# vps_setup is a working notebook of Linux server commands

> hongwenjun/vps_setup is a personal collection of shell snippets and operational notes for cheap VPS instances, covering swap files, service trimming, log analysis, certificate renewal and ssh keepalive, with no package, no licence file and a default branch named remove.

**hongwenjun/vps_setup** — linux  vim bash 脚本学习笔记 by 蘭雅sRGB   https://262235.xyz/

- Repository: https://github.com/hongwenjun/vps_setup
- Website: https://262235.xyz/
- Stars: 859 · Forks: 458
- Language: Python
- License: not declared
- Published: 2026-10-20 · Updated: 2026-10-20 · Language: en
- Canonical page: https://hysenlabs.com/projects/hongwenjun-vps-setup

## This is a notebook of commands, not a tool you install

The repository describes itself as Linux, vim and bash script learning notes, and the directory layout confirms that reading. The top level holds Arch/, cloud/, debian/, docker/, mysql/, sqlite/, vscode/, zfaka/ and bitmonero/ directories alongside the README, and there is no package manifest, no build system and no entry point. What you get is a body of text with fenced command blocks, and the value is that each block is a thing that was run rather than a thing that was designed. The audience is the individual operator on a cheap virtual private server, the kind of person with a 512MB instance that runs out of memory during a Docker build. The linked site at 262235.xyz is where the longer articles live, with entries on cross compiling for RISC-V, on building a static site with Hugo, on running Linux Deploy on an old phone, and on deploying a Synology NAS tool, so the repository is the index and the site is the writing.

## The swap recipe exists because a 420MB instance cannot run Docker

The most detailed recipe in the notes is about a Microsoft B1ls instance given 420MB of memory, where the author notes that Docker crashes and virtual memory is the only option. The sequence creates a 1GB swap file with fallocate, restricts it with chmod 600, formats it with mkswap, activates it with swapon, and then appends the mount to /etc/fstab so it survives a reboot.

```bash
fallocate -l 1G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

echo "/swapfile swap swap defaults 0 0"  >>  /etc/fstab
```

The same block also adjusts two kernel parameters in /etc/sysctl.conf, setting vm.min_free_kbytes to 18600 and vm.swappiness to 5, and applies them with sysctl -p. Low swappiness is the standard choice on a machine that relies on swap for survival rather than for convenience, since it keeps the kernel from eagerly pushing pages out. The whole recipe is four lines of substance, but it is the difference between a Docker daemon starting and not starting on that hardware.

## Disabling the cloud agent daemons is the other half of the memory fix

The other half of the low-memory work is deleting services that exist for the provider rather than for you. The notes list a set of systemctl disable commands for the Google cloud agent daemons, then a second group covering unattended-upgrades, fail2ban, rsyslog, cron and the getty units.

```bash
systemctl | grep running

systemctl disable   google-accounts-daemon.service
systemctl disable   google-clock-skew-daemon.service
systemctl disable   google-network-daemon.service
systemctl disable   google-osconfig-agent.service

systemctl disable  unattended-upgrades.service
systemctl disable  fail2ban
systemctl disable  rsyslog
systemctl disable  cron
systemctl disable  getty@tty2.service
systemctl disable  console-getty.service
```

The first command in the block is the diagnostic, listing running units so you can see what is actually consuming memory. The rest are the cuts. This is where the notes need reading rather than copying. Disabling the Google agents is specific to GCP and Azure images and does nothing on another provider. Disabling unattended-upgrades and fail2ban removes security patching and brute force protection, and disabling rsyslog removes your login audit trail, which then makes the log analysis recipe in the next section much less useful. Disabling cron on a machine that still needs scheduled jobs is another trap. The notes are honest that these are optimisations for a throwaway backup box, and the surrounding comment says as much, but that caveat is not repeated next to every line.

## Counting who is scanning you is a grep pipeline, not a tool

One of the more reusable pieces is a one-liner for extracting addresses from a log and counting them, piped through sort and uniq and then sorted by count.

```bash
grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq -c| sort -nrk 1
```

The notes apply it to three sources. One counts the address distribution in a udp2raw log, described as tracking how the ISP addresses of a home connection change over time. Another counts the addresses appearing in /var/log/auth.log, described as finding which IPs are scanning the server, and a third points at an external lookup page for resolving a single address. The mechanism is straightforward: the -oE expression prints only the matching part of each line, uniq -c counts duplicates, and sort -nrk 1 orders by that count in descending numeric order. Worth knowing that the regular expression is deliberately loose, matching any four groups of one to three digits, without checking that each octet is in range, so it will happily match parts of longer strings,, and disabling rsyslog in the previous recipe removes the very log it reads.

