Skip to content
vops

Hosts and security

Host commands operate over SSH against inventory entries. They work on servers vops created and on machines brought from elsewhere.

Inventory

Terminal window
vops host add web-1 --address 203.0.113.10 --user root --key laptop
vops host import ovh <server-id-or-name>
vops host list
vops host show web-1
vops host remove web-1

add and remove change local inventory only. import reads a provider server and creates an inventory entry; it does not recreate the server.

Tags support small fleet operations:

Terminal window
vops host add web-2 --address 203.0.113.11 --tag production
vops host status --tag production
vops host update --tag production --list

SSH keys and sessions

Terminal window
vops ssh-key create deploy
vops ssh-key import laptop --from ~/.ssh/id_ed25519
vops ssh-key list
vops ssh-key register deploy --help
vops host ssh web-1

Private keys remain local. Import by reference records an existing path rather than copying the private key. vops host key status shows which vops-known keys are authorized on a host.

Health and updates

Terminal window
vops host status web-1
vops host update web-1 --list
vops host update web-1 --dry-run
vops host update web-1

status runs read-only probes. update --list reads pending packages without applying them. --security-only narrows an update; --reboot explicitly opts into a reboot when one is required.

Hardening

Terminal window
vops host harden web-1 --dry-run
vops host harden web-1 --user admin
vops host ssh-harden web-1
vops host ssh-harden web-1 --yes

General hardening steps are idempotent. SSH hardening has an additional lock-out preflight, verifies the user’s key and arms a timed auto-revert while the new configuration is checked.

Unified firewall

Terminal window
vops host firewall web-1
vops host firewall web-1 --allow ssh,http,https --dry-run
vops host firewall web-1 --allow ssh,http,https
vops host firewall web-1 --clear --yes

The command chooses the provider-native backend when available and the vops-managed host firewall otherwise. It also reports an existing firewall it can detect but does not own.

--clear is destructive because it leaves the host without vops-managed rules. The host engine preserves the SSH access path.

Operations key

vops distinguishes the user’s interactive key from an operations key used for bounded automation:

Terminal window
vops host key install-ops web-1 --dry-run
vops host key install-ops web-1
vops host key status web-1
vops host key revoke-ops web-1 --dry-run

Revocation verifies another access path and refuses an unsafe change unless the user deliberately overrides the guard.