Introduction

vps-ready is one static binary that audits a fresh Linux server and hardens it, with a plan you review first and a one-command undo after. Its headline feature is the safety net: before it keeps a change to the admin user, the SSH server config or the firewall, it proves you can still log in.

Note

vps-ready is pre-1.0. detect and audit (29 controls), and plan, apply, confirm and rollback for six modules work today on Debian 12/13 and Ubuntu 22.04/24.04 with systemd. There may be breaking changes before 1.0.

Why

You rent a VPS, get root@ip, and want to deploy something. Before that there are about fifteen setup steps: an admin user with an SSH key, SSH hardening, a firewall that also covers Docker, automatic security updates, sane kernel settings. In practice people follow an old blog post, run a random script as root, lock themselves out of SSH, or end up with a firewall that silently ignores their containers.

Auditors like Lynis tell you what is wrong but fix nothing. Ansible roles fix things but need a control machine and offer no undo. vps-ready does both, on the server itself, and checks that you can still get in.

How a run works

1. 1auditread-only

   Checks 29 controls and says why each one matters.

2. →
3. 2planread-only

   A diff of every file and setting that would change.

4. →
5. 3applychanges

   Snapshot, validate, write, verify. A failure restores everything.

6. →
7. 4confirmsafety net

   From a new SSH login. Without it, the safety timer rolls back.

8. →
9. 5rollbackany time

   Undoes a transaction from the journal.

confirm is only asked for when the run changes the admin user, the SSH server config or the firewall.

Every command before apply only reads. apply shows the plan again and asks before it changes anything, and every change it makes is journaled so rollback can undo it later.

What it promises

• Never lock you out. Root and password logins stay on until an admin user with an SSH key and sudo exists. The firewall always allows the SSH port that is actually in use.
• Prove it from a new login. Risky changes roll back on their own unless a new SSH login runs confirm in time, even if your terminal is gone or the server reboots.
• Show, then do. Nothing changes without a plan you can read. Every change is labeled reversible or partial.
• Your files stay yours. vps-ready writes its own drop-in files and never rewrites your sshd_config in place. No network calls except package installs, no telemetry, no self-update.

Checks read the live state (sshd -T, /proc/sys, apt-config, nft, ss), not a guess at what a config file means.

Start here

InstallOne command on the server, or read the script first.

Quick startThe guided setup, or audit, plan, apply, confirm and undo step by step.

How the safety net worksThe safety timer, confirm, and rollback across a reboot.

Profiles and modulesWhat minimal and web change, and how to undo each part.