VPS server configuration with cards you read and approve

What the agent can use on a VPS job

• Filesread_file, write_file, edit_file, grep, glob and list_dir work in the chat's working folder, where you keep copied configuration files, logs and notes. A counter shows files created, edited and read.
• Shellruns commands in the chosen environment, local Windows, WSL or SSH to your own server, and judges success by the real exit code, not by what the output sounds like. Dangerous commands are blocked.
• Webweb_search finds documentation and http_get reads one official page, so you can check a setting against the provider's own text.
• Screenshots and imagesocr reads text from a saved screenshot, for example an error message from a provider dashboard, and gen_image saves image files.
• Orchestrationtask runs independent checks as parallel sub-agents, run_on_model sends a hard step to a bigger model and skill stores reusable playbooks.
• Approval modesAuto-run acts at once, Ask first pauses before actions that change something and Plan only writes a plan and runs nothing.
• Cronruns a saved prompt on a schedule, for example a daily check of disk space, memory and service status that you read later.
• Modelsconnect a cloud provider through a standard API endpoint, a model running locally on your PC or the built-in model. The Test button checks an endpoint.

Four reviewed steps on a new server

Update, add a user, test key login

Start with the update, a normal user for daily work and SSH keys. People on a first VPS often ask what to do about security, and this order is the practical answer: update first, then the user, then keys, then the firewall. Portward runs your update command with Shell and shows the exit code on a card, uses write_file to save a note of each step and prepares the SSH configuration change with edit_file as a diff. Test key login from a second session before password login is switched off. Keep the first session open until that test passes. Ask first pauses before each action that changes something, so you accept 1 diff at a time and read every result. Expand a card to read the full output or the whole diff.

Open only the ports you need

A wrong firewall rule can cut off your own login, and a locked-out session cannot repair it. Portward runs your firewall command with Shell to list the current rules, reads a copy of the rules file with read_file and uses grep to find the lines for SSH and for each service you run. It then proposes one change at a time with edit_file, shown as a diff. Test the new rule. Open a second SSH session and confirm that you can still log in before you close the first one. A wrong firewall or SSH setting can lock you out, so keep both sessions open until the test passes. Allow only the ports you need and nothing else, then write the final list of open ports into your notes file with write_file.

Add file-transfer users for clients

SFTP is file transfer over SSH, so a Linux server that already allows SSH usually needs no separate server. Starting an SFTP service therefore means adding a user, a folder and a limit to the SSH service that already runs. If you want sftp setup help, Portward runs the user command you choose with Shell, reads a copy of the settings in the working folder and shows the change as a diff. Plain FTP sends passwords unencrypted and should not be used on the internet, so the examples here use SFTP only. Give each client a dedicated user, limit access to one directory and keep administrator rights away from file-transfer users. Ask first waits for your approval, and you log in as the new user from a second session to confirm the limits work.

Back up, restore and keep watch

A backup counts only when a restore works. Portward runs your backup command with Shell and reports its real exit code, then write_file records the date and the result in a log file in the working folder. The task tool can run independent checks of disk space, memory and service status as parallel sub-agents, and Cron repeats that check prompt on a schedule, so you read 3 short cards instead of logging in by hand. Restore the backup on a spare copy, read the result card and note the outcome in the log. After the first scheduled run, open the log again to see that Cron really ran the prompt. Take a snapshot or backup before every big change, and keep a written log of what the agent did: the date, the command and the result.