---
name: al-288-take-the-server-your-ai-agent-runs-on-off-the-public-inte
description: "Lots of people now run AI agents around the clock on a rented server (a VPS). On Oct 23, 2026, as reports of hacks spread, Pieter Levels (@levelsio) reposted his advice to get any VPS off the public internet and into a Tailscale network and Cloudflare Tunnel, noting that SSH key login alone doesn't protect you from exploits and vulnerabilities; the post drew hundreds of thousands of views and thousands of bookmarks. This prompt has an AI walk you through it step by step, checking each step before you close the old door so you don't lock yourself out. Use when the user wants help with agent server lockdown (security) for a small business."
---

# Take the server your AI agent runs on off the public internet: put it behind Tailscale or a Cloudflare Tunnel so only you can reach it

Lots of people now run AI agents around the clock on a rented server (a VPS). On Oct 23, 2026, as reports of hacks spread, Pieter Levels (@levelsio) reposted his advice to get any VPS off the public internet and into a Tailscale network and Cloudflare Tunnel, noting that SSH key login alone doesn't protect you from exploits and vulnerabilities; the post drew hundreds of thousands of views and thousands of bookmarks. This prompt has an AI walk you through it step by step, checking each step before you close the old door so you don't lock yourself out.

## Inputs to collect first
Ask the user for anything below that they haven't already given you. Don't guess missing facts.

- Provider, e.g. Hetzner/DigitalOcean
- OS, e.g. Ubuntu 24.04
- SSH on a public IP / a public web address
- , e.g. agent dashboard on port 3000, n8n on 5678

## Instructions

Do the task below with the user's inputs in place of each [bracket].

I run an AI agent (or other apps) on a rented Linux server: [provider, e.g. Hetzner/DigitalOcean], [OS, e.g. Ubuntu 24.04]. Right now I reach it by [SSH on a public IP / a public web address]. Services on it: [list, e.g. agent dashboard on port 3000, n8n on 5678]. Help me take it off the public internet using Tailscale for my own access and, only if something must stay public, a Cloudflare Tunnel. Give me one step at a time with the exact command, what I should see if it worked, and wait for me to confirm before the next step. Order it so I can't lock myself out: install and test Tailscale access first, then close public ports in the firewall last, and tell me how to get back in through my provider's web console if something goes wrong. Finish with a short checklist to confirm nothing is still reachable from the public internet. Don't ask me for passwords or keys; tell me where to enter them myself.

## Safety checks (share these with the user)

- Read and edit the draft before it reaches a customer or goes public. If you later automate this prompt, start with "draft and notify me", not "send automatically".
- Check names, dates, numbers and any claim against your own source material before you use the answer. AI can misread or invent details.
- Say clearly which parts need a person to review or approve before anything is sent, paid, posted or filed.

## About this skill

- Works with: Tailscale, Cloudflare Tunnel, ChatGPT, Claude
- Based on this real-world example: https://x.com/levelsio/status/2113587042185576853
- Free prompt from AgentPlaybook Real Estate: https://agentic-library.netlify.app/prompt/al-288-take-the-server-your-ai-agent-runs-on-off-the-public-interne/
- To install in an agent that supports Agent Skills, save this file as SKILL.md in a folder with the same name as `name` above (for example in your skills directory). Install steps for Claude.ai, Claude Code, Cursor and Codex: https://agentic-library.netlify.app/skills/