ray
52 lines
2.1 KiB
Markdown
52 lines
2.1 KiB
Markdown
# OVHcloud VPS Provisioning Quirks
|
|
|
|
OVH VPS instances have specific behaviors that differ from a fresh Ubuntu install. Documenting what worked.
|
|
|
|
## Initial access
|
|
|
|
- OVH gives you an IPv4 and a root password via email. But **the password often doesn't work over SSH** — OVH may require first login via their web KVM console.
|
|
- **OVH KVM has no clipboard passthrough.** You cannot paste into the console. Type commands manually or use short one-liners.
|
|
- The default user on OVH Ubuntu images is **`ubuntu`**, not `root`. `~` expands to `/home/ubuntu/`. If you write an authorized_keys as `ubuntu` via KVM, SSH as `ubuntu@ip` — NOT `root@ip`.
|
|
- `/root/` may not exist on first boot (cloud-init hasn't created it). Run `sudo mkdir -p /root/.ssh && sudo cp ~/.ssh/authorized_keys /root/.ssh/` to enable root SSH.
|
|
|
|
## First boot issues
|
|
|
|
- **apt lock on first boot.** The cloud-init process runs apt update/upgrade on first boot, holding `/var/lib/apt/lists/lock`. Wait 60 seconds or `rm /var/lib/apt/lists/lock /var/lib/dpkg/lock` then retry.
|
|
- **OVH's Ubuntu 26.04 image ships with 4GB RAM, 38GB disk** on the smallest tier. Plenty for nginx + Tailscale + certbot.
|
|
|
|
## SSH key bootstrap (no clipboard workaround)
|
|
|
|
From the KVM console, type (no paste available):
|
|
|
|
```bash
|
|
echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host' > ~/.ssh/authorized_keys
|
|
```
|
|
|
|
Then from the Hermes server:
|
|
|
|
```bash
|
|
ssh ubuntu@<vps-ip> "sudo cp ~/.ssh/authorized_keys /root/.ssh/ && sudo chmod 600 /root/.ssh/authorized_keys"
|
|
```
|
|
|
|
After this, `ssh root@<vps-ip>` works with key auth.
|
|
|
|
## Tailscale setup
|
|
|
|
```bash
|
|
curl -fsSL https://tailscale.com/install.sh | sudo sh
|
|
sudo tailscale up --accept-routes --accept-dns=false
|
|
```
|
|
|
|
The `--accept-dns=false` flag prevents Tailscale from overriding the VPS's DNS — important if the VPS needs to resolve its own hostname for Let's Encrypt challenges. The auth URL must be opened in a browser logged into the Tailscale account.
|
|
|
|
## Firewall
|
|
|
|
OVH VPS instances have no firewall by default. Set up ufw:
|
|
|
|
```bash
|
|
sudo ufw allow 80/tcp
|
|
sudo ufw allow 443/tcp
|
|
sudo ufw allow 22/tcp
|
|
sudo ufw --force enable
|
|
```
|