AI Agent VPS

Source

Machina (@EXM7777) — x.com/EXM7777/status/2101371746003845539 (19 Sep 2026). ~476 likes / ~764 bookmarks / ~29k views at capture. Follow-up: his list at weeklyaiops.com (his, not ours).

you should invest some time setting up a VPS for your AI agents... it might change your life

His how:

• Rent one big computer in a data center. Hermes, Claude Code, Codex all run on it.
• Invisible to the public internet. Only devices on a private Tailscale network can connect.
• Install Tailscale, sign in, reach the server by name — like they’re in the same room.
• Hermes desktop uses that tunnel. Chats and jobs live on the server. Same sessions from any device on the network (same for every agent).
• Login needs a personal key file. Passwords don’t work. No key → nothing, even inside the private network.
• Every program under its own limited account. A bug in one can’t touch the others. API keys in files only he can read as admin.
• Security updates install themselves. An intrusion guard bans attackers. A backup runs every hour.

Close: “a very cheap AI model can set this up for you, give it a try.” True — if you don’t let it close the only SSH door before Tailscale works. Lockout warning is in the sitting below.

One-sentence TL;DR

Rent a Linux box, put agents on it, talk to it only over Tailscale, SSH keys only, one Unix user per agent, secrets mode 600, unattended upgrades, backups of the vault not of node_modules. Laptop sleeps; the box doesn’t.

Not the other VPS pages on this site

Picture

Phone / laptop / Hermes desktop
  └── Tailscale (signed in, same tailnet)
        └── VPS by MagicDNS name  (no public :22)
              ├── user hermes   → Hermes + tmux
              ├── user claude   → Claude Code
              ├── user codex    → Codex
              ├── admin (you)   → /etc/agent-secrets/*  mode 600
              ├── unattended-upgrades
              └── restic/borg hourly → another bucket

GitHub is still source of truth. Production (Railway, customer sites) stays a different machine. This box is the agent desk, not the storefront.

Sitting (give this to a cheap model — then watch the firewall)

Order matters. You still need the provider’s public SSH once to install Tailscale. Only then do you hide :22. Keep that first session open until a second device on Tailscale can ssh admin@your-box.

1. Rent the box

• Ubuntu LTS, a region close to you.
• RAM first (agents + context), then CPU. “One big computer” in his tweet — not a $4 toy if Hermes + Claude + Codex run together.
• Add your SSH public key in the provider panel before first boot if they offer it.

2. Key login, passwords off (while you still have a window)

# on the laptop, if you don't have a key yet:
ssh-keygen -t ed25519 -f ~/.ssh/agentbox -N ""
ssh-copy-id -i ~/.ssh/agentbox.pub admin@PROVIDER_IP

# on the VPS:
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?KbdInteractiveAuthentication.*/KbdInteractiveAuthentication no/' /etc/ssh/sshd_config
sudo systemctl reload sshd

Open a second terminal and confirm key login before you close the first. A machine without the key gets nothing — that starts now, even before Tailscale.

3. Tailscale, then name

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale status
# note the MagicDNS name, e.g. agentbox.tailnet-name.ts.net

On the laptop (and phone): install Tailscale, same account. Then:

ssh -i ~/.ssh/agentbox admin@agentbox

If MagicDNS fails, use the 100.x from tailscale status (same gotcha as Termius on /tmux). Put a Host agentbox in ~/.ssh/config with IdentityFile. Don’t publish the 100.x or tailnet name.

4. Hide from the public internet

Only after step 3 works from a second device:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow in on tailscale0
sudo ufw enable
sudo ufw status

SSH is now reachable on the Tailscale interface, not on 0.0.0.0:22. Provider console / VNC is your break-glass if you still lock yourself out. Don’t skip that check.

“Intrusion guard” in the tweet is fail2ban-class tooling. If :22 is already tailnet-only, fail2ban on public SSH is mostly theater. Keep it if you still expose anything (a leaked web UI). Don’t think it replaces the firewall.

