Teploy

Provisioning Servers

3 min read

Teploy has no hosted control plane and doesn't create VPS instances for you — spin up a box from whichever provider you like (Hetzner, Vultr, DigitalOcean, Linode, a bare-metal box, whatever), then point teploy setup at its IP over SSH. There's no agent installed and no account to create; the CLI connects, configures the box, and moves on.

Create the VPS

Provision a server the normal way through your provider of choice — their web console, CLI, or Terraform. Any fresh Ubuntu/Debian box with SSH access works. Note the server's IP address.

Set up teploy

From your machine, with SSH access to the new server as root (or a sudo-capable user):

teploy setup 192.168.1.10 --name web1

If the server only has password auth so far (no SSH key yet):

teploy setup 192.168.1.10 --name web1 --user tyler --password

This prompts for the password once, installs your local SSH key on the server, and uses key auth for everything after.

This installs Docker, configures the firewall (opens only 80/443 and your SSH port), starts Caddy as the reverse proxy, applies security hardening (SSH hardening, fail2ban-equivalent, automatic security updates), and registers the server in ~/.teploy/servers.yml under the given --name.

Join it to a VPN mesh (Tailscale, Headscale, or Netbird) in the same step if you're running a multi-server fleet:

teploy setup 192.168.1.10 --name web1 --network tailscale --auth-key tskey-auth-...

Skip hardening (e.g. for a throwaway dev box) with --no-harden.

What's installed

  • Docker
  • Caddy (reverse proxy + automatic HTTPS), running as a container on the teploy network
  • Firewall rules limiting inbound traffic to 80, 443, and SSH
  • Security hardening: SSH config tightening, automatic security updates (skippable with --no-harden)
  • VPN mesh join, if --network was passed

Nothing runs that isn't one of these — no resident dashboard, no phone-home agent. State for deployed apps lives as plain files under /deployments/ on the server itself.

SSH access

You can SSH into your servers anytime, the same way you always could — teploy setup doesn't change how you access the box, it just prepares it for teploy deploy:

ssh root@your-server-ip

Re-running setup

teploy setup is safe to re-run against an already-configured server — it's idempotent and preserves existing state (containers, Caddy config, networks) rather than wiping the box. Useful for picking up a hardening or Caddy version update after upgrading the CLI.

On this page