## Certificate renewal is acme.sh with a webroot and an nginx variant

The notes show the acme.sh route to free certificates, with the socat and netcat dependencies installed and the tool fetched from its own installer, then a domain variable and an issue command using the webroot mode with ec-256 key type and the force flag.

```bash
apt-get install socat netcat -y
curl  https://get.acme.sh | sh

DOMAIN=ssl.srgb888.ga

~/.acme.sh/acme.sh  --issue -d ${DOMAIN}  --webroot  /var/www/html --standalone -k ec-256 --force
```

A single line follows for the nginx case.

```bash
~/.acme.sh/acme.sh  --issue -d ssl.srgb888.ga  --nginx  --standalone -k ec-256 --force
```

The webroot variant assumes the document root is /var/www/html and the standalone variant means the certificate is served over a temporary listener, which is why socat is installed. The nginx variant lets acme.sh place the challenge itself. Two things are worth flagging for anyone copying this. The domain is a placeholder that has to change, and the install step pipes a remote script straight into a shell, which is a habit worth avoiding when you can read the script first.

## Three ways to keep an ssh session from dropping

The ssh section gives three approaches to keepalive, which is a good illustration of a personal notes file covering more than one answer to the same question. The first changes the server side, setting ClientAliveInterval to 60 and ClientAliveCountMax to 3 in sshd_config and reloading the daemon. The second changes the client side, adding ServerAliveInterval and ServerAliveCountMax to ssh_config, for the case where you cannot edit the server. The third sets the option per command with ssh -o ServerAliveInterval=60, described as the way to keep only the connections that need it persistent.

```bash
systemctl reload sshd
```

The distinction between the two directions is the part that matters. ClientAliveInterval makes the server probe the client, and ServerAliveInterval makes the client probe the server, and only one of them prevents a given side from being dropped by an idle timeout on the other. The per-command form is the least invasive, and it is the one to reach for first when only one tunnel needs to survive.

## Why this cannot be adopted as infrastructure

The honest limit of the repository is that nothing in it is pinned. There are no version tags, no releases, and the licence field is empty with no licence file in the tree, so the default branch is named remove. That last detail is worth pausing on, since it suggests the working content sits on a branch other than the one a clone lands on. The linked scripts are distributed through short links, which means the command you run today is not pinned to the code that was reviewed, and the crontab examples include a pattern that fetches a remote script and pipes it into bash on a schedule. That pattern is the clearest argument for treating the whole repository as a journal rather than a dependency. There is also no test suite, no CI configuration and no structure that would let you apply part of it reproducibly. The right way to use it is to read it, pick the two or three recipes that match your situation, and rewrite them into your own provisioning with the values filled in and the risky parts removed.

## Conclusion

vps_setup suits an individual operator who wants a concrete record of what they actually typed on a small VPS, and it is a useful catalogue of the memory and service problems that appear on cheap instances with a few hundred megabytes of RAM. It is the wrong tool for a team that needs reproducible infrastructure, because nothing in the repository is versioned, packaged or tested, and it is the wrong tool for a base image you intend to rebuild, because several notes depend on a specific provider's agent daemons. Before copying anything from it, check whether the memory assumptions still hold for your instance size, replace any curl or wget piped straight into a shell with a version you have read, and confirm what a disabled service was doing for you, since fail2ban, unattended-upgrades and rsyslog are all on the disable list. The last push was on 2026-09-06, and the repository lists no licence.

## FAQ

### What is the hongwenjun/vps_setup repository?

It is a personal collection of Linux, vim and bash learning notes and command snippets for setting up and maintaining VPS servers. The top level is organised into directories such as cloud/, debian/, docker/, mysql/ and vscode/, and there is no package to install.

### How do I add swap to a small VPS using the notes in vps_setup?

The notes create a 1GB swap file with fallocate, set permissions with chmod 600, format it with mkswap, activate it with swapon, and append the mount line to /etc/fstab. They also lower vm.swappiness to 5 in /etc/sysctl.conf and apply it with sysctl -p.

### Which services does vps_setup disable to free memory?

The notes disable the Google cloud agent daemons, unattended-upgrades, fail2ban, rsyslog, cron, getty@tty2.service and console-getty.service. The first group applies to GCP and Azure images specifically.

### How do I renew an SSL certificate with acme.sh as shown in vps_setup?

The notes install socat and netcat, install acme.sh, set a DOMAIN variable, and run the issue command with the webroot option pointing at /var/www/html, the standalone option, the ec-256 key type and the force flag. A one line variant uses the nginx option instead of the webroot.

## Sources

- [hongwenjun/vps_setup on GitHub](https://github.com/hongwenjun/vps_setup)
- [Issues](https://github.com/hongwenjun/vps_setup/issues)
- [Project website](https://262235.xyz/)
- [README](https://github.com/hongwenjun/vps_setup/blob/remove/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/hongwenjun-vps-setup