/op-vps

description: Secure a fresh VPS — encrypted storage, firewall, SSH hardening, log management, killswitch
allowed-tools: ToolSearch, Bash, Read, Write, AskUserQuestion
argument-hint: <vps-ip> [--provider auto|aws|digitalocean|linode|vultr] [--profile paranoid|stealth|normal]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to /tmp/ or any system temporary directory.

VPS Hardening and Setup

Target and options: `$ARGUMENTS`

1. Parse `$ARGUMENTS` for VPS IP address, `--provider` (default `auto`), and `--profile` (default `normal`). The profile determines the opsec posture applied across all phases.

2. Ask the user for SSH credentials or key path via `AskUserQuestion` if not obvious from the environment or arguments.

3. Set the opsec profile for the session:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" set <profile>

• `normal` — standard hardening, full logging
• `stealth` — aggressive hardening, minimal logging
• `paranoid` — maximum hardening, no logging, encrypted everything

4. **Phase 1 — SSH Hardening**: Connect to the VPS and lock down SSH:

• Deploy SSH public key and disable password authentication
• Change SSH port to a non-standard port (randomized high port)
• Set `PermitRootLogin no`, `MaxAuthTries 3`, `AllowUsers <operator>`
• Restart sshd and verify reconnection on the new port

5. **Phase 2 — Firewall Setup**: Configure nftables with deny-by-default policy:

• Default INPUT and FORWARD policy: DROP
• Allow only the new SSH port, and any explicitly needed service ports
• Allow established/related connections
• Rate-limit new connections to prevent brute-force

6. **Phase 3 — Fail2ban**: Install and configure fail2ban:

• Set up an aggressive SSH jail: `maxretry=2`, `bantime=3600`, `findtime=600`
• Configure email or webhook notifications if desired
• Enable and start the fail2ban service

7. **Phase 4 — Unattended Upgrades**: Configure automatic security patching:

• Install `unattended-upgrades` package
• Enable automatic security updates only (no feature updates)
• Configure auto-reboot if needed (with time window)

8. **Phase 5 — Encrypted Storage**: Set up LUKS-encrypted container for operational data:

• Create a file-backed LUKS container: `dd if=/dev/urandom of=/root/vault.img bs=1M count=512`
• Format with LUKS: `cryptsetup luksFormat /root/vault.img`
• Open and mount: `cryptsetup open /root/vault.img vault && mkfs.ext4 /dev/mapper/vault && mount /dev/mapper/vault /mnt/vault`
• Ask user for the encryption passphrase via `AskUserQuestion`

9. **Phase 6 — VPN Killswitch**: Configure iptables rules to prevent traffic leaks:

• Allow traffic only through VPN tunnel interface (tun0/wg0)
• Allow loopback and the VPN server's IP on the physical interface
• Drop all other outbound traffic
• Persist rules with `iptables-save`

10. **Phase 7 — DNS Leak Prevention**: Force all DNS through VPN or Tor:

• Set `/etc/resolv.conf` to use VPN-provided DNS or Tor DNS (127.0.0.1:5353)
• Make resolv.conf immutable: `chattr +i /etc/resolv.conf`
• Verify no DNS leaks with external test

11. **Phase 8 — Log Management**: Configure logging based on the opsec profile:

• `normal`: standard syslog and journald, rotate weekly
• `stealth`: minimal logging — disable auth.log verbose entries, reduce journal retention to 1 day
• `paranoid`: disable all persistent logging — set `Storage=volatile` in journald.conf, truncate all log files, disable rsyslog

12. Log each setup phase to the ops tracker:

    node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add <vps-ip> vps-setup <phase> "<action>" <result> <severity>

13. Write a comprehensive VPS setup report to the project directory. Include all configuration changes, credentials/ports to remember, and operational notes.