OVHcloud VPS Provisioning Quirks

OVH VPS instances have specific behaviors that differ from a fresh Ubuntu install. Documenting what worked.

Initial access

OVH gives you an IPv4 and a root password via email. But the password often doesn't work over SSH — OVH may require first login via their web KVM console.
OVH KVM has no clipboard passthrough. You cannot paste into the console. Type commands manually or use short one-liners.
The default user on OVH Ubuntu images is ubuntu, not root. ~ expands to /home/ubuntu/. If you write an authorized_keys as ubuntu via KVM, SSH as ubuntu@ip — NOT root@ip.
/root/ may not exist on first boot (cloud-init hasn't created it). Run sudo mkdir -p /root/.ssh && sudo cp ~/.ssh/authorized_keys /root/.ssh/ to enable root SSH.

First boot issues

apt lock on first boot. The cloud-init process runs apt update/upgrade on first boot, holding /var/lib/apt/lists/lock. Wait 60 seconds or rm /var/lib/apt/lists/lock /var/lib/dpkg/lock then retry.
OVH's Ubuntu 26.04 image ships with 4GB RAM, 38GB disk on the smallest tier. Plenty for nginx + Tailscale + certbot.

SSH key bootstrap (no clipboard workaround)

From the KVM console, type (no paste available):

echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host' > ~/.ssh/authorized_keys

Then from the Hermes server:

ssh ubuntu@<vps-ip> "sudo cp ~/.ssh/authorized_keys /root/.ssh/ && sudo chmod 600 /root/.ssh/authorized_keys"

After this, ssh root@<vps-ip> works with key auth.

Tailscale setup

curl -fsSL https://tailscale.com/install.sh | sudo sh
sudo tailscale up --accept-routes --accept-dns=false

The --accept-dns=false flag prevents Tailscale from overriding the VPS's DNS — important if the VPS needs to resolve its own hostname for Let's Encrypt challenges. The auth URL must be opened in a browser logged into the Tailscale account.

Firewall

OVH VPS instances have no firewall by default. Set up ufw:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 22/tcp
sudo ufw --force enable

2.1 KiB Raw Blame History