Set up a Production-Ready Droplet

If you don’t already have a DigitalOcean account, sign up now and log in to the control panel.

Step 1: Create and Upload SSH Keys

Our recommended setup uses SSH keys for authentication when logging into Droplets because password-based authentication is less secure. After you upload your SSH public key to your DigitalOcean account, you can add it automatically to any new Droplets you create, which avoids manually adding or configuring them.

How do I do this?

If you don’t have an SSH key pair, create one using OpenSSH, which is included on Linux, macOS, and Windows Subsystem for Linux:

ssh-keygen

Your key pair is saved in the location prompted, which by default is ~/.ssh/ on Linux and /Users/your_username/.ssh on Windows and macOS. Copy the contents of your public key, which is named id_rsa.pub by default. On macOS, you can copy the key directly to your clipboard by running the following command:

pbcopy < ~/.ssh/id_rsa.pub

The Windows and Linux versions of the command depend on your specific distribution, subsystem, or command-line shell.

From the Account section, in the Security tab, find the SSH keys section. Click Add SSH Key to open the New SSH key window.

Paste your public key into the SSH key content field, give it a name, then click Add SSH Key.

Get more detail on creating and uploading SSH keys.

The following articles have more detailed explanations of this step:

How to Create SSH Keys with OpenSSH on MacOS or Linux

Use OpenSSH to create new SSH keys on MacOS, Linux, or Windows Subsystem for Linux.

How to Create SSH Keys with PuTTY on Windows

Use PuTTY to create SSH keys on Windows systems without Bash.

How to Upload SSH Public Keys to a DigitalOcean Team

Upload SSH public keys to a DigitalOcean team to make it easier to add keys to Droplets during creation.

Step 2: Create and Configure the Droplet

Our recommended setup for Droplets includes enabling several features: VPC (private networking), IPv6, monitoring, and backups.

• VPC creates a private network interface accessible only by resources within the same account or team. It’s free and increases security and decreases bandwidth costs for resources that communicate using it. Enabling it later requires manual network configuration and rebooting the Droplet.

• IPv6 enables an additional 16 IP addresses for the Droplet. It’s free and enabling it later requires manual network configuration and rebooting the Droplet.

• Monitoring is a metrics visualization service that adds additional graphs to the control panel (like CPU load, RAM usage, and disk usage) and the ability to set up alert policies. It’s free and enabling it from the start avoids manual setup and lets you understand your resource usage to make more informed decisions on when and how to scale.

• Backups are automatic, system-level disk images of Droplets taken weekly. Backups give you a way to revert a Droplet to an older state or recreate Droplets, protecting you against data loss. They add 20% to the monthly cost of the Droplet.

Our setup also uses user data, which is data that CloudInit consumes during the Droplet’s first boot to perform tasks or run scripts. The user data script in this tutorial implements two security measures:

• Disables password-based login to the Droplet, making it accessible with SSH keys only.

• Creates a sudo non-root user for day-to-day use. The root user has broad privileges that you don’t need for many tasks. Using a sudo non-root user decreases the risk of making destructive changes by accident and still lets you escalate privileges when necessary.

How do I do this?

From the control panel, click Create in the top right to open the create menu, then click Droplets to open the Droplet create page. Configure the new Droplet with the following options:

1. In Choose an image, under the OS tab, choose the latest version of Ubuntu 18.04.

2. In VPC Network, choose the default VPC.

3. In the recommended and advanced options sections, check the boxes for IPv6 and monitoring.

4. In the Advanced Options section, additionally check the box for user data. In the text box that opens, copy and paste the following cloud-config script. Customize the emphasized line to set the username.

