Servers and hardening
Connect any server with the installer, or connect a Hetzner, DigitalOcean, Vultr, Akamai (Linode), Scaleway or UpCloud token and let Unrent create one. Each server has a mode that limits what it accepts, and Unrent can harden it with eight checks that you review as a plan before anything changes.
Modes
| Mode | What Unrent may do |
|---|---|
| Observe | Read inventory, status and logs. Changes nothing |
| Protect | Add backups and alerts; leave your apps alone |
| Manage | Deploy and run your apps and databases |
You choose the mode when you add the server. Lowering it works on the server itself: sudo unrent policy lower observe.
Coming Raising a server’s mode from the console, as a passkey-approved change.
Create a server on your cloud
- At your provider, create a token with read and write access: a Read & Write token in a Hetzner project for Unrent, a DigitalOcean personal access token, a Vultr API key, an Akamai Cloud personal access token (Linodes and Firewalls), a Scaleway API secret key with the Project id, or an UpCloud API token.
- In Unrent, Settings → Providers, paste the token (owners and admins). It is checked with a read call and stored encrypted; only its last four characters are shown again.
- In Servers → Create on…, pick your provider, then the location, server type and image. An SSH key is optional; with one, you can limit SSH to an address range.
- Unrent creates the provider’s firewall (web traffic on 80 and 443, ping, and SSH only if you gave a key; on UpCloud, the server’s own rules), then the server with a one-time token bound to its addresses, and follows it until the agent connects. No root password is set, mailed or kept.
Deleting a server is destructive: a developer asks, an approver confirms with a passkey. Unrent then disconnects the agent and deletes the server, the firewall and the SSH key it created.
Hardening
Supported on Ubuntu 24.04 or 26.04, or Debian 12 or 13 (amd64 or arm64).
| Check | Passes when |
|---|---|
| Firewall | ufw (if installed) or Unrent’s nftables table is active, denies incoming by default and allows the ports you need |
| SSH | No password or keyboard-interactive login; root only with a key. A lock-out guard refuses changes that would cut off your session |
| Upgrades | unattended-upgrades is installed and enabled |
| Docker | Live restore is on and container logs are capped |
| Swap | Swap is active, or the server has 2 GiB of memory or more |
| Time | chrony or systemd-timesyncd keeps the clock in sync |
| Journal | The systemd journal is limited to 2 GiB or less |
| Container ports | A container port published with docker run -p is unreachable from the internet unless it is 80, 443 or a port you allowed, and containers cannot reach the cloud metadata address. The rules hold across Docker restarts and reboots, and the Hardening tab lists each published port and whether it is reachable |
First you get a plan: every change, nothing applied. Applying it uses the plan’s digest, so what runs is what you reviewed. Every night the agent re-checks and raises a hardening_drift alert if something changed.
Coming A reboot window for kernel updates, and more distributions.
Updated . This page as Markdown.