Memstack Deployment Hetzner Setup

🖥️ Hetzner Setup — VPS Provisioning & Deployment

Provision a Hetzner Cloud server with security hardening, reverse proxy, SSL, database setup, monitoring, and automated backups.

Activation

When this skill activates, output:

🖥️ Hetzner Setup — Provisioning your server...

| Context | Status | |---------|--------| | User says "Hetzner", "VPS setup", "server provisioning" | ACTIVE | | User wants to deploy to a cloud server (Hetzner specifically) | ACTIVE | | User mentions SSH hardening, fail2ban, or server security | ACTIVE | | User wants Docker containerization guidance | DORMANT — see docker-setup | | User wants CI/CD pipeline (not server setup) | DORMANT — see ci-cd-pipeline | | User wants managed hosting (Railway, Netlify, Vercel) | DORMANT — see railway-deploy or netlify-deploy |

Protocol

Step 1: Gather Inputs

Ask the user for:

• Workload type: Web app, API, database, scraper, background worker?
• Expected traffic: Low ( /etc/sudoers.d/deploy

echo "=== SSH HARDENING ===" cat > /etc/ssh/sshd_config.d/hardened.conf /etc/fail2ban/jail.local /etc/apt/apt.conf.d/20auto-upgrades > /etc/fstab sysctl vm.swappiness=10 echo 'vm.swappiness=10' >> /etc/sysctl.conf fi

echo "=== KERNEL TUNING ===" cat >> /etc/sysctl.conf 85%) DISKUSAGE=$(df / | awk 'NR==2{print $5}' | sed 's/%//') if [ "$DISKUSAGE" -gt 85 ]; then echo "ALERT: Disk usage at ${DISKUSAGE}%" # Send notification (webhook, email, etc.) curl -X POST "https://hooks.slack.com/services/XXX" \ -H 'Content-Type: application/json' \ -d "{\"text\":\"🔴 Disk usage at ${DISKUSAGE}% on $(hostname)\"}" fi

Memory usage alert (>90%)

MEMUSAGE=$(free | awk '/Mem:/{printf "%.0f", $3/$2 * 100}') if [ "$MEMUSAGE" -gt 90 ]; then echo "ALERT: Memory usage at ${MEMUSAGE}%" curl -X POST "https://hooks.slack.com/services/XXX" \ -H 'Content-Type: application/json' \ -d "{\"text\":\"🟡 Memory usage at ${MEMUSAGE}% on $(hostname)\"}" fi

