VPS Setup and Security Checklist: Complete Self-Hosting Guide for 2025

I set up my own VPS, documented every step, and ended up with a repeatable
deployment pipeline. This is both a checklist for my future self and a guide for
anyone curious about self-hosting. Along the way I'll explain why I picked
Hetzner and Coolify, and how they compare with other options like DigitalOcean,
AWS, Render, or Fly.io.

This comprehensive checklist covers every essential step for setting up a
secure, production-ready VPS. Each section includes commands, verification
steps, and troubleshooting tips based on real-world experience.

Pre-Setup Checklist

Before You Begin:

• Choose your VPS provider (Hetzner recommended for price/performance)
• Select server specifications (minimum 1GB RAM, 20GB storage)
• Note down server IP address and root credentials
• Prepare your local machine with SSH client
• Have a strong password generator ready

Picking the VPS provider

• Chose Hetzner Cloud (cheap, fast, reliable in Europe)
• Alternatives I considered:
  • DigitalOcean → smoother onboarding, great docs, slightly more expensive
  • AWS Lightsail → decent for small apps, but tied to AWS ecosystem
    (complex for beginners)
  • Linode → reliable, but Hetzner wins on price/performance
  • Render/Fly.io → easier PaaS, but more opinionated and costly at scale

Why Hetzner?

• 2–3x cheaper for the same specs compared to DO/AWS
• Strong European datacenter presence (latency advantage for my use case)
• Transparent pricing and no surprise bills

Initial Server Setup Checklist

First Login and System Updates

• Initial login as root

ssh root@your-server-ip

• Update package lists and upgrade system

apt update && apt upgrade -y

• Verify system information

uname -a
cat /etc/os-release

Root Account Security

• Change root password

passwd

- Use strong password with mixed case, numbers, symbols
- Store securely in password manager

• Create secondary user account

adduser your-username

- Choose descriptive username (not 'admin' or 'user')
- Set strong password

• Add user to sudo group

usermod -aG sudo your-username

• Verify user groups

groups your-username

- Should show: `your-username : your-username sudo`

• Test sudo access

su - your-username
sudo whoami

- Should return: `root`

SSH Key Authentication Setup

• Generate SSH keys on LOCAL machine (not server)

#### Ed25519 (recommended)
ssh-keygen -t ed25519 -C "your-email@example.com"

##### Or RSA if Ed25519 not supported
ssh-keygen -t rsa -b 4096 -C "your-email@example.com"

• Display public key on local machine

cat ~/.ssh/id_ed25519.pub
#### or
cat ~/.ssh/id_rsa.pub

• Copy public key to clipboard
• Create .ssh directory on server (as your user, not root)

mkdir -p ~/.ssh
chmod 700 ~/.ssh

• Create authorized_keys file

nano ~/.ssh/authorized_keys

- Paste your public key
- Save and exit

• Set correct permissions

chmod 600 ~/.ssh/authorized_keys

• Test SSH key login (from local machine)

ssh your-username@your-server-ip

- Should login without password prompt

Disable Password Authentication

• Edit SSH configuration

sudo nano /etc/ssh/sshd_config

• Modify these settings:

PasswordAuthentication no
PubkeyAuthentication yes

• Check cloud-init config if exists

sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf

- Set `PasswordAuthentication no` here too if file exists

• Test SSH configuration

sudo sshd -t

- Should show no errors

• Restart SSH service

sudo systemctl restart ssh
#### or
sudo service ssh restart

• Verify service status

sudo systemctl status ssh

- Should show active (running) with green dot

Disable Root Login

• Edit SSH configuration

sudo nano /etc/ssh/sshd_config

• Change root login setting

PermitRootLogin no

• Restart SSH service

sudo systemctl restart ssh

• Test root login is blocked (from another terminal)

ssh root@your-server-ip

- Should get "Permission denied"

Firewall Configuration Checklist

UFW (Uncomplicated Firewall) Setup

• Check UFW status

sudo ufw status

• Set default policies

sudo ufw default deny incoming
sudo ufw default allow outgoing

• Allow SSH before enabling firewall

sudo ufw allow ssh
#### or if you changed SSH port:
sudo ufw allow 2022/tcp

• Allow HTTP and HTTPS for web apps

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

• Enable firewall

sudo ufw enable

- Type 'y' when prompted

• Verify firewall rules

sudo ufw status verbose

Advanced Firewall Configuration

• Restrict SSH to your IP (optional but recommended)

sudo ufw allow from YOUR_IP_ADDRESS to any port 22
sudo ufw delete allow ssh

• Change default SSH port (optional security through obscurity)

sudo nano /etc/ssh/sshd_config

- Change `Port 22` to `Port 2022` (or your chosen port)
- Update firewall: `sudo ufw allow 2022/tcp`
- Remove old rule: `sudo ufw delete allow 22/tcp`
- Restart SSH: `sudo systemctl restart ssh`

