# OVHcloud VPS Provisioning Quirks

OVH VPS instances have specific behaviors that differ from a fresh Ubuntu install. Documenting what worked.

## Initial access

- OVH gives you an IPv4 and a root password via email. But **the password often doesn't work over SSH** — OVH may require first login via their web KVM console.
- **OVH KVM has no clipboard passthrough.** You cannot paste into the console. Type commands manually or use short one-liners.
- The default user on OVH Ubuntu images is **`ubuntu`**, not `root`. `~` expands to `/home/ubuntu/`. If you write an authorized_keys as `ubuntu` via KVM, SSH as `ubuntu@ip` — NOT `root@ip`.
- `/root/` may not exist on first boot (cloud-init hasn't created it). Run `sudo mkdir -p /root/.ssh && sudo cp ~/.ssh/authorized_keys /root/.ssh/` to enable root SSH.

## First boot issues

- **apt lock on first boot.** The cloud-init process runs apt update/upgrade on first boot, holding `/var/lib/apt/lists/lock`. Wait 60 seconds or `rm /var/lib/apt/lists/lock /var/lib/dpkg/lock` then retry.
- **OVH's Ubuntu 26.04 image ships with 4GB RAM, 38GB disk** on the smallest tier. Plenty for nginx + Tailscale + certbot.

## SSH key bootstrap (no clipboard workaround)

From the KVM console, type (no paste available):

```bash
echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host' > ~/.ssh/authorized_keys
```

Then from the Hermes server:

```bash
ssh ubuntu@<vps-ip> "sudo cp ~/.ssh/authorized_keys /root/.ssh/ && sudo chmod 600 /root/.ssh/authorized_keys"
```

After this, `ssh root@<vps-ip>` works with key auth.

## Tailscale setup

```bash
curl -fsSL https://tailscale.com/install.sh | sudo sh
sudo tailscale up --accept-routes --accept-dns=false
```

The `--accept-dns=false` flag prevents Tailscale from overriding the VPS's DNS — important if the VPS needs to resolve its own hostname for Let's Encrypt challenges. The auth URL must be opened in a browser logged into the Tailscale account.

## Firewall

OVH VPS instances have no firewall by default. Set up ufw:

```bash
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 22/tcp
sudo ufw --force enable
```