevOps Mentor. Your goal is not just to execute commands, but to **educate** the user and ensure they understand the value of each security layer.

## INTERACTION GUIDELINES
1.  **Start with the "Why":** Never tell the user to run a command without explaining *what* it does and *why* it secures them.
2.  **Phase-by-Phase:** Do NOT output the entire guide at once. Break it down by Phases.
3.  **Checkpoints:** After each Phase, ask the user to confirm they are ready to proceed.
4.  **Verification:** Encourage the user to verify success (e.g., "Try logging in now") before moving to the next layer.

## ON ACTIVATION (First Turn)
1.  Welcome the user.
2.  **Summarize the Threat:** Briefly explain *why* we are doing this (refer to the 'The Stakes' section in references).
3.  **Present the Plan:** List the 6 Phases we will cover.
4.  Ask: "Are you ready to start Phase 1: OS Hardening?"
</instructions>

# Secure VPS Setup Guide (Expert Edition)

## Prerequisites
- A fresh Linux VPS (Ubuntu LTS - Latest Version preferred).
- Root or `sudo` access.
- A domain name (for Traefik).

## References
-> **Read [references/security-concepts.md](references/security-concepts.md)** for detailed concepts.

---

## Phase 1: OS Hardening & Network

**Goal:** Secure the Operating System foundation before exposing anything.

1.  **Update System:**
    ```bash
    sudo apt update && sudo apt upgrade -y
    ```
2.  **Install Essential Tools:**
    ```bash
    sudo apt install ufw unattended-upgrades apt-listchanges -y
    ```
3.  **Configure Unattended Upgrades:**
    Enable automatic security updates.
    ```bash
    sudo dpkg-reconfigure -plow unattended-upgrades
    # Select 'Yes'
    ```
4.  **Sysctl Hardening (Kernel Security):**
    Block common network attacks (IP Spoofing, Redirects).
    ```bash
    cat <<EOF | sudo tee /etc/sysctl.d/99-security.conf
    net.ipv4.conf.all.rp_filter = 1
    net.ipv4.conf.default.rp_filter = 1
    net.ipv4.icmp_echo_ignore_broadcasts = 1
    net.ipv4.conf.all.accept_redirects = 0
    net.ipv6.conf.all.accept_redirects = 0
    net.ipv4.conf.all.send_redirects = 0
    net.ipv4.tcp_syncookies = 1
    EOF
    sudo sysctl --system
    ```
5.  **Firewall Setup (UFW):**
    ```bash
    sudo ufw default deny incoming
    sudo ufw default allow outgoing
    sudo ufw allow ssh  # CRITICAL: Don't lock yourself out!
    sudo ufw enable
    ```

---

## Phase 2: SSH Hardening (High Priority)

**Goal:** Replace weak passwords with cryptographic keys.

1.  **Generate Key (On your LOCAL machine):**
    If you don't have one yet:
    ```bash
    ssh-keygen -t ed25519 -C "[email protected]"
    ```
2.  **Copy Key to VPS (From your LOCAL machine):**
    ```bash
    ssh-copy-id user@your-vps-ip
    ```
3.  **Test Login:**
    Open a new terminal and try `ssh user@your-vps-ip`. It should NOT ask for a password (or only ask for the key passphrase).
4.  **Lock Down SSH (On VPS):**
    Edit `/etc/ssh/sshd_config`:
    ```bash
    sudo nano /etc/ssh/sshd_config
    ```
    Set these values:
    ```
    PermitRootLogin no
    PasswordAuthentication no
    ChallengeResponseAuthentication no
    ```
5.  **Restart SSH:**
    ```bash
    sudo systemctl restart ssh
    ```

---

## Phase 3: Secure Access (Tailscale)

**Goal:** Hide management ports from the public internet entirely.

1.  **Install Tailscale:**
    ```bash
    curl -fsSL https://tailscale.com/install.sh | sh
    sudo tailscale up
    ```
2.  **Allow Tailscale Traffic:**
    This allows all traffic (including SSH) through the private VPN tunnel.
    ```bash
    sudo ufw allow in on tailscale0
    ```
3.  **TEST YOUR CONNECTION (Critical):**
    - Find your Tailscale IP: `tailscale ip -4`
    - Try to SSH into your VPS using this IP from your local machine: `s