Hardened VPS Deploy for a 24/7 Claude Agent
Run an always-on Claude agent on a VPS safely: SSH and firewall hardening, locked-down chat bot, scoped secrets, vetted skills, alerts.
Before & after
Same prompt, same agent — the only difference is the skill.
Running an autonomous agent is a cool idea, but it requires setting up a server and making sure everything is secure. You'd need to pick a cloud provider, set up the environment, and deploy your agent code there. You'll probably want to add some monitoring so you know if things go wrong, and you should think about how to make it secure—not exposing credentials or letting it access sensitive files. It's also helpful to have a way to communicate with the agent, like through Slack or email. Setting this up can be complex, but many people do it successfully. The main thing is to be careful about security and test thoroughly before going live.
VPS DEPLOYMENT GUIDE: AUTONOMOUS CLAUDE AGENT STEP 1: PROVISION VPS (1 hour) • Host: Hetzner Cloud (CX11, 2vCPU, 4GB RAM, Germany region) ~$5/mo • OS: Ubuntu 22.04 LTS • SSH key: generate locally, save to 1password, add to VPS root access only • Firewall: inbound = 22 (SSH, your IP only), 443 (https); outbound = all STEP 2: HARDENED AGENT DEPLOYMENT • Deploy OpenClaude template (click deploy, answers defaults) • Create agent user: uid=1001, no shell, home=/var/agent • Skill allowlist: all skills scanned via VirusTotal + Claude analyzer before install • Credentials: never in code; use env files, 0600 permissions, rotate monthly STEP 3: EXTERNAL INTEGRATIONS (Read-Only Gateway) • Gmail: OAuth token, read-only scope (no send, delete) • Google Sheets: read-only API key, audit log enabled • Slack alerts: incoming webhook only (one-way notifications) • Zapier MCP: trusted proxy instead of raw API keys (credential isolation) STEP 4: MONITORING & ALERTING • Telegram bot: agent health + error alerts (daily digest 6am UTC) • Logwatch: sends 404 attempts, resource spikes to Telegram • Backup: nightly to S3, keep 7-day retention • Rollback: tag each deployment; can revert in <2 min LAUNCH CHECKLIST ✓ Agent online 24/7; test with /ping daily ✓ Skills scanned and whitelisted ✓ Secrets rotated; backup working ✓ Incident runbook posted in Telegram group
About this skill
An always-on agent that reads the web and holds your API keys is a target. This skill deploys it to a VPS so it keeps running when your laptop is closed, and so only you can talk to it.
What it does
- Hardens SSH, firewall, and patching, including the Docker port trap that bypasses ufw
- Runs the agent as an unprivileged systemd service with secrets in env files or a secret manager, never in prompts or memory files
- Keeps gateways off the public internet and locks the Telegram or Slack bot to allowed user ids
- Vets skills and plugins before install and scopes app connections to least privilege with confirmation for sends and deletes
- Adds restart-on-crash, an external dead-man alert, tested backups, and a documented kill switch
What you get
An ordered deploy plan, a 13-point audit checklist, and a host record with no secret values in it.
Best for
Solo operators and small teams moving a personal or business agent from a laptop to a server.
SKILL.md preview
---
name: vps-autonomous-claude-deploy
description: Deploy an always-on Claude-based agent to a VPS safely - SSH and firewall hardening, a non-root service user, secrets in env files or a secret manager, no public admin ports, a chat bot (Telegram, Slack) locked to allowed user ids, vetted skill installs, least-privilege app connections, restart-on-crash, backups, and an external dead-man alert. Use when the user says "run my agent 24/7 on a server", "move my Claude agent off my laptop", "set up an agent on Hetzner/DigitalOcean/Hostinger", "connect my agent to Telegram", "is my agent server secure?", or casually "I want my bot running when my laptop is off".
---
… (sign up to view the full skill)More development skills
View all Development skills →Chaos Experiment and Game Day Planner
Plans chaos experiments and game days: hypothesis, blast radius, abort conditions, tool manifests, rollback, and post-run review.
Claude Code Cost and Latency Routing
Configure Claude Code Router with model tiers, explicit fallbacks, compatibility checks, and a cost-aware validation plan.
CI/CD Pipeline Builder with Gated Deploys
Generates CI/CD workflows from your repo's real stack: cached fast-fail checks, pinned actions, and staging-to-prod deploys with gates.
Terraform Modules and Safe Deployments
Get reusable Terraform modules, safe state migrations, explicit provider wiring, and CI gates tied to reviewed plans.