Prompt: provision a cloud server at a hostname, hardened
Have an agent create an ird VPS (EU, billed hourly from credits), anchor
it at a hostname on your domain, and run a sensible first-boot hardening
— updates, firewall, non-root user, optional Docker — with the cost
stated before anything is created.
Needs: ird access (MCP server or the ird CLI, logged in); an SSH key uploaded to the account (ird vps ssh-keys add, or the web panel — the MCP server cannot upload keys); a shell with ssh
Costs: hourly per tier (vps_tiers; credits_prices → recurring.vps-hourly), plus snapshots/volumes if used
Group: servers
Paste everything below the line into a fresh conversation. Fill in the
FILL IN block first.
Task
Create one server as specified, anchor it at SUBDOMAIN.ZONE, harden it,
and hand me a ready-to-use SSH line. Confirm the monthly price with me
first.
FILL IN
NAME: app-1
ZONE: example.ro # zone hosted on ird DNS (blank = no DNS anchor)
SUBDOMAIN: app # server lives at app.example.ro
NEED: 2 vCPU, 4 GB RAM, ~40 GB disk, for a Node app + Postgres # the agent picks the tier
IMAGE: latest Debian # or Ubuntu LTS, or a snapshot id
SSH_KEY: laptop # name or id from `ird vps ssh-keys`
ADMIN_USER: deploy # non-root user to create
DOCKER: yes
OPEN_PORTS: 22, 80, 443
Non-negotiable rules
- Price before create. Pick the smallest tier in
vps_tiers that
meets NEED, show vCPU/RAM/disk, the hourly price and hourly × 730 as a
monthly figure, and wait for a yes.
- Create once.
vps_create blocks until provisioning finishes. Don't
retry on a timeout — check vps_list first; a second call means a
second server being billed.
- Destroy is irreversible and takes the disk with it. Never call
vps_destroy unless I name the server id in chat.
- SSH key from the account only. If SSH_KEY isn't in
ird vps ssh-keys, stop and tell me to add it (ird vps ssh-keys add);
never paste private keys anywhere.
Steps
A. Choose. vps_tiers (CLI: ird vps tiers) → tier for NEED.
ird vps images → image id for IMAGE. ird vps ssh-keys → key id.
dns_list_zones must include ZONE if set. credits_balance should cover
at least a month; say if it doesn't.
B. Confirm with me (tier, image, hostname, monthly cost).
C. Create.
vps_create(name=NAME, tier_id, image_ref, ssh_key_ids=[id], zone=ZONE, subdomain=SUBDOMAIN)
(CLI: ird vps create NAME --tier … --image … --ssh-key … --zone ZONE --subdomain SUBDOMAIN).
The A record for SUBDOMAIN.ZONE is written after provisioning. Read the
public IP from the result / vps_list.
D. First login. ssh root@<ip> (or SUBDOMAIN.ZONE once
dig +short answers). Accept the host key after showing me the
fingerprint.
E. Harden (Debian/Ubuntu; adapt if IMAGE differs):
apt-get update && apt-get -y upgrade; install unattended-upgrades
and enable it.- Create ADMIN_USER with sudo, copy
/root/.ssh/authorized_keys to it.
sshd_config: PasswordAuthentication no, PermitRootLogin
prohibit-password (keep root-by-key until ADMIN_USER login is
verified, then no). Restart sshd only after a second session as
ADMIN_USER works.- Firewall:
ufw default deny incoming; allow OPEN_PORTS; enable.
- If DOCKER: install Docker from Docker's apt repo, add ADMIN_USER to
the
docker group.
- Set the hostname to
SUBDOMAIN.ZONE; timezone UTC.
F. Snapshot the clean state (optional, ask):
ird vps snapshot NAME base-hardened — bills per GB-hour
(recurring.image-hourly).
G. Verify. vps_list shows NAME running with the IP;
dig +short SUBDOMAIN.ZONE = IP; ssh ADMIN_USER@SUBDOMAIN.ZONE sudo true
works and ssh root@… with password is refused; ufw status lists only
OPEN_PORTS; docker run --rm hello-world if DOCKER.
H. Lifecycle notes for me. vps_power for restart/shutdown (a
shut-down server still bills); vps_destroy(instance_id) stops billing
and deletes everything, DNS record included.
Deliverable
Server id, name, tier, IP, hostname, the SSH line, what was hardened,
open ports, snapshot id if taken, hourly and monthly cost, and the exact
destroy command for later.