Claude Code on VPS Only: levelsio's Year-Long Production Workflow (June 2026)
Jun 28, 2026: Pieter Levels (~1.2M views) on a year of VPS-only Claude Code — live prod edits, deploy evolution, Hetzner + Tailscale setup, solo vs staging.
On June 28, 2026, Pieter Levels posted a thread that became one of the year's most-cited agent-dev manifestos — ~1.2M views by mid-July — describing almost a year of coding solely on a VPS with Claude Code. No laptop open. No battery drain. Switch phone or any device. Agents keep going overnight with /goal. Hacky projects start on the server and go live in seconds because the code already sits on production infrastructure.
Two weeks later, Levels extended the same stack for Nomads iOS — Termius from iPhone, Xcode on rented macOS — in our companion VPS + SSH iOS guide. This post is the June 28 manifesto: deploy evolution, live production edits, solo vs team staging, and the Hetzner + Tailscale + Cloudflare checklist Levels shared in replies.
TL;DR — levelsio VPS Production Manifesto
Question
Answer
How long on VPS-only?
~12 months of Claude Code as primary dev environment (Jun 28, 2026)
Why not a laptop?
No lid open / battery drain; any device (Termius, etc.); overnight /goal runs
Deploy stage now?
Claude Code on VPS — 2 outages (~10 sec each) in a year
Levels did not jump straight to live production edits. His thread sketches a deliberate regression toward speed — each stage traded safety ceremony for seconds saved.
Stage
Flow
Typical latency
Community reaction
1 — Classic
Laptop → test local → GitHub → auto-pull deploy on server
~1 minute
Sensible default most teams still use
2 — Skip local
Lazy on new MBP: skip local Nginx, push straight to prod
~3 seconds
"People called me crazy"
3 — Agent on prod (now)
Claude Code on VPS edits production live — no push step
Immediate
2 site-down incidents in 12 months (~10 sec each)
explainx.ai's read: Stage 3 only works when you treat the VPS as a disposable agent harness host, not sacred infrastructure. Levels' two ten-second outages are the honest error budget — not zero, but acceptable for a solo builder shipping fast. Teams with SLAs should stop at stage 1.5: agent edits staging, human or CI promotes to prod.
The opposite philosophy — local-first, repo upload, no cloud credentials on a shared box — is what Grok Build open source advocates. Both camps agree the laptop is leaving the critical path; they disagree on whether production should be one SSH session away from rm -rf.
Why VPS-only feels like "living in the future"
Levels listed benefits that map cleanly to how long-running agents behave in 2026:
No laptop open / no battery drain — the harness runs on wall power in a datacenter
Device agnostic — phone, tablet, hotel PC; SSH is the UI (July iOS thread made Termius explicit)
Overnight continuity — /goal and tmux survive your sleep; wake up to a diff, not a dead process
Instant hacky deploys — spin a project on the same machine that serves traffic; no "works on my machine" transfer
Blast-radius separation — after Codex $HOME deletion reports, a wiped /home/dev on a €5 VPS beats a wiped laptop home directory
That last point is why solo builders tolerate stage 3 live prod edits. The VPS is already the sandbox — until it isn't, because production databases and customer sessions live on the same disk.
Solo on prod vs teams on staging
Levels drew an explicit line in the thread:
Profile
Levels' recommendation
Why
Solo indie
Live prod edits acceptable
You own the error budget; 10-second outages are survivable
Team / company
Staging server required
Concurrent agents, review gates, and customer trust need promotion workflow
Regulated / enterprise
Staging + change control + audit
Live agent shell on prod violates most compliance baselines
Staging pattern that preserves speed:
snippet
[Claude Code on staging VPS] → git push / rsync → [prod VPS auto-pull or blue-green]
Agents get full shell freedom on staging; production receives only reviewed artifacts — aligned with thin prompts, thick artifacts: chat stays thin, git carries truth.
For harness mechanics — permission modes, tool loops, checkpoint restore — see What is an agent harness?.
Levels' setup reply on the June 28 thread named a concrete stack. This is explainx.ai's expanded checklist — official docs linked where noted; no competitor product URLs.
