Transcription
Hello everyone and welcome back to the webinari channel. In today's video, we are starting our series of how we can uh deploy your servers on its cloud. And uh I will focus in this series on more fundamental uh things like preparing the the server, database optimization, website optimizations, backups, etc., etc. Because there are already plenty of tutorials how we can use it in the front end and I will just add more those fundamental things. uh in that so you can make your own decision.
I will teach you how you can use SSH and all the goodies that comes with um basically having a server because unfortunately if you are also using X excloud because you are the owner of the server and you are responsible for managing this server. So in that case you know you cannot rely on uh Excal support to help you with the server server things. Of course yes they can help you but uh you know still you are the person owning the server and you are just adding the the software on top of it. So you know you are responsible for the server. So in this series basically uh you will get confident with some basic you know system task and you will get familiar with SSH because SSH is really necessary. So I hope you like it.
So in this first video I will cover the basics before you even deploy the XCloud uh software. So stay tuned, give it a like, share it and yeah let's get started. All right.
So before we begin with our uh excloud installation, the first step is to choose your server provider. You can use vouchure, you can use any any provider that you like to use. But in my case, I seriously love to use uh headsum. The prices are cheap compared to the competition and you will get many features that are free. So you don't get any dus protection behind pay wall. You you get intuitive firewall and all other features that h provides. Yes, recently there was some pricing change but that's I guess that's normal because you know nowadays everything is going up and uh the prices for the servers and components are just skyrocketing. So I hope the bubble would burst but uh still it is one of the best provider that you can use for your server infrastructure. So if you want to use Hner you can find the link in the description. it will get you $20 credit and make sure to not use any VPN or some you know one-time email addresses because they are strict and they are checking the account so for smooth run just use any don't use any VPN so that's it okay perfect so now we are in hner vulture lenodema anywhere first thing what we need to set up is basically our project as you can see I created the xcloud tutorial project. And now what we need to do is uh go to the security and now you will need your SSH public key. And with SSH key, you know, this replaces the password which is what we want because passwords are obsolid and uh I don't like to use password for SSH into our server. So uh to get your SSH key you can use bitward and vault to generate uh SSH or one password or you can just uh uh you you can find on my channel any other tutorials that are covering the SSH. So okay I'm going to copy my public key from the Bitwarden. I put it here and excloud to and I will set that as a default key. So let's click add.
And now what we want to do is to create our firewall. And this is really important step. And I will show you later why the firewall is really important. So first thing basically is to is to whitelist xcloud infrastructure IP addresses. So let's do xcloud. Let me remove any. And uh I think it was update two months ago. They finally released the update that will allows you to whitelist specific excloud IP addresses. So you don't need to keep the port 22 open which is really great. But then there's also caveat and I will talk about those caveats later. But for now you can uh read more about how to restrict SSH access to your server. And when you scroll down, you see you can visit this link and here you got excloud infrastructure IP addresses. So just copy them, go back to your firewall and make sure they're white listed on port 22 and also just in case make sure to whitelist them on ICMP protocol so Excloud bots can ping your uh servers. Perfect. So let's do also excloud. And here comes the here comes the tricky part. So in order to SSH to your server, you will need to basically open port 22 to the public. And unfortunately with you know this whitelisting those infrastructure IP addresses on port 22 and then opening port 22 to public I just don't see reason why they do that you know it's nice they provide the static infrastructure IP addresses but what's the point you know what's the point they should but I would love to see seriously to move the excloud management and to different port. So you can you know keep your port locked down or what you can do what I will show you uh later is actually we can use uh tail scale net or if you have your dedicated VPN you can put the dedicated VPN IP address uh here so you can SSH to your server. So for now let's keep it uh any IPv4 and in the future part I'm going to show you basically how you you can completely close port 22 and how you can use tcale or any other mesh VPN for secure access to your server if you need it. So let's keep that open. SSH then let's do HTTP. We can remove IPv6 HTTPS 80 and let's do port 443 and also uh if you want to use quick UDP protocol HTTP3 HTTP3 and you will need to open port UDP and port 443 and this is the quick HTTP3 modern protocol and for now as you can see our firewall is uh ready ready to deploy and so I think we can click create and let's just name it xcloud apps let's create our firewall and our firewall is ready and we have basically six rules so we are righting the xcloud infrastructure then we are opening port 22 so we can SSH if you want I highly recommend you you you you learn SSH it's really simple and easy and without it you know you you you just need to rely on what's XCloud providing you cannot do advanced backups advanced configurations etc so let's just keep this open and then I think we are ready to deploy our server so let's click add a server and you can choose if you want cost optimize regular performance or with dedicated resources. In my case, in this tutorial, we can do just regular performance. The CPX22 standard is fine. You can choose the location. So, let me choose the Falconstein. Uh for the distribution OS image, you want Ubuntu 24.04. You can disable public IPv6. And if you want you can even create if you will have multiple servers that you want to interconnect you can interconnect them with the private network. So let's just do xcloud EU central and we will attach this private subnet to this server. Uh SSH key choose the SSH key you add. For the volumes we don't need to add any volumes. Uh firewall choose the firewall we created. You want to also enable the backups which is additional 20% cost of the server price. And what you will get, you will get daily snapshots with 7day retention. So you can easily restore the server if something goes wrong. For the placement group, uh yeah, you can also create the placement group. That means it will spread the multiple virtual machines across the server racks. So if one rag goes down, it will not affect all the servers on the cluster, but