    
        
            


#!/bin/bash
set -euo pipefail

USERNAME=sammy # TODO: Customize the sudo non-root username here

# Create user and immediately expire password to force a change on login
useradd --create-home --shell "/bin/bash" --groups sudo "${USERNAME}"
passwd --delete "${USERNAME}"
chage --lastday 0 "${USERNAME}"

# Create SSH directory for sudo user and move keys over
home_directory="$(eval echo ~${USERNAME})"
mkdir --parents "${home_directory}/.ssh"
cp /root/.ssh/authorized_keys "${home_directory}/.ssh"
chmod 0700 "${home_directory}/.ssh"
chmod 0600 "${home_directory}/.ssh/authorized_keys"
chown --recursive "${USERNAME}":"${USERNAME}" "${home_directory}/.ssh"

# Disable root SSH login with password
sed --in-place 's/^PermitRootLogin.*/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config
if sshd -t -q; then systemctl restart sshd; fi


        
    

4. In Authentication, select SSH keys, and choose one or more keys. These keys will give you access to the root user, and the user data script will add these keys to the sudo non-root user and disable password authentication.

5. In Tags, create a tag that matches what you’re using the Droplet for, like webserver. You’ll use this tag to apply cloud firewalls in the next step.

6. In the recommended options section, check the box for Enable backups.

Once you’ve selected all of the options, click Create Droplet.

Get more detail on creating Droplets.

The following articles have more detailed explanations of this step:

How to Create a Droplet

Create Droplets and customize the image, plan, authentication method, and quantity of Droplets you want.

Step 3: Create a Cloud Firewall

Firewalls place a barrier between your servers and other machines on the network to protect them from external attacks. DigitalOcean Cloud Firewalls are a free, stateful firewall service for Droplets. They block all traffic that isn’t expressly permitted by a rule.

You can apply cloud firewalls to individual Droplets by name or to one or more Droplets by tag. Our setup uses tags. When you add a tag to a cloud firewall, any Droplets with that tag are automatically included in the firewall configuration, including new Droplets that you tag during creation.

To start, we recommend the following default firewall rules:

• Restrict all inbound traffic except for SSH connections to the Droplet on port 22.

• Allow all outbound traffic to any destination on any port. Many fundamental services rely on outbound communication, and these defaults make it easier to set up a new Droplet without introducing restrictions that could cause expected problems.

In the long term, we recommend organizing firewalls by role, so you can create custom firewalls for your specific use case.

How do I do this?

From the control panel, click Create Droplet in the top right to open the create menu, then click Cloud Firewalls to open the firewall create page. Configure the cloud firewall with the following options:

1. In Name, enter inbound-ssh-only.

2. In Inbound Rules, leave the single default rule for SSH.

3. In Outbound Rules, keep the default rules, which permit all traffic to any destination on any port.

4. In Apply to Droplets, add the tag you created with the new Droplet. When you create additional Droplets, adding the same tag to them will automatically add them to this cloud firewall as well, simplifying scaling in the future.

Once you’ve selected all of the options, click Create Firewall.

Get more detail on firewall creation and rules.

The following articles have more detailed explanations of this step:

How to Create Firewalls

Create a cloud firewall to restrict network traffic to and from specified Droplets.

How to Configure Firewall Rules

Create, modify, or delete firewall rules to restrict Droplets’ inbound and outbound traffic based on ports, sources, and destinations.

How to Add and Remove Droplets from Firewalls

Add Droplets to a firewall by name or by tag to apply the firewall’s rules.

Summary

After you set up one Droplet with our recommended setup, setting up future ones is simpler because you don’t need to repeat most of the steps. You only need to complete these steps once:

• Creating an SSH key pair.
• Uploading your public key to your DigitalOcean account.
• Creating the cloud firewall.

To create additional Droplets with the same setup, the only step is choosing its configuration options on the Droplet creation page:

1. Enable the same features (VPC, IPv6, monitoring, and backups).

2. Choose your SSH key.

3. Paste the cloud-config script in user data.

4. Add the tag for the cloud firewall.

If you use doctl, the DigitalOcean command line interface, you can create a Droplet with all of these options in a single command:

doctl compute droplet create TODO-NAME --tag-names TODO-TAG-NAME \
    --image ubuntu-18-04-x64 --region nyc3 --size s-2vcpu-2gb \
    --ssh-keys TODO-KEY-FINGERPRINT --user-data-file TODO-PATH-TO-FILE \
    --enable-ipv6 --enable-monitoring --enable-private-networking --enable-backups