Going Live
From localhost to the world — agent-operated, human-approved
Overview
Your app works on your own computer. But try sending it to a friend — you can't. localhost means "this computer, right here." To everyone else in the world, your app doesn't exist. This chapter fixes that.
You'll rent a small Hetzner server, point a domain at it, and deploy your Travel Bucket List with HTTPS and automatic restarts. Your agent operates the infrastructure over SSH and calls the Cloudflare API for DNS — while you approve every destructive command and hand it only narrowly scoped credentials.
Keep a human on the destructive commands. Read each command before you approve it. Approve read-only and setup commands freely. Stop and think on anything destructive or irreversible: rm -rf, ufw enable, disabling SSH, reboot, hcloud server delete. You are the last line of review.
— from the exercise
By the end of this exercise.
- ✓A Hetzner CX23 Ubuntu 24.04 server (roughly EUR 5–7/month, billed by the hour) created with the hcloud CLI
- ✓An SSH key you created yourself, with a passphrase
- ✓A hardened server: non-root deploy user, root login disabled, UFW allowing only SSH, HTTP and HTTPS
- ✓Your app deployed behind Caddy with automatic HTTPS (Let's Encrypt)
- ✓DNS configured via the Cloudflare API, using a token scoped to one zone and kept in an environment variable
- ✓A systemd service that restarts on crash and survives a reboot
- ✓A live URL you can share with anyone in the world
Terms you'll learn.
- VPS
- Virtual Private Server — a small computer you rent in a data centre
- SSH key
- A key pair that proves who you are — the private half never leaves your machine
- Least privilege
- A deploy user instead of root, a DNS token that can edit one zone — nothing more
- Reverse proxy
- Software that sits in front of your app and handles incoming traffic
- HTTPS
- Encrypted web traffic — the padlock icon in your browser
- A record
- The most basic DNS entry — maps a domain name directly to an IP address
- systemd
- Linux's service manager — keeps your app running even after reboots
Sections in this exercise.
- 01What You'll Build
- 02What You'll Need
- 03Why Self-Host?
- 04Create Your Server
- 05The Agent SSHes In
- 06Harden the Server
- 07Deploy the App
- 08Set Up the Web Server
- 09Point Your Domain with the Cloudflare API
- 10Make It Survive Reboots
- 11Test the Full Stack
- 12Cleaning Up
The agent's role expanded. In Exercise 04 it wrote code; here it operated infrastructure — provisioning a server, SSHing in, calling APIs, managing services. Higher stakes, so you scoped its credentials tightly and kept your own hand on every destructive command.