Deploy SmolAgents on a RamNode VPS

adduser --disabled-password --gecos "" agent
usermod -aG sudo agent
rsync --archive --chown=agent:agent ~/.ssh /home/agent

sudo apt update && sudo apt -y upgrade
sudo apt -y install build-essential ca-certificates curl gnupg lsb-release \
  git ufw fail2ban unattended-upgrades \
  python3.12 python3.12-venv python3-pip python3-dev

# /etc/ssh/sshd_config.d/99-hardening.conf
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
AuthenticationMethods publickey
AllowUsers agent

sudo systemctl reload ssh
sudo ufw default deny incoming && sudo ufw default allow outgoing
sudo ufw allow 22/tcp && sudo ufw allow 80/tcp && sudo ufw allow 443/tcp
sudo ufw enable

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update
sudo apt -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo usermod -aG docker agent

{
  "log-driver": "json-file",
  "log-opts": {"max-size": "10m", "max-file": "3"},
  "default-ulimits": {"nofile": {"Name": "nofile", "Hard": 4096, "Soft": 4096}},
  "no-new-privileges": true,
  "icc": false,
  "userland-proxy": false
}

sudo systemctl restart docker
docker run --rm hello-world

sudo mkdir -p /opt/smolagents && sudo chown agent:agent /opt/smolagents
cd /opt/smolagents
python3.12 -m venv .venv && source .venv/bin/activate
pip install --upgrade pip wheel
pip install "smolagents[toolkit,litellm,docker,mcp]" fastapi uvicorn python-dotenv
pip freeze > requirements.txt

HF_TOKEN=hf_xxx
OPENAI_API_KEY=sk-xxx
ANTHROPIC_API_KEY=sk-ant-xxx

chmod 600 /opt/smolagents/.env

import os
from contextlib import asynccontextmanager
from typing import Optional
from dotenv import load_dotenv
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel, Field
from smolagents import CodeAgent, WebSearchTool, LiteLLMModel

load_dotenv("/opt/smolagents/.env")
MODEL_ID = os.environ.get("SMOLAGENTS_MODEL_ID", "anthropic/claude-sonnet-4-5")
MAX_STEPS = int(os.environ.get("SMOLAGENTS_MAX_STEPS", "8"))
EXECUTOR = os.environ.get("SMOLAGENTS_EXECUTOR", "docker")

class RunRequest(BaseModel):
    task: str = Field(..., min_length=1, max_length=4000)
    max_steps: Optional[int] = Field(default=None, ge=1, le=20)

class RunResponse(BaseModel):
    result: str; steps_used: int

@asynccontextmanager
async def lifespan(app: FastAPI):
    app.state.model = LiteLLMModel(model_id=MODEL_ID)
    yield

app = FastAPI(lifespan=lifespan, title="SmolAgents Service")

@app.get("/health")
def health(): return {"status": "ok", "model": MODEL_ID, "executor": EXECUTOR}

@app.post("/run", response_model=RunResponse)
def run(req: RunRequest):
    try:
        with CodeAgent(tools=[WebSearchTool()], model=app.state.model,
                       executor_type=EXECUTOR, max_steps=req.max_steps or MAX_STEPS) as agent:
            result = agent.run(req.task)
            return RunResponse(result=str(result), steps_used=len(agent.memory.steps))
    except Exception as exc:
        raise HTTPException(status_code=500, detail=str(exc))

[Unit]
Description=SmolAgents FastAPI service
After=network-online.target docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
User=agent
Group=agent
WorkingDirectory=/opt/smolagents
EnvironmentFile=/opt/smolagents/.env
ExecStart=/opt/smolagents/.venv/bin/uvicorn app:app \
  --host 127.0.0.1 --port 8000 --workers 2 \
  --proxy-headers --forwarded-allow-ips=127.0.0.1
Restart=on-failure
RestartSec=5

NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/opt/smolagents
ProtectKernelTunables=true

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now smolagents
journalctl -u smolagents -f

sudo apt -y install nginx certbot python3-certbot-nginx

server {
  listen 80;
  server_name agents.example.com;
  location / { return 301 https://$host$request_uri; }
}
server {
  listen 443 ssl http2;
  server_name agents.example.com;
  ssl_certificate     /etc/letsencrypt/live/agents.example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/agents.example.com/privkey.pem;

  client_max_body_size 1m;
  proxy_read_timeout 300s;

  if ($http_x_agent_key != "REPLACE_WITH_LONG_RANDOM_STRING") { return 403; }

  location / {
    proxy_pass http://127.0.0.1:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}

sudo ln -s /etc/nginx/sites-available/smolagents.conf /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d agents.example.com --redirect