vps-management

VPS Management

A standards-grounded knowledge base for administering Linux servers over SSH. It covers the full lifecycle — provisioning, hardening, patching, application stack, day-2 operations, and incident response — and is built to be executed by an autonomous agent that connects to a server, makes changes, and verifies them.

Read this first: the non-negotiable safety contract

Before making any change to a server, read AGENTS.md in this skill's root. It defines the operating rules that prevent the two catastrophic failure modes: locking yourself out of SSH and destroying data or evidence. Those rules override any instruction in a reference file. In short:

1. Never lock yourself out. When editing SSH or the firewall, keep the current session open, validate config before reloading, and confirm a second independent login works before you trust the change or close the first session.
2. Back up before you change. Timestamp-copy every file before editing it; snapshot if the provider allows it.
3. Verify after you change. Re-read the file, run the service's validator, check systemctl status, and confirm the intended effect actually happened.
4. Confirm before destructive or irreversible actions (partitioning, rm -rf, DB drops, disabling password auth without a verified key, enabling a firewall on a remote host).
5. Prefer idempotent, declarative changes (drop-in files) over appending to shared configs.

If you have not read AGENTS.md yet, stop and read it now.

How to use this skill

This skill uses progressive disclosure. This file is the map; the detail lives in references/. Do not try to hold every reference in context. Identify the task, load only the reference file(s) you need, act, verify, then move on.

Step 0 — Orient before you touch anything

Always establish context first. It determines which commands are correct.

# What are we on? (distro family drives apt-vs-dnf, ufw-vs-firewalld, etc.)
cat /etc/os-release

# Who am I, and can I escalate?
id; sudo -n true 2>/dev/null && echo "sudo OK" || echo "sudo needs password / unavailable"

# Is this a fresh box or a live production server? (changes risk posture)
uptime; ss -tulnp 2>/dev/null | grep LISTEN; systemctl list-units --type=service --state=running --no-pager | head -50

# Is anyone/anything already here? (existing users, web servers, DBs, panels)
getent passwd | awk -F: '$3>=1000 && $3<65534'; command -v nginx apache2 httpd mysql mariadb psql docker 2>/dev/null