maybe only one for the labels. We don't need any labels. And here comes the the critical part, you know, the cloud config. And I already created the cloud config. So we can use as a template. And basically what cloud config is, it is the set of instruction before you create a server to harden your server, edit some things like adding your uh user username to the pseudo group. Then we we want this pseudo to be passwordless. So you don't need to use any password for pseudo commands because we locked the SSH only with your public key. though I think this is the the safest way how you can use it and you don't need to worry about any password because your private key that is securely stored in your password manager will allow you access this server securely so eliminating the the pseudo password so that's basically it and then we have uh SSH hardening so we don't want to permit root login we want to enable only pop key authentification, disable password authentification. We won't enable strict mode and you can enable you know max autism in tries max session logging race time etc etc. Then we will disable the need start prompts in the kernel settings. Then we will uh update our server. We will install an upgrades and we will configure it. uh then we will uh create some swap space. So if your server has low memory, it will automatically generate the uh swap and if your server have a lot of memory basically it it will it will create just the basic swap or it won't. Uh then we will add some uh system control flex to optimize the performance of the swappiness and the swap file. So we will do VM swappiness 10, VM dirty ratio 10 and VM data ratio background five and then we will add some disk optimization because nowadays all servers are using SSDs or NVME. So, we can add flag Nova time to our FS step. And then weekly maintenance reboot at 4:00 a.m. Sunday, the server time. I highly recommend you keep this. So, the server will reboot every Sunday 4:00 a.m. for the uh fresh performance. Some many of you you know they don't see reason why you should reboot the Linux servers but the best practice is always reboot once a week once a month you know I like it to do once a week and also I like to reboot all of my devices that I'm using like the phones and etc etc so it has always the fresh start so and don't worry this process takes less than 60 seconds to come back so there won't be any measure really seriously downtime and yeah after everything is set basically it will automatically reboot the server and we have nicely prepared our server. So what you need to do we need to copy that and you need to paste it in the cloud config in your server provider.
All right and after that we can just name the server. So, it's going to be XCloud tutorial and let's create and buy our server. And now we just need to wait couple minutes for the server to spawn and also to cloud in it to begin with our system installation, system tweaks, etc., etc. So, take a break and come back in 5 minutes and your server will be up and ready.
All right. So, our server should be up and ready. So let's just verify. Let's copy this public IP address. Let's go to your favorite terminal. In my case, I'm using Ghosty. And let's just do SSH Webestify and the IP address. And now I will authorize it with my Bitwen. And as you can see, we have our server ready to be deployed. And now I what I want to show you is uh different way how you can add your server to your Excel dashboard and why I think uh the manual method is uh the best. So let's just close this terminal and let's go to our excloud dashboard.
All right. So to add your uh new server with manual way just log into your XCloud dashboard, click add a new server and what you will see now is the the menu where you can choose basically your uh provider. So in our case uh what you want to select is any and you will need to basically copy this which will add the excloud uh public key to the root user. So let's click copy and let's go back to the terminal. Open the terminal and just elevate yourself to the root, paste this command. And basically what it do what it does it addit the the excloud uh bodex cloud to our authorized key and also probably you will need to edit fs uh not fstop sorry ATC ssh sshd config and you will need to basically allow this one time to to login as root because xcloud needs to login as a root. So permit rude login you can do yes and basically what you can do you don't need to type yes you can just do prohibit password and this you force the root login only via SSH key so you can just edit prohibit password and just do system control restart SSH SSH service and that's it let me close the terminal because this is all what we need. And now what you need to do is to type your server name. So it's going to be XCloud tutorial. Uh you can install IB but I just want to focus now on the pure basic. So we will install our server. Then you need to copy the server public IP address. You can paste the IP address here and you can select basically uh the database what you want to use. I like to use Maria DB and you can choose your web server engine open light speed. So we can just use engineix right now and uh I have the uh lifetime plan. So I have created the server on my provider and let's click create. It will verify and the installation should start right away if there is no if there are no issues.
Perfect. So since our server is starting to install now I'm going to show you the other way how you can use it. So let's open a menu in a server. Let's add a new server. And in our case now we will use basically the headser and we will use our API key. So I will I will uh add my um API key again. So let me go to the settings going to be integration server provider. I will remove this and basically now I will add API key from this project. So what you will need to do is you need to go to the security API tokens and you will generate your API token with read and write will be excloud create the API token. And now you can click to show you can copy that and you can go back to excloud add a new provider excloud tutorial and verify to save. Perfect. So now you have your API token and now you want to add a server through the built-in API integration. But there is there are a couple downsides of this and I will show you straight away. So I will connect my excloud tutorial and I will name it uh excloud uh xcloud tutorial via API. We don't choose any uptime uh any app type we will choose region server type can use this one CPX and basically we will choose also Maria DB latest Ubuntu and you want to also enable the auto backups and you understood that the billing of the server will be handled by your account but here you can see the first problem there is no firewall option which you can select. There is uh no cloud in it section and there is also no placement group. This is really why I don't like to connect my servers via API because to be honest, how many of you go back to this server a server provider and apply the firewall and other things you know I think very less you know not a few people only do that if they know so that's why I wanted to showcase this when we create the server. Let's just wait for those two servers to finish up and then we will continue.
