levelsio reposts his VPS lockdown as hacks spread
SSH keys are not the point, he says, because the attack is coming through your app as often as your server.
levelsio reposted his VPS hardening setup with a note that everyone is getting hacked, and that if you run a VPS you should get it off the public internet and onto a Tailscale network and Cloudflare Tunnel as soon as possible. His framing is that SSH key login does not save you here, because what is being found are exploits and vulnerabilities, and AI is finding them.
It doesn't matter you have SSH key login, this is about exploits and vulnerabilities AI is finding
How do Tailscale and Cloudflare Tunnel get in then? They don't. They go outbound.
He splits the problem in two. There are two ways into a VPS, via your site or app, and via your server. For the app side he cites the PHP exploit of that week involving a file upload hack. For the server side he means things like hacking into SSH or some open port.
The three steps
The app goes behind a Cloudflare Tunnel. On the default free plan that comes with WAF security enabled, and levelsio says Cloudflare jumps on new security exploits fast. The practical effect is the one that matters. Your server does not respond to port 80 or 443 anymore, and the only way to reach the site is through the tunnel.
Server access goes onto a Tailscale network, which he describes as your own private network that nobody can access but your own devices, meaning your laptop, your phone and the VPS itself, roughly like a VPN.
Then you turn off any regular access to the VPS at the firewall. He uses Hetzner, where he creates a new firewall, empties it, and that blocks everything. His advice is to test it.
Why it holds together
The obvious question is how Tailscale and Cloudflare Tunnel still reach a box that blocks everything. They do not reach in. Both dial outbound and make a tunnel that sends and receives, so there is nothing sitting there listening for a port scanner to find. That is the whole trick, and it is why an empty firewall does not lock you out of your own machine.
levelsio is clear about the limits. The setup reduces the attack vector to Tailscale and the Cloudflare Tunnel, which he calls much safer, and then adds that it is not perfect, and nothing is.
In a follow-up he removed the last excuse. Both Cloudflare Tunnel and Tailscale are 100% free, he says, and he expects them to stay that way because both companies make money upselling big companies and enterprise.
The business read here is small. This is one founder's own configuration, not a tested benchmark, but it costs nothing to copy and the failure mode it guards against is the kind that ends a one-person software business in an afternoon.
Steal the numbers, not the vibes
One email a day. Under three minutes. Real MRR, real pricing, real launches from founders building with AI.