DEV Community

Cover image for Setup a VPS on Hetzner Cloud
David Y Soards
David Y Soards

Posted on • Edited on • Originally published at blog.soards.me

Setup a VPS on Hetzner Cloud

#vps #docker #cloud #linux

Lambda What, Lambda Who

For deploying my personal projects and websites I have mostly relied on the hobby tiers of serverless services like Netlify, Github pages, or Cloudflare pages. Prior to that I used simple FTP on shared hosting.

The DX of using serverless platforms is very appealing. Just connect a Github account, push your code, and they do all the work for you. For simple statically generated websites, it can't be beat. But when I started using lambda functions for server-side actions, I quickly hit some annoying edge cases because the runtimes are not 100% Node compatible.

That experience motivated me to setup my own VPS for deploying containerized applications. It was also an opportunity to learn how the abstractions and tools I use actually work. I chose Hetzner because it was the cheapest and I like German stuff.

These are the steps I took to get up and running with a VPS on Hetzner Cloud:

Hetzner Cloud

Start a Hetzner account at accounts.hetzner.com/signUp

Donate the blood of your first born child. I kid, but if you are from the U.S. you will need to verify your identity using your passport and then wait for a manual approval. My approval only took a couple hours.

Log into your new Hetzner account and choose Hetzner Cloud. In the Hetzner Cloud dashboard, start a new project and add a server. I used the following settings for a basic server to host my side projects.

Location

Choose the nearest location. For me it was (Ashburn, VA) us-east.

Image

Either choose Ubuntu OS or if you plan on using Docker, you can switch to Apps and select Docker CE. It will give you the latest Ubuntu OS with Docker Community Edition pre-installed. If you prefer, you can also install Docker yourself later.

Type

Shared cVPU
x86 (Intel/AMD)
CPX11 - 2GB Ram / 40GB SSD

Networking

Select both IPv4 and IPv6. IPv6 only is a tiny bit cheaper, but you will almost definitely still need IPv4 also.

SSH Keys

Add an SSH Key. Github has a nice guide on generating SSH keys. Lately I've been using 1Password's SSH agent and I like how I can easily use the same keys on different machines.

Skip for now

Volumes, Firewalls, Backups, Placement groups, Labels, and Cloud Config can be configured later if you need them.

Name

I used the default name.

Click Create & Buy Now.

Configure your server

Now it's time to SSH into the server and set it up.

Copy your new server's IP Address and open a terminal.

ssh root@<server_ip_address>
Enter fullscreen mode Exit fullscreen mode

The first time you will be prompted to add the server's fingerprint to your known_hosts.

Updates

Run system updates to make sure we are using the latest, greatest, and most secure packages.

sudo apt-get update

sudo apt-get upgrade
Enter fullscreen mode Exit fullscreen mode

SSH

Create a new sudo user.

sudo adduser <new_user_name>

usermod -aG sudo <new_user_name>
Enter fullscreen mode Exit fullscreen mode

Add the public SSH key to your new user on the server.
To do that, switch to your new user.

su <new_user_name>
Enter fullscreen mode Exit fullscreen mode

Then make a new .ssh directory.

mkdir ~/.ssh
Enter fullscreen mode Exit fullscreen mode

To that directory, add a new file authorized_keys. Open that file with nano and paste in your public key.

nano ~/.ssh/authorized_keys
Enter fullscreen mode Exit fullscreen mode

End your session and log back in with your new user to make sure SSH is working properly.

ssh <new_user_name>@<server_ip_address>
Enter fullscreen mode Exit fullscreen mode

Now that you can ssh in with your username, you should dIsable login via the root user.
Navigate to the ssh directory and edit the sshd_config file. You may want to disable login via password entirely as well.

cd /etc/ssh
nano sshd_config
Enter fullscreen mode Exit fullscreen mode 
# sshd_config

PermitRootLogin no
PasswordAuthentication no
Enter fullscreen mode Exit fullscreen mode

A lot of people recommend changing the default SSH port, but I left mine on 22.

For convenience you can edit your local .ssh/config file like so:

Host <nickname>
  HostName <server_ip_address>
  User <new_user_name>
  PreferredAuthentications publickey
Enter fullscreen mode Exit fullscreen mode

With the above config, instead of typing ssh <new_user_name>@<server_ip_address> every time, you can just type ssh <nickname>.

UFW

Enable Uncomplicated Firewall and allow ports for SSH.

sudo ufw enable
sudo ufw allow OpenSSH
sudo ufw allow 22
Enter fullscreen mode Exit fullscreen mode

Fail2Ban

Install Fail2Ban to prevent brute force attacks.

sudo apt install fail2ban
Enter fullscreen mode Exit fullscreen mode

To configure, copy the jail.conf to jail.local and edit the file with nano.

cd /etc/fail2ban

# copy conf
sudo cp jail.conf jail.local

# edit
sudo nano jail.local
Enter fullscreen mode Exit fullscreen mode

Make sure the sshd jail is enabled. It should be on by default.

[sshd]
enabled = true
port    = ssh
Enter fullscreen mode Exit fullscreen mode

Nginx

Install Nginx and allow ports 80 and 443 on your firewall.

sudo apt-get install nginx
sudo ufw allow 'Nginx Full'
Enter fullscreen mode Exit fullscreen mode

Setup reverse-proxy to allow hosting multiple containers on a single server. Each container will be accessed publicly through a subdomain.

There are several different methods for configuring reverse-proxy. Using sites-enabled / site-available has long been the convention for Debian/Ubuntu, but a lot of people recommend avoiding it. I find it overly complicated.

A simpler method is to add a *.conf file to the conf.d directory for each subdomain.

cd /etc/nginx
Enter fullscreen mode Exit fullscreen mode 
# conf.d/subdomain.conf

server {
        listen 80;
        listen [::]:80;
        server_name subdomain.example.com;
        location / {
                proxy_pass http://localhost:3000;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
}
Enter fullscreen mode Exit fullscreen mode

To only use subdomains and remove the default Nginx page from your root domain, disable default in sites-enabled.

sudo unlink sites-enabled/default
Enter fullscreen mode Exit fullscreen mode

And return a root 404 page instead.

# conf.d/root.conf

server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        location / {
                return 404;
        }
}
Enter fullscreen mode Exit fullscreen mode

Restart Nginx.

sudo systemctl restart nginx
Enter fullscreen mode Exit fullscreen mode

Docker

If you didn't install Docker when you added your server, install it now by following instructions in the docs.

unattended-upgrade

Keep your system up to date automatically by installing unattend-upgrade.

By default it only auto updates security updates, but you can configure to update other packages as well. I left it on the default settings.

# install
sudo apt install unattended-upgrades
# configure
sudo dpkg-reconfigure unattended-upgrades
# check is running
sudo systemctl status unattended-upgrades
Enter fullscreen mode Exit fullscreen mode

git

Install git so you can clone your repos, build them on your server, and share with the world.

apt-get install git
Enter fullscreen mode Exit fullscreen mode

Congrats, you're officially a system admin! 🤜🤛

Next time, we will actually deploy a Node.js app in a Docker container.

Top comments (0)

Read next

mohsenkamrani profile image

Master Cron Expressions In 2 minutes

Sam -

blessingglobally profile image

Linux Challenge

Blessing Ndubuisi -

aws-cloudsec profile image

Issue 67 of AWS Cloud Security Weekly

AJ -

mrcaption49 profile image

Terraform - Infrastructure as a Code

Pranav Bakare -