Deploy on a fresh VPS in one paste.
Generate a cloud-init file with your SSH key baked in. Create a small cloud server with it (Ubuntu 24.04 - the cheapest Hetzner or DigitalOcean instance is plenty), and it boots into a running, firewalled gateway: only SSH ports open, key-only login, dashboard reachable through an SSH tunnel only.
Generate your file
Provide at least one. Keys go into the file so the server trusts your machine from first boot - no dependence on the provider's key-selection form. Public keys only; everything happens in this request, nothing is stored.
Then create the server with the file pasted into the provider's "user data" / cloud-init field - no CLI needed. Prefer the terminal? With Hetzner's hcloud CLI:
# one time: create an API token (Hetzner console -> your project -> # Security -> API tokens -> Generate, Read & Write), then: hcloud context create nimblegate # paste the token when prompted hcloud server create --name gateway --image ubuntu-24.04 --type cx23 \ --user-data-from-file nimblegate-cloud-init.yaml
DigitalOcean's doctl is equivalent; the flag there is
--user-data-file.
- Create the server with the downloaded file pasted into the "user data" / cloud-init field (or the command above).
- Wait ~5 minutes - first boot updates packages, sets the firewall, and starts the gateway.
- SSH in - the login banner shows your one-time setup token and the dashboard tunnel command. From there, the getting-started guide takes you to your first guarded push.
Done for youThe file gets you a running server. A working setup is more.
After the install: rule kits chosen and tuned to your stack, repos registered with correctly-scoped tokens, your team's keys onboarded, Auto-PR wired to your agents, and a verified block-and-fix loop - the parts teams actually stall on. Fixed price, in your cloud account; you add your own credentials and revoke my access at handoff.