Setting Up a New VPS

First Things First

  • update
  • change root password if not set already

Install Essential Packages

zsh git eza zoxide stow ufw foot-terminfo

Add User with sudo Privileges

adduser vpsadmin --shell $(which zsh)
usermod -aG sudo vpsadmin

SSH Setup

In /etc/ssh/sshd_config:

Port 62222
Protocol 2
PermitRootLogin no
AllowUsers vpsadmin

Use Keys for Auth with passphrase and name for key:

ssh-keygen -N 'securepassphrase' -t ed25519 -C 'mycomputer'
chmod 0600 /home/vpsadmin/.ssh/authorized_keys

optionally set PasswordAuthentication no in /etc/ssh/sshd_config

Add Alias on Client in ~/.ssh/config:

Host 1.1.1.1
  User vpsadmin
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes
  Port 62222

Remove AcceptEnv LANG LC_* to silence perl LC warnings

Firewall Setup

ufw allow 62222/tcp
ufw enable

Setup Hostname

hostnamectl set-hostname newhostname

In /etc/hosts:

127.0.1.1 newhostname

docker

https://docs.docker.com/engine/install/debian/#install-using-the-repository

Wireguard

# /etc/wireguard/wg0.conf
[Interface]
Address = 10.10.0.1/24
ListenPort = 51820
PrivateKey = <privkey>
PostUp = iptables -t nat -A POSTROUTING -o ens6 -j MASQUERADE
PostUp = iptables -A FORWARD -i wg0 -o ens6 -j ACCEPT
PostUp = iptables -A FORWARD -i ens6 -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT

PostDown = iptables -t nat -D POSTROUTING -o ens6 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -o ens6 -j ACCEPT
PostDown = iptables -D FORWARD -i ens6 -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT

[Peer]
PublicKey = <pubkey>
AllowedIPs = 10.10.0.2/32

Ip Forwarding:

sudo tee /etc/sysctl.d/99-wireguard.conf >/dev/null <<EOF
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
EOF

sudo sysctl --system

Allow Port and Forwarding in Firewall, e.g. ufw:

sudo ufw allow 51820/udp
sudo ufw route allow in on wg0 out on ens6
sudo ufw route allow in on ens6 out on wg0

On Client

[Interface]
Address = 10.10.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <pubkey>
Endpoint = <vps_ip>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Bring up with wg-quick up <wg.conf> and set private key with wg set from SecretService via secret-tool (cf. dotfiles/scripts/lwg)