Hetzner VPS Setup Guide

Hetzner VPS Setup Guide

**This file is a Claude Code setup prompt. When you feed this file to Claude Code, it must follow the instructions in the CLAUDE INSTRUCTIONS block below before doing anything else.**

---

CLAUDE INSTRUCTIONS

Before executing any setup steps, ask the user the following questions **one at a time** and wait for each answer:

1. **Username:** "What username do you want to create on the server?"

2. **SSH public key:** "Please paste your SSH public key (or multiple keys, one per line). This will be the only way to log into the server."

3. **Tailscale:** "Do you want to set up Tailscale for private network access from your phone and computer? (yes/no)"

   • If yes: "Please paste your Tailscale auth key. You can generate one at https://login.tailscale.com/admin/settings/keys — use a reusable auth key if you plan to add multiple devices."

Once you have the answers, proceed with the setup steps below. Substitute ``, `` and Tailscale steps accordingly. Skip Section 9 (Tailscale) entirely if the user said no.

---

System Baseline

• OS: Ubuntu 24.04 LTS
• Hostname: set via Hetzner console or hostnamectl set-hostname

---

1. Initial Package Install

apt update && apt upgrade -y
apt install -y fail2ban curl git vim ufw

---

2. Create the Admin User

useradd -m -s /bin/bash -G sudo,adm 

Set home directory permissions:

chmod 750 /home/

---

3. SSH Key Authentication Setup

Create the `.ssh` directory with strict permissions:

mkdir -p /home//.ssh
chmod 700 /home//.ssh
chown : /home//.ssh

Write the authorized_keys file using the key(s) the user provided:

cat > /home//.ssh/authorized_keys << 'EOF'

EOF

Lock down the file:

chmod 600 /home//.ssh/authorized_keys
chown : /home//.ssh/authorized_keys

---

4. Sudo Access (Passwordless)

echo " ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/
chmod 440 /etc/sudoers.d/

---

5. SSH Server Hardening

Replace `/etc/ssh/sshd_config` with the following:

cat > /etc/ssh/sshd_config << 'EOF'
# Authentication
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
KbdInteractiveAuthentication no
PermitEmptyPasswords no
StrictModes yes

# Session limits
LoginGraceTime 30
MaxAuthTries 10
MaxSessions 5
ClientAliveInterval 300
ClientAliveCountMax 2

# Restrict access to a single user
AllowUsers 

# Disable unused features
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
PrintMotd no

# Logging
LogLevel VERBOSE
UsePAM yes

# SFTP subsystem
Subsystem sftp /usr/lib/openssh/sftp-server
EOF

Restart SSH (keep your current session open until verified):

systemctl restart ssh

**Verify login works** in a new terminal before