Automatic Updates Setup Checklist

Unattended Upgrades Configuration

• Install unattended-upgrades

sudo apt install unattended-upgrades apt-listchanges

• Enable automatic updates

sudo dpkg-reconfigure unattended-upgrades

- Select "Yes" in the dialog

• Configure update settings

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

• Uncomment security updates line

"${distro_id}:${distro_codename}-security";

• Configure email notifications (optional)

Unattended-Upgrade::Mail "your-email@example.com";

• Enable automatic reboots if needed

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

• Test configuration

sudo unattended-upgrades --dry-run

• Check service status

sudo systemctl status unattended-upgrades

Production Application Deployment Checklist

Node.js Production Setup

• Install Node.js LTS

curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs

• Verify installation

node --version
npm --version

• Install PM2 globally

sudo npm install -g pm2

• Upload your application files

scp -r ./your-app your-username@your-server-ip:~/

• Install dependencies

cd ~/your-app
npm install --production

• Create production build

npm run build

Process Manager Configuration

• Start application with PM2

NODE_ENV=production pm2 start app.js --name "your-app"

• Configure PM2 for clustering (optional)

pm2 start app.js -i max --name "your-app-cluster"

• Save PM2 configuration

pm2 save

• Enable PM2 startup

pm2 startup
#### Run the command it outputs

• Test application restart

pm2 restart all
pm2 status

Reverse Proxy Setup (Nginx)

• Install Nginx

sudo apt install nginx

• Create site configuration

sudo nano /etc/nginx/sites-available/your-app

• Basic Nginx configuration

server {
    listen 80;
    server_name your-domain.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

• Enable site

sudo ln -s /etc/nginx/sites-available/your-app /etc/nginx/sites-enabled/

• Test Nginx configuration

sudo nginx -t

• Restart Nginx

sudo systemctl restart nginx

SSL Certificate Setup Checklist

Let's Encrypt with Certbot

• Install Certbot

sudo apt install certbot python3-certbot-nginx

• Obtain SSL certificate

sudo certbot --nginx -d your-domain.com

• Test automatic renewal

sudo certbot renew --dry-run

• Verify SSL grade
• Visit: https://www.ssllabs.com/ssltest/
• Should get A or A+ rating

Monitoring and Maintenance Checklist

Basic Monitoring Setup

• Install monitoring tools

sudo apt install htop iotop netstat-nat

• Check system resources

htop
df -h
free -h

• Monitor logs

sudo tail -f /var/log/syslog
sudo tail -f /var/log/auth.log

• Set up log rotation

sudo nano /etc/logrotate.d/your-app

Backup Strategy

• Create backup script

nano ~/backup.sh

• Sample backup script

#!/bin/bash
DATE=$(date +%Y%m%d_%H%M%S)
tar -czf ~/backups/app_backup_$DATE.tar.gz ~/your-app
#### Add database backup commands if needed

• Make script executable

chmod +x ~/backup.sh

• Set up automated backups

crontab -e

- Add: `0 2 * * * /home/username/backup.sh`

Troubleshooting Checklist

Common Issues and Solutions

SSH Connection Problems:

• Check firewall rules: sudo ufw status
• Verify SSH service: sudo systemctl status ssh
• Check SSH logs: sudo tail -f /var/log/auth.log
• Test from different network

Permission Denied Errors:

• Check file permissions: ls -la
• Verify user groups: groups username
• Check sudo configuration: sudo -l

Service Not Starting:

• Check service status: sudo systemctl status service-name
• View service logs: sudo journalctl -u service-name
• Check configuration files syntax

High Resource Usage:

• Identify processes: htop
• Check disk usage: df -h
• Monitor network: netstat -tulpn
• Review application logs

Final Verification Checklist

Security Verification

• Test SSH key authentication works
• Verify password authentication is disabled
• Confirm root login is blocked
• Check firewall is active and configured
• Verify automatic updates are working
• Test application runs in production mode
• Confirm SSL certificate is valid
• Verify backups are being created

Performance Testing

• Run basic load test

#### Install Apache Bench
sudo apt install apache2-utils

#### Test with 100 requests, 10 concurrent
ab -n 100 -c 10 http://your-domain.com/

• Monitor resource usage during load

htop

• Check application logs for errors

pm2 logs

Quick Reference Commands

System Information:

htop                    # System monitor
df -h                   # Disk usage
free -h                 # Memory usage
uname -a               # System info

Process Management:

pm2 status             # PM2 process status
pm2 restart all        # Restart all processes
pm2 logs              # View logs
pm2 monit             # Real-time monitoring

Security:

sudo ufw status        # Firewall status
sudo fail2ban-client status  # Fail2ban status
sudo lynis audit system      # Security audit

Services:

sudo systemctl status nginx    # Service status
sudo systemctl restart nginx   # Restart service
sudo journalctl -u nginx      # Service logs

Final thoughts

This checklist provides a complete approach to VPS setup and management. This
isn’t just about saving money. It’s about control and understanding. By
self-hosting with Hetzner + Coolify, I built muscle memory for devops that paid
off in confidence and freedom.

If you’ve been meaning to try VPS hosting, consider this a nudge.