Check if app is responding

HTTPCODE=$(curl -s -o /dev/null -w "%{httpcode}" http://localhost:3000/health) if [ "$HTTPCODE" != "200" ]; then echo "ALERT: App health check failed (HTTP $HTTPCODE)" curl -X POST "https://hooks.slack.com/services/XXX" \ -H 'Content-Type: application/json' \ -d "{\"text\":\"🔴 App health check failed on $(hostname) — HTTP ${HTTP_CODE}\"}" fi

```bash
# Add to crontab: every 5 minutes
crontab -e
*/5 * * * * /opt/scripts/health-check.sh >> /var/log/health-check.log 2>&1

External uptime monitoring:

• UptimeRobot (free tier: 50 monitors, 5-min checks)
• Better Uptime / Hetrixtools (free alternatives)
• Monitor: HTTPS endpoint, SSL expiry, response time

Log management:

# Logrotate for application logs
cat > /etc/logrotate.d/app  "$BACKUP_DIR/appdb_${DATE}.sql.gz"

# Optional: Upload to off-site storage (Hetzner Storage Box or S3)
# rsync -avz "$BACKUP_DIR/" u123456@u123456.your-storagebox.de:backups/

# Cleanup old backups
find "$BACKUP_DIR" -type f -mtime +${RETENTION_DAYS} -delete

echo "Backup complete: appdb_${DATE}.sql.gz"

# Daily at 2 AM
0 2 * * * /opt/scripts/backup-db.sh >> /var/log/backup.log 2>&1

Off-site backup options:

• Hetzner Storage Box: Cheap, same datacenter, rsync/SFTP
• Hetzner Object Storage: S3-compatible, good for large files
• Backblaze B2: Ultra-cheap cloud storage, S3-compatible
• BorgBackup: Deduplication, encryption, efficient for incremental backups

Step 9: Hardening Checklist

Final security hardening verification:

── SERVER HARDENING CHECKLIST ─────────────

SSH:
  [x] Root login disabled
  [x] Password authentication disabled
  [x] SSH port changed from 22
  [x] Key-based auth only
  [x] MaxAuthTries set to 3
  [x] Idle timeout configured

Firewall:
  [x] UFW enabled with deny-by-default
  [x] Only required ports open (SSH, HTTP, HTTPS)
  [x] No database ports exposed

Services:
  [x] Fail2ban active on SSH
  [x] Unattended security upgrades enabled
  [x] Unused services disabled
  [x] No unnecessary packages installed

Application:
  [x] App runs as non-root user (deploy)
  [x] Environment variables for secrets (not in code)
  [x] Database listens on localhost only
  [x] Redis password set, localhost only

Monitoring:
  [x] Disk/memory/CPU alerts configured
  [x] App health check endpoint monitored
  [x] External uptime monitoring active
  [x] Log rotation configured

Backups:
  [x] Database backed up daily
  [x] Server snapshots weekly
  [x] Off-site backup configured
  [x] Backup restoration tested

Step 10: Output

Present the complete server setup:

━━━ HETZNER SERVER SETUP ━━━━━━━━━━━━━━━━━
Instance: [type] — [vCPU] vCPU, [RAM] GB RAM
Location: [datacenter]
OS: Ubuntu [version] LTS
Cost: ~$[X]/mo

── PROVISIONING SCRIPT ────────────────────
[complete setup script]

── APPLICATION DEPLOYMENT ─────────────────
Method: [Docker / Direct]
Process manager: [Docker / PM2]
Config: [ecosystem.config.js or docker-compose.yml]

── REVERSE PROXY ──────────────────────────
Server: [Caddy / Nginx]
SSL: Let's Encrypt (auto-renewal)
Config: [Caddyfile or nginx.conf]

── DATABASE ───────────────────────────────
[PostgreSQL/Redis setup]

── MONITORING ─────────────────────────────
Internal: [health check script + cron]
External: [uptime monitoring service]
Alerts: [notification channel]

── BACKUPS ────────────────────────────────
Database: Daily, [retention] days
Snapshots: Weekly, last [N] kept
Off-site: [storage solution]

── HARDENING ──────────────────────────────
[checklist with status]

── DEPLOYMENT COMMANDS ────────────────────
[quick reference for common operations]

Inputs

• Workload type and expected traffic
• Application stack (language, framework)
• Database requirements
• Domain name
• Budget preference

Outputs

• Instance type recommendation with justification
• Complete server provisioning script (SSH hardening, firewall, fail2ban, unattended upgrades)
• Application deployment (Docker or direct with PM2)
• Reverse proxy config (Caddy or Nginx) with auto-SSL
• Database setup (PostgreSQL, Redis) with security
• Monitoring script with disk/memory/app health alerts
• Backup strategy (snapshots + database dumps + off-site)
• Server hardening checklist
• Deployment quick-reference commands

Level History

• Lv.1 — Base: Hetzner instance selection matrix, full provisioning script (SSH hardening, UFW, fail2ban, unattended upgrades, swap, kernel tuning), Docker and direct deployment, Caddy/Nginx reverse proxy with auto-SSL, PostgreSQL/Redis setup, health monitoring with alerts, backup strategy (snapshots + DB dumps + off-site), hardening checklist. Based on CPX31 production experience. (Origin: MemStack v3.2, Mar 2026)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: cwinvestments
• Source: cwinvestments/memstack
• License: MIT
• Homepage: https://memstack.pro

Install and usage instructions live in the source repository linked above.