Server setup

Create an SSH key

Generate a dedicated key for this server and set a passphrase when asked.

ssh-keygen -t ed25519 -a 100 -f ~/.ssh/hostinger-support -C "hostinger-support"

Copy the public key to your clipboard:

pbcopy < ~/.ssh/hostinger-support.pub

Only the .pub file leaves your laptop.

Get the VPS

Open Hostinger and pick a KVM plan. KVM 1 is enough for this project, because the database runs on Supabase. KVM 2 gives headroom if you want to run more projects on the same server.

Pick the 12-month term and enter the code DAVEVPS at checkout for 10% off. The code only works on a first purchase with a yearly plan. Log in, or create an account, when the checkout asks.

Look at the renewal price before you pay. The first term is discounted, and the plan renews at a higher price.

Set up the server

After payment, log in to your Hostinger account, open Billing, then Subscriptions, and click Set up next to the VPS.

1. Location: the data center closest to you.
2. Operating system: search the applications for Docker and pick the Docker template on Ubuntu 24.04.
3. Set a strong root password and save it in your password manager.
4. Click Add key and paste the public key. Name it hostinger-support.
5. Leave the malware scanner and paid backups unchecked.

When setup finishes, click Manage VPS and copy the IPv4 address from the overview.

Allow SSH from your IP only

Find your public IP address:

curl -4 https://ifconfig.me
# 203.0.113.25

In hPanel, open the VPS, then Security, then Firewall. Click Add firewall, name it ssh-my-ip, open Edit, and add one rule:

Keep the drop rule that the firewall starts with. Go back to the list, turn the firewall on, and confirm Activate.

The app needs no open port. The poller only makes outgoing calls, and you open the dashboard through SSH.

Log in as root once

In the VPS overview, open Web console and print the server's fingerprint:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
# 256 SHA256:<fingerprint> root@<hostname> (ED25519)

Then connect from your laptop. Type yes only if the fingerprint matches.

ssh -o IdentitiesOnly=yes -i ~/.ssh/hostinger-support root@<VPS_IPV4>

Update and check Docker

Still as root on the server:

apt update && apt upgrade -y
docker --version
docker compose version

If docker is not found, the template did not include it. Install it with Docker's official script:

curl -fsSL https://get.docker.com | sh

Create a deploy user

adduser asks for a password. You need it for sudo, so save it in your password manager.

adduser --gecos "" deploy
usermod -aG sudo,docker deploy
install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
install -m 600 -o deploy -g deploy /root/.ssh/authorized_keys /home/deploy/.ssh/authorized_keys

The docker group lets deploy run Docker without sudo. That is close to root access, so treat this user's key like a root key.

Save a shortcut

On your laptop, add this block to ~/.ssh/config (on Windows, $HOME/.ssh/config). Create the file if it does not exist.

Host support-vps
  HostName <VPS_IPV4>
  User deploy
  IdentityFile ~/.ssh/hostinger-support
  IdentitiesOnly yes
  ServerAliveInterval 30

Open a new terminal and test it, while the root session stays open:

ssh support-vps
whoami
# deploy

Harden SSH

As deploy on the server:

sudo tee /etc/ssh/sshd_config.d/01-hardening.conf > /dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF
sudo sshd -t
sudo systemctl restart ssh

sshd -t prints nothing when the config is valid. The file name starts with 01 because SSH uses the first value it reads, and files in that folder load in alphabetical order. A cloud setup file such as 50-cloud-init.conf can no longer turn password login back on.

Check the active values:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication)'
# permitrootlogin no
# passwordauthentication no