VPS + IA : le setup complet pour tout auto-héberger

# Connect with the root password provided by your host
ssh root@VOTRE_IP_VPS

# First thing: update the system
apt update && apt upgrade -y

# Create a user with sudo rights
adduser deploy
usermod -aG sudo deploy

# Copy SSH keys to the new user
mkdir -p /home/deploy/.ssh
cp ~/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

# Edit SSH config
nano /etc/ssh/sshd_config

# Disable root login
PermitRootLogin no

# Disable password authentication
PasswordAuthentication no

# Change port (optional but recommended)
Port 2222

# Limit authorized users
AllowUsers deploy

# Restart SSH
systemctl restart sshd

# Install and configure UFW
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (on the port you chose)
sudo ufw allow 2222/tcp comment 'SSH'

# Allow HTTP and HTTPS (for reverse proxy)
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# Enable firewall
sudo ufw enable

# Check status
sudo ufw status verbose

Status: active

To                         Action      From
--                         ------      ----
2222/tcp                   ALLOW IN    Anywhere    # SSH
80/tcp                     ALLOW IN    Anywhere    # HTTP
443/tcp                    ALLOW IN    Anywhere    # HTTPS

# Install fail2ban
sudo apt install fail2ban -y

# Create local config
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
banaction = ufw

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400

# Start fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Check status
sudo fail2ban-client status sshd

# Install unattended-upgrades
sudo apt install unattended-upgrades -y

# Configure
sudo dpkg-reconfigure -plow unattended-upgrades

# Check config
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    "${distro_id}:${distro_codename}-updates";
};

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

Internet
    │
    ▼
┌─────────────┐
│  Caddy/Nginx│  ← Reverse proxy + SSL auto
│  (port 443) │
└──────┬──────┘
       │
       ├──► OpenClaw      (port 3000)  ← Agent IA
       ├──► FastAPI        (port 8000)  ← API custom
       └──► SQLite Web     (port 8080)  ← Interface DB

# Install Node.js 20+
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

# Install OpenClaw
sudo npm install -g openclaw

# Verify installation
openclaw --version

# Install Python 3.11+
sudo apt install python3.11 python3.11-venv python3-pip -y

# Create a virtual environment
python3.11 -m venv /home/deploy/api-env
source /home/deploy/api-env/bin/activate

# Install FastAPI and dependencies
pip install fastapi uvicorn python-dotenv httpx

# /home/deploy/api/main.py
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
import os

app = FastAPI(title="Mon API IA", version="1.0")

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://mondomaine.com"],
    allow_methods=["GET", "POST"],
    allow_headers=["*"],
)

@app.get("/health")
async def health():
    return {"status": "ok", "service": "api-ia"}

@app.get("/api/stats")
async def stats():
    # Vos métriques custom
    return {
        "uptime": "99.9%",
        "requests_today": 1337,
        "models_active": 3
    }

# Create a systemd service
sudo tee /etc/systemd/system/fastapi.service << EOF
[Unit]
Description=FastAPI IA Service
After=network.target

[Service]
User=deploy
WorkingDirectory=/home/deploy/api
ExecStart=/home/deploy/api-env/bin/uvicorn main:app --host 127.0.0.1 --port 8000
Restart=always
RestartSec=5
EnvironmentFile=/home/deploy/api/.env

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable fastapi
sudo systemctl start fastapi

# SQLite is already installed on Ubuntu, but let's install the tools
sudo apt install sqlite3 -y

# Create your database
mkdir -p /home/deploy/data
sqlite3 /home/deploy/data/app.db << 'SQL'
CREATE TABLE IF NOT EXISTS logs (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
    level TEXT NOT NULL,
    message TEXT NOT NULL,
    metadata JSON
);

CREATE TABLE IF NOT EXISTS cache (
    key TEXT PRIMARY KEY,
    value TEXT NOT NULL,
    expires_at DATETIME
);

CREATE INDEX idx_logs_timestamp ON logs(timestamp);
CREATE INDEX idx_cache_expires ON cache(expires_at);
SQL

# Install Caddy
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy -y

mondomaine.com {
    # OpenClaw
    handle /api/claw/* {
        reverse_proxy localhost:3000
    }

    # FastAPI
    handle /api/* {
        reverse_proxy localhost:8000
    }

    # Static site (optional)
    handle {
        root * /home/deploy/www
        file_server
    }

    # Security headers
    header {
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy strict-origin-when-cross-origin
    }
}

# Reload Caddy
sudo systemctl reload caddy

sudo apt install nginx certbot python3-certbot-nginx -y

# /etc/nginx/sites-available/mondomaine.com
server {
    listen 80;
    server_name mondomaine.com;

    location /api/claw/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location / {
        root /home/deploy/www;
        index index.html;
    }
}

# Enable the site and get SSL
sudo ln -s /etc/nginx/sites-available/mondomaine.com /etc/nginx/sites-enabled/
sudo certbot --nginx -d mondomaine.com
sudo systemctl reload nginx

✅ Non-root user created
✅ SSH key-only (password disabled)
✅ SSH port changed
✅ UFW enabled (only 80, 443, SSH open)
✅ Fail2ban configured and active
✅ Automatic updates enabled
✅ Reverse proxy with SSL (valid certificate)
✅ Services in systemd (auto-restart)
✅ Backups configured (at minimum daily)
✅ Basic monitoring in place

#!/bin/bash
# /home/deploy/scripts/backup.sh
BACKUP_DIR="/home/deploy/backups"
DATE=$(date +%Y-%m-%d_%H-%M)

mkdir -p "$BACKUP_DIR"

# Backup SQLite (copie atomique)
sqlite3 /home/deploy/data/app.db ".backup $BACKUP_DIR/app_$DATE.db"

# Backup configs
tar czf "$BACKUP_DIR/configs_$DATE.tar.gz" \
    /etc/caddy/Caddyfile \
    /home/deploy/api/.env \
    /etc/fail2ban/jail.local

# Rotation: keep last 7 days
find "$BACKUP_DIR" -name "*.db" -mtime +7 -delete
find "$BACKUP_DIR" -name "*.tar.gz" -mtime +7 -delete

echo "[$(date)] Backup terminé : $BACKUP_DIR"

# Add to cron (every day at 3am)
crontab -e
# Ajouter : 0 3 * * * /home/deploy/scripts/backup.sh >> /home/deploy/logs/backup.log 2>&1