5. One Unix user per agent

sudo adduser --disabled-password --gecos "" hermes
sudo adduser --disabled-password --gecos "" claude
sudo adduser --disabled-password --gecos "" codex
# none of these in sudo

# you jump in as admin, then:
sudo -iu hermes
tmux new -s hermes
# install / run that agent here, Ctrl-b d to detach

A runaway Claude Code as claude should not be able to read Hermes’ files or your admin secrets. That’s the “bug in one can’t touch the others” line. Don’t run all three as root “to make install easier.”

6. API keys only admin can read

Linux has no Keychain Access. On this Mac that’s /keychain. On the VPS:

sudo mkdir -p /etc/agent-secrets
sudo chmod 700 /etc/agent-secrets
sudo touch /etc/agent-secrets/hermes.env
sudo chmod 640 /etc/agent-secrets/hermes.env
sudo chown root:hermes /etc/agent-secrets/hermes.env
# paste keys as root, never in agent chat
# hermes user can read, cannot write

Same for claude.env / codex.env with those groups. Agents source the file in their tmux session. Don’t commit them. Don’t leave a world-readable .env in a repo.

7. Unattended upgrades

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Security updates install themselves. Reboots: either enable automatic reboot in that config or a calendar reminder. An unpatched box on Tailscale is still a box with your keys.

8. Hourly backup (of what matters)

His tweet says every hour. Useful targets: home dirs, /etc/agent-secrets, tmux isn’t needed if the projects are in git. Skip backing up node_modules and model caches every hour.

• Provider snapshots daily is the lazy floor.
• restic or borg to a different account/bucket hourly is the real version.
• Test a restore once or it isn’t a backup.

9. Hermes desktop (and every other client) uses the tunnel

Point the desktop app at the MagicDNS name, not a public IP. Sessions live on the server. Laptop A and laptop B see the same jobs because they’re the same processes. Same idea as tmux attach from any device — the UI is just another client on the tailnet.

We don’t have his Hermes config file. Don’t invent one. If the app can set a remote host / SSH / Tailscale IP, that’s the knob. /hermes is the operating-layer writeup on this site, not a guarantee it’s the same binary he runs.

Prompt you can give a cheap model

Paste this, then you confirm Tailscale SSH from a second device before it enables UFW.

Set up this Ubuntu VPS as an AI agent box.
Constraints:
- SSH keys only. Disable passwords and root login.
- Install Tailscale. I will join the tailnet from my laptop.
- Do NOT enable a default-deny firewall until I confirm SSH works via Tailscale from a second session.
- Create unprivileged users: hermes, claude, codex. None in sudo.
- /etc/agent-secrets mode 700; per-agent env files 640 root:AGENT.
- unattended-upgrades on.
- Do not install a public web UI.
- Print every command before you run it. Stop before UFW enable and wait for me.

If it fails

What we keep vs skip

• Keep: one always-on box; Tailscale as the network; keys not passwords; one user per agent; secrets 600/640; unattended upgrades; backup of secrets + git; cheap model with a UFW stop-gate.
• Verify: Hermes desktop actually talks over the tailnet (his tweet, we don’t have the app settings); whether fail2ban is doing anything once :22 is private.
• Skip: leaving SSH on the public IP “just in case”; all agents as root; hourly backups of caches; using this VPS as production for customer sites; pasting API keys into the cheap model’s chat; treating Grok Bot’s VM as this recipe.

Related on this site

• SSH + VPS — @jturntdev, thinner client, less tailnet lock
• Agent machine — tmux + Tailscale + Termius
• tmux reconnect — same persistence idea on a Mini
• macOS Keychain — secrets on a Mac; this page is files on Linux
• Hermes · computer use
• exe.dev · GrokBot limits (their VM, not yours)
• Gym hack — a private network is not a deny list on send/spend

Primary: @EXM7777 — VPS for AI agents