Cloud VPS Best Practices

SSH Key Authentication

Always use SSH keys instead of passwords for authentication. SSH keys are significantly more secure and cannot be brute-forced.

# Generate a strong SSH key
ssh-keygen -t ed25519 -C "your_email@example.com"

# Disable password authentication
echo "PasswordAuthentication no" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd

See our SSH Key Management guide for details, and consider adding two-factor authentication for SSH. If you ever get locked out, see Lost SSH Access.

Firewall Configuration

Configure restrictive firewall rules using Security Groups. Follow the principle of least privilege, only opening ports that are absolutely necessary. Learn more about the cloud firewall, and add a host-level firewall with UFW or firewalld.

Regular Security Updates

Keep your system updated with the latest security patches:

# Ubuntu/Debian
sudo apt update && sudo apt upgrade -y

# CentOS/Rocky/AlmaLinux
sudo dnf update -y

# Enable automatic security updates
sudo apt install unattended-upgrades  # Ubuntu/Debian
sudo dnf install dnf-automatic        # CentOS/Rocky/Alma

Implement Fail2ban

Protect against brute-force attacks by automatically blocking suspicious IPs:

# Install Fail2ban
sudo apt install fail2ban

# Start and enable
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

See the full Fail2ban documentation, or deploy CrowdSec for collaborative, reputation-based blocking.

Use Private Networks

Keep internal communication private by using private networks. Never send sensitive data over public interfaces. For encrypted links between regions or to remote sites, see our WireGuard guide.

Choose the Right Instance Size

Don't over-provision or under-provision. Monitor your resource usage with basic resource monitoring and resize the instance as needed. Use our benchmarking guide to establish a baseline:

• • CPU: Should average 60-80% under normal load
• • RAM: Keep 10-20% free for system operations
• • Disk I/O: Monitor with iostat for bottlenecks

Optimize Disk Performance

Use modern filesystems and mount options for better performance:

# Add to /etc/fstab for better SSD performance
/dev/vda1 / ext4 defaults,noatime,discard 0 1

# For databases, consider using dedicated volumes
# Mount with appropriate options
/dev/vdb /var/lib/mysql ext4 noatime,data=writeback 0 0

See Block Storage for attaching dedicated volumes, Expanding Partitions for growing them, and Swap Partition for memory-constrained workloads. High-connection servers should also review sysctl tuning.

Implement Caching

Reduce load on your applications with caching layers:

• • Redis / Valkey: For application-level caching
• • Nginx or Caddy: For static content and reverse proxy caching
• • CDN: For global content delivery

Use Content Delivery Networks

Integrate with Cloudflare or other CDNs to cache static assets and reduce server load while improving global performance.

Follow the 3-2-1 Backup Rule

Our Backup Strategies documentation walks through applying this to cloud workloads.

Automated Backup Strategy

Implement automated backups at multiple levels:

• • Snapshots: Daily automated snapshots via Cloud Control Panel (see Backups and snapshotting without freezing)
• • Application backups: Database dumps and file backups with restic, Kopia, or Backrest
• • Offsite storage: Copy backups to Object Storage via the S3 API

Test Your Backups

Regular testing is crucial. Schedule quarterly restore tests to verify backup integrity and recovery procedures.

# Example automated backup script
#!/bin/bash
DATE=$(date +%Y%m%d)
mysqldump -u root -p$DB_PASSWORD mydb > /backups/mydb-$DATE.sql
tar -czf /backups/files-$DATE.tar.gz /var/www
# Upload to Object Storage
rclone copy /backups/ remote:backups/

Use Floating IPs for Production

Floating IPs allow you to quickly remap traffic to different instances during maintenance or failover scenarios. See the Floating IP documentation to assign one.

Implement Load Balancing

For high-availability applications, use a load balancer to distribute traffic across multiple instances. Learn more on the Load Balancers feature page, or self-host one with Traefik or Caddy.

Configure Reverse DNS

Set up proper reverse DNS records, especially for mail servers, to improve deliverability and reputation. Manage your zones with DNS Zones, review the DNS feature overview, and consult DNS troubleshooting if records aren't resolving.