1. Provision Hetzner VPS
CX or CPX tier: 2+ vCPU, 4+ GB RAM for comfortable Claude Code + build tools
Ubuntu 24.04 LTS, single non-root dev user
Enable Hetzner Cloud Firewall: block all inbound by default
2. SSH hardening
bash
# As root on fresh VPS — create dev user
adduser dev
usermod -aG sudo dev
mkdir -p /home/dev/.ssh && chmod 700 /home/dev/.ssh
# Paste Ed25519 public key → authorized_keys (chmod 600)# Disable password auth in /etc/ssh/sshd_config# PasswordAuthentication no# PermitRootLogin nosudo systemctl reload sshd
3. Install Claude Code + tmux
bash
# As dev — persist sessions for phone reconnectsudo apt update && sudo apt install -y git tmux build-essential
tmux new -s code
# Install Claude Code per official Linux docs# ANTHROPIC_API_KEY in ~/.config/agent/env (chmod 600) — never in prompts
4. Tailscale (private mesh)
Install Tailscale on the VPS and every client device
SSH via Tailscale IP or MagicDNS hostname — no public SSH port required
Prefer Tailscale SSH or key-based auth; disable exposure of port 22 to the public internet
5. Cloudflare Tunnel (optional public HTTPS)
Run cloudflared on the VPS for web preview or admin UIs
Tunnel terminates TLS at Cloudflare; origin stays off the public internet
Pair with Cloudflare Access if you expose anything beyond localhost
6. Firewall summary
Rule
Action
Inbound 0.0.0.0/0
Deny (Hetzner firewall + ufw)
Tailscale interface
Allow SSH, agent ports as needed
Cloudflare Tunnel
Outbound-only — no open inbound ports
7. Agent session hygiene
bash
tmux attach -t code || tmux new -s code
cd ~/your-product
claude # harness runs here; /goal for overnight tasks# Ctrl-b d to detach — iPhone Termius reconnects to same pane
Levels agreed with Theo (~Theo — builder and commentator in the agent-dev space): roughly six months until most developers move coding agents off laptops onto servers or cloud sandboxes.
Evidence in the thread and adjacent coverage:
Karpathy reportedly runs Claude via cloud/Slack — agents operate server-first, not IDE-first (Anthropic pre-training hire)
Community sandboxes — kayhe's sandbox setups, Phil Freo's Docker dev environments, peetzweg's 160k GitHub contributions from agent-assisted workflows
Peter Yang asked whether dedicated Claude Code / Codex desktop apps matter if the harness lives on a remote box — the answer trending toward no, SSH + tmux + /goal is enough UI
explainx.ai tracks the same shift in phone agent guides: the supervisor is mobile; the worker is always-on infrastructure.
Safety, backups, and when NOT to live-edit prod
3-2-1 backups (Levels' recommendation)
Copy
Where
Purpose
3 copies of data
Prod + local/staging snapshot + off-site
Survive single-disk failure
2 different media
NVMe on VPS + object storage
Correlated failure resistance
1 off-site
Hetzner Storage Box, S3-compatible, or git remote
Fire/fraud/ransomware hedge
Automate daily DB dumps and pre-agent snapshots before destructive refactors. Treat snapshots as cheap rollback — not a substitute for git.
Never enable full access on hardware you cannot wipe — see Codex $HOME chain
When NOT to live-edit production
Do not let Claude Code touch prod directly when:
Customers pay for uptime and a 10-second outage has real cost
Multiple engineers share one VPS without branch isolation or worktrees
PCI, HIPAA, SOC2, or similar requires segregation of duties
No staging mirror exists — you cannot diff before traffic hits changes
Backups are untested — you have never restored from them
Secrets live in the repo the agent reads — .env, signing keys, prod DB URLs
Database migrations need rollback plans agents cannot infer
In those cases: staging VPS + git promotion + CI smoke tests. Solo indie? Levels' error budget is instructive — two ten-second incidents in twelve months — not a guarantee for your stack.
Community replies — what builders are actually running
The June 28 thread spawned practical forks without changing the core thesis:
Voice
Idea
explainx.ai mapping
Peter Yang
Do we need CC/Codex desktop apps if VPS SSH suffices?
Same VPS brain; July adds second SSH hop to macOS for Xcode. Start here for why; read July for how on iPhone.
Summary
June 28, 2026: Pieter Levels documented ~12 months of VPS-only Claude Code — overnight /goal runs, three-stage deploy evolution ending in live production edits, and two ~10-second outages in a year. Solo on prod; teams on staging. Stack: Hetzner, SSH, Tailscale, Cloudflare Tunnels, inbound firewall deny.
explainx.ai's read: this is the server-first agent harness thesis Theo and Karpathy echo — your laptop becomes a terminal remote, not the source of truth. Pair speed with 3-2-1 backups, DCG hooks, and honest when-not-to rules. For Nomads iOS and Termius, continue to the July 8 companion post.
Context: Pieter Levels X thread, June 28, 2026 (~1.2M views, edited 2:52 PM) · Companion July 8, 2026 Nomads iOS thread (~322.5K views)
Thread view counts, agent CLI behavior, and Hetzner/Tailscale/Cloudflare docs reflect community reports through July 16, 2026. Live production editing carries real outage risk — verify backups and staging before copying a solo-indie error budget. Published June 28, 2026 (story date); last updated July 16, 2026 with July 8 iOS cross-links and Codex safety context.