All right. So our two servers are deployed. So now let's go back and check in our header that check our servers. Let's do servers. And this is our XCloud tutorial with API. And when we open it, as you can see, we have some texts, which is uh nice. But when we go to the firewalls, you know, is does not does not open HTTP port uh 553 uh 443 and also it does not whit list the um I mean the excloud infrastructure IP addresses and now you know this is fully open. There's nothing wrong, you know, to have your server fully open, but you need to ask yourself, uh, do you really need it? Do I really want to have my server and administration port 22 open to the public? you know as web as me as you know in this channel what I'm trying to always teach you know the best practices in security and in day-to-day life you know you don't need to keep your house doors open all the time so anyone can come in no you want limit you want to lock it down so only you have access to your servers you know so I know it's convenience over security. But I always choose uh security over convenience. And you can have convenient life even with security hardening. But that's what I'm trying to, you know, what I'm trying to uh teach you.
All right. So, uh yeah, the firewall is here. It should be fine. I was expecting it does not create a firewall, but it it does the basic one, which is good. But other things for example what we have the backups are enabled which is great but unfortunately the we cannot use cloud in it with the xcloud API server deployed via API. So basically what you need to do you need to copy uh this IP address you need to SSH and you need to do all the security hardening all the SSD optimization yourself in the server which you know for agency owners who don't know anything about the server management you know this can be really really frightening so that's why the cloud in it I created for you is just copy and paste and you are good to go.
All right. So, uh, yeah, that's that's how you can deploy your server on uh xcloud via API and also via standard manual way. And another downside uh doing the server via API is that you don't have straight away to login or SSH into your server. So for example, when you copy the password, copy the IP address, go back to the terminal. Let me open it. Exit out of this and let's clear this. Do SSH root And yeah, as you can see, uh you don't have any way to login to your server until you open the server and you go to the management and you go to the pseudo uh pseudo users and you will need to basically add your pseudo user here. Let's do test. I don't want to use password, but I will use the SSH key. Save this. Actually, you need to put password there. Copy the password. Let's save it. Now status is updating. And when we go back, let's do SSH. And we will do test. Now you can uh SSH and to use sudo to the app update you need you see you need to use uh password and when we open another terminal and let's cop uh let's do the other server SSHify at where is my chrome let's go to the server list. Copy the IP address. Go back to terminal. You can do sudo up update. And as you can see, you you you have the passwordless sudo. And uh yeah, also you have your uh sudo y. You also have your local administrative user on the server deployed manually via the cloud in it. And when we go here, so do I. As you can see here, you don't have any other user except root and xcloud user which is responsible for basically managing your web applications etc etc. So you will need to do manual manual task you know creating your uh local pseudo user editing the FS tab because we need to etc fs tab boom etc fs tab as you can see we don't have any nova time uh flex for the for the uh for the NVME and u yeah, you know, it's completely up to you how you want to go about it but I don't really personally like deeply server via API because I want to be in full control what's how the server is configured what's there etc etc so yeah that's that's I think that's it uh choice is yours how you can do it you can do it API You can do what I recommend to do via manually using my cloudinit config which you can also fully edit. You can add more users if you have multiple developers so they can so they have constant access to the server. And yeah, that's it for this and let's wrap up.
So there you have it. So now I showed you how we can uh deploy servers to excloud via the API which I don't recommend or manually via the cloud in it and all the goodies like the proper firewall backups placement groups private subnet etc etc and uh I think this way you have more control over the server. First you have your local user already ready for you. You also have some performance improvements like FS tab, no time, swappiness, etc., etc. And uh yeah, you basically you have server ready. So you don't need to do any administrative task on the server configuring all the users etc etc because the cloudinit file is basically like a blueprint for the server. You can consider it like WordPress blueprint, right? you you set what you want to do and you just clone it, copy and over and over again. So we get consistent settings across all of your infrastructure and that's why the manual deployment on XCloud or any other cloud provider it doesn't need to be excloud and with cloud in it basically you are sure that everything is working. So yeah in the next uh next part what I wanted to show you how we can harden the SSH and all the things even further because now by default you know the port 22 is open and um the XCloud infrastructure is communicating on port 22. So that's you know you can whitelist the infrastructure and open port 22 to open but I don't see the reason why you should do that when we are now in 2026 and we have so many tools available that they don't care what firewalls rules are open we can fully close that port 22 to public so in that video I'm going to show you how you can set it up using tail scale and also maybe some other tips tips and tricks. So, thank you very much for watching and stay tuned for the next one.