Monitor Network Performance

Track bandwidth usage and network latency:

# Monitor bandwidth
iftop -i eth0

# Check network latency
mtr -r example.com

# Monitor connections
ss -s

Track monthly transfer against your bandwidth allocation, and test routes to each region from our Looking Glass. For ongoing graphs, deploy Prometheus with Grafana, or a lightweight option like Netdata or Beszel.

Right-Size Your Resources

Regularly audit and optimize your infrastructure:

• • Delete unused instances and block storage volumes
• • Remove old snapshots beyond retention period
• • Scale down over-provisioned instances
• • Consolidate low-traffic applications

Leverage Hourly Billing

Take advantage of hourly billing for development and testing environments. Important: stopping or powering off an instance does not stop billing. Instances are billed for every hour they exist, regardless of power state. To stop billing, you must delete the instance entirely.

For environments you want to preserve but stop paying for, snapshot the instance first and then delete it. You can recreate it later from the snapshot:

# Create a snapshot image of your dev instance
openstack server image create dev-instance --name dev-instance-snapshot-$(date +%Y%m%d)

# Delete the instance to stop billing
openstack server delete dev-instance

# Recreate later from the snapshot when needed
openstack server create --image dev-instance-snapshot-YYYYMMDD --flavor your-flavor dev-instance

Use Appropriate Storage

Match storage type to workload:

• • Local disk: For temporary data, caches
• • Block Storage: For persistent application data
• • Object Storage: For backups, static assets, and archives

Monitor and Alert

Set up billing alerts and usage monitoring to avoid surprises. Use the Cloud Control Panel to track spending trends.

Use Configuration Management

Implement Infrastructure as Code (IaC) for reproducible deployments:

• • Terraform: For infrastructure provisioning
• • Ansible: For configuration management (or Semaphore for a web UI)
• • Cloud-init: For initial instance setup, covered in our cloud-init guide

Implement Health Checks

Monitor application health and availability:

# Simple health check endpoint
curl -f http://localhost/health || exit 1

# Use tools like Uptime Kuma for monitoring

Deploy Uptime Kuma or Gatus for endpoint checks, and see Monitoring for platform-level metrics.

Enable Logging

Centralize logs for easier debugging and auditing:

# Send logs to centralized logging
# rsyslog configuration
*.* @@logserver.example.com:514

# Or use journald
journalctl -u myapp -f

For centralized log aggregation, deploy Grafana Loki, Vector, or Fluentd and Fluent Bit. See also Linux log file locations.

Use Environment Variables

Never hardcode credentials. Use environment variables or secret management:

# Store secrets in environment
export DB_PASSWORD="secret"
export API_KEY="key"

# Or use systemd environment files
EnvironmentFile=/etc/myapp/secrets.env

For a proper secrets backend, deploy OpenBao, or use Sealed Secrets if you run Kubernetes.

Blue-Green Deployments

Minimize downtime by maintaining two identical production environments:

1. Deploy new version to "green" environment
2. Test thoroughly
3. Switch the floating IP or load balancer to green
4. Keep blue as rollback option

Use Version Control

Track all configuration and infrastructure code in Git:

• • Store cloud-init configs
• • Version control Terraform/Ansible scripts
• • Document changes in commit messages
• • Use branches for testing changes, hosted on your own Gitea or Forgejo instance

Implement CI/CD

Automate deployment pipelines for consistency and speed:

• • Automated testing before deployment
• • Consistent deployment process
• • Easy rollback capabilities
• • Audit trail of all changes

Self-host a pipeline with Woodpecker CI, Drone CI, or Jenkins, and ship releases with Kamal, Dokku, or Coolify.

Essential DR Components

• • RPO (Recovery Point Objective): Maximum acceptable data loss (e.g., 1 hour)
• • RTO (Recovery Time Objective): Maximum acceptable downtime (e.g., 4 hours)
• • Backup verification: Regular restore testing
• • Runbook: Step-by-step recovery procedures
• • Contact list: Emergency contact information
• • Multi-region capability: Replicate snapshots and data across data center regions