Home / VPS / Site setup

VPS & site setup: one server plus a static site is enough to start

Do not buy a pile of services at the start. The starter stack is two pieces: one annual VPS for anything that must run continuously, and Cloudflare Pages for every static page. This site (go.sweetai.work) shipped on exactly the flow below.

What the VPS is for

• Your own services and automation: scheduled jobs, data processing, a small backend.
• A self-hosted network exit (proxy), giving you one fixed, clean overseas IP environment.
• A fallback host and monitoring point for your landing pages and tools.

We use RackNerd's annual plans: pricing moves with promotions, so this page prints no figure — check the official site order page when you buy. Selection rules: location in the region your users and platforms are in; 1–2GB RAM is enough to start; pay monthly first to validate the route, then switch to annual.

Static site deploy: Cloudflare Pages in four steps

1. Generate static files locally into dist/ (this site: one zero-dependency Python script builds all pages).
2. Install wrangler and prepare an API token scoped to Pages editing only.
3. Deploy (commands below).
4. Bind the custom domain in the Pages project; DNS gets a CNAME in the same Cloudflare zone, SSL is issued automatically. Then verify the whole site as a visitor.

# 1. build your static files into dist/
python3 build.py

# 2. deploy to Cloudflare Pages (replace the project name)
export CLOUDFLARE_ACCOUNT_ID=<your-account-id>
export CLOUDFLARE_API_TOKEN=<pages-edit-token>
npx wrangler@3 pages deploy dist --project-name <your-project> --branch main

# 3. verify what a visitor sees
curl -I https://<your-domain>/

Keep the token scoped and stored like a password — Pages-edit only, never a global API key, and never committed to the repository.

Domain and DNS order

Move the domain's DNS to Cloudflare first, then build: adding subdomains, binding Pages and managing records all happen in one panel instead of shuttling between registrar and host. All our sites start as subdomains of sweetai.work — zero extra domain spend — and only earn a standalone domain once the traffic proves out.

Security baseline for the VPS (do this before anything else runs)

1. Key-only SSH. Add your public key to the server's authorized keys, confirm a key login works in a second session, then set PasswordAuthentication no in the SSH daemon config and restart SSH. Never disable passwords before the key login is proven.
2. Updates on. Apply system updates at setup and enable automatic security updates where your distribution offers them; an unpatched hobby server is the most common kind of compromised server.
3. Firewall: default deny, open only what you use. Allow SSH and the web ports your setup actually serves (typically 80/443); everything else stays closed. Every extra open port is attack surface with no upside.
4. Least privilege everywhere. Deploy tokens scoped per service (like the Pages-only token above), no shared root passwords, nothing sensitive sitting in the web root.