VPS + IA : le setup complet pour tout auto-héberger

# Connexion avec le mot de passe root fourni par l'hébergeur
ssh root@VOTRE_IP_VPS

# Première chose : mettre à jour le système
apt update && apt upgrade -y

# Créer un utilisateur avec des droits sudo
adduser deploy
usermod -aG sudo deploy

# Copier les clés SSH vers le nouvel utilisateur
mkdir -p /home/deploy/.ssh
cp ~/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

# Éditer la config SSH
nano /etc/ssh/sshd_config

# Désactiver la connexion root
PermitRootLogin no

# Désactiver l'authentification par mot de passe
PasswordAuthentication no

# Changer le port (optionnel mais recommandé)
Port 2222

# Limiter les utilisateurs autorisés
AllowUsers deploy

# Redémarrer SSH
systemctl restart sshd

# Installer et configurer UFW
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Autoriser SSH (sur le port que vous avez choisi)
sudo ufw allow 2222/tcp comment 'SSH'

# Autoriser HTTP et HTTPS (pour le reverse proxy)
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# Activer le firewall
sudo ufw enable

# Vérifier le statut
sudo ufw status verbose

Status: active

To                         Action      From
--                         ------      ----
2222/tcp                   ALLOW IN    Anywhere    # SSH
80/tcp                     ALLOW IN    Anywhere    # HTTP
443/tcp                    ALLOW IN    Anywhere    # HTTPS

# Installer fail2ban
sudo apt install fail2ban -y

# Créer la config locale
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
banaction = ufw

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400

# Démarrer fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Vérifier le statut
sudo fail2ban-client status sshd

# Installer unattended-upgrades
sudo apt install unattended-upgrades -y

# Configurer
sudo dpkg-reconfigure -plow unattended-upgrades

# Vérifier la config
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    "${distro_id}:${distro_codename}-updates";
};

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

Internet
    │
    ▼
┌─────────────┐
│  Caddy/Nginx│  ← Reverse proxy + SSL auto
│  (port 443) │
└──────┬──────┘
       │
       ├──► OpenClaw      (port 3000)  ← Agent IA
       ├──► FastAPI        (port 8000)  ← API custom
       └──► SQLite Web     (port 8080)  ← Interface DB

# Installer Node.js 20+
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

Pour aller plus loin sur ce sujet, consultez notre guide [Docker + IA : conteneuriser ses services intelligents](/article/docker-ia-conteneuriser-services).

# Installer OpenClaw
sudo npm install -g openclaw

# Vérifier l'installation
openclaw --version

# Installer Python 3.11+
sudo apt install python3.11 python3.11-venv python3-pip -y

# Créer un environnement virtuel
python3.11 -m venv /home/deploy/api-env
source /home/deploy/api-env/bin/activate

# Installer FastAPI et ses dépendances
pip install fastapi uvicorn python-dotenv httpx

# /home/deploy/api/main.py
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
import os

app = FastAPI(title="Mon API IA", version="1.0")

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://mondomaine.com"],
    allow_methods=["GET", "POST"],
    allow_headers=["*"],
)

@app.get("/health")
async def health():
    return {"status": "ok", "service": "api-ia"}

@app.get("/api/stats")
async def stats():
    # Vos métriques custom
    return {
        "uptime": "99.9%",
        "requests_today": 1337,
        "models_active": 3
    }

# Créer un service systemd
sudo tee /etc/systemd/system/fastapi.service << EOF
[Unit]
Description=FastAPI IA Service
After=network.target

[Service]
User=deploy
WorkingDirectory=/home/deploy/api
ExecStart=/home/deploy/api-env/bin/uvicorn main:app --host 127.0.0.1 --port 8000
Restart=always
RestartSec=5
EnvironmentFile=/home/deploy/api/.env

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable fastapi
sudo systemctl start fastapi

# SQLite est déjà installé sur Ubuntu, mais installons les outils
sudo apt install sqlite3 -y

# Créer votre base de données
mkdir -p /home/deploy/data
sqlite3 /home/deploy/data/app.db << 'SQL'
CREATE TABLE IF NOT EXISTS logs (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
    level TEXT NOT NULL,
    message TEXT NOT NULL,
    metadata JSON
);

CREATE TABLE IF NOT EXISTS cache (
    key TEXT PRIMARY KEY,
    value TEXT NOT NULL,
    expires_at DATETIME
);

CREATE INDEX idx_logs_timestamp ON logs(timestamp);
CREATE INDEX idx_cache_expires ON cache(expires_at);
SQL

# Installer Caddy
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy -y

mondomaine.com {
    # OpenClaw
    handle /api/claw/* {
        reverse_proxy localhost:3000
    }

    # FastAPI
    handle /api/* {
        reverse_proxy localhost:8000
    }

    # Site statique (optionnel)
    handle {
        root * /home/deploy/www
        file_server
    }

    # Headers de sécurité
    header {
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy strict-origin-when-cross-origin
    }
}

# Recharger Caddy
sudo systemctl reload caddy

sudo apt install nginx certbot python3-certbot-nginx -y

# /etc/nginx/sites-available/mondomaine.com
server {
    listen 80;
    server_name mondomaine.com;

    location /api/claw/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location / {
        root /home/deploy/www;
        index index.html;
    }
}

# Activer le site et obtenir le SSL
sudo ln -s /etc/nginx/sites-available/mondomaine.com /etc/nginx/sites-enabled/
sudo certbot --nginx -d mondomaine.com
sudo systemctl reload nginx

✅ Utilisateur non-root créé
✅ SSH par clé uniquement (mot de passe désactivé)
✅ Port SSH changé
✅ UFW activé (seuls 80, 443, SSH ouverts)
✅ Fail2ban configuré et actif
✅ Mises à jour automatiques activées
✅ Reverse proxy avec SSL (certificat valide)
✅ Services en systemd (redémarrage auto)
✅ Backups configurés (au minimum quotidiens)
✅ Monitoring basique en place

#!/bin/bash
# /home/deploy/scripts/backup.sh
BACKUP_DIR="/home/deploy/backups"
DATE=$(date +%Y-%m-%d_%H-%M)

mkdir -p "$BACKUP_DIR"

# Backup SQLite (copie atomique)
sqlite3 /home/deploy/data/app.db ".backup $BACKUP_DIR/app_$DATE.db"

# Backup configs
tar czf "$BACKUP_DIR/configs_$DATE.tar.gz" \
    /etc/caddy/Caddyfile \
    /home/deploy/api/.env \
    /etc/fail2ban/jail.local

# Rotation : garder les 7 derniers jours
find "$BACKUP_DIR" -name "*.db" -mtime +7 -delete
find "$BACKUP_DIR" -name "*.tar.gz" -mtime +7 -delete

echo "[$(date)] Backup terminé : $BACKUP_DIR"

# Ajouter au cron (tous les jours à 3h)
crontab -e
# Ajouter : 0 3 * * * /home/deploy/scripts/backup.sh >> /home/deploy/logs/backup.log 2>&1