AI Powered

Operational

Infomaniak VPS · Ubuntu 24.04 LTS

Inside the
AI Powered
VPS.

A deliberately compact infrastructure: one public gateway, isolated applications, a protected system disk and heavy data placed on a dedicated volume.

Explore the system View verified status
AI POWERED / PROD LIVE
CPU4 vCPU
RAM11 GiB
EDGECaddy
KERNEL6.8.0

Verified status

0 failed units

0 pending updates

0 required reboots

01 / Architecture

A short path, with clear roles.

Public traffic stops at Caddy. Marco, the OpenClaw agent, stays on loopback under its own Linux account without sudo. A constrained root broker publishes only validated projects.

PUBLIC ZONE

ENTRYInternet

IPv4 + IPv6

REVERSE PROXYCaddy

TLS · HSTS · routing

STATIC SITEAI Powered

.CH + .FR

APPLICATIONgab-loc

SPA + API

PRIVATE ZONE / LOOPBACK

PRIVATE AGENTMarco

Local OpenClaw · controlled Telegram

DEPLOYMENTGuarded broker

Bounded actions · no sudo

DEDICATED VOLUME/mnt/data

250 GiB · guarded mounts

02 / Capacity

Two disks, two distinct jobs.

Linux does not balance volumes automatically. The smaller system disk holds the OS; the data volume absorbs Marco's state, projects, published releases and rollback evidence.

PROVISIONED ALLOCATION

270 GiB split across two volumes.

The data disk holds most of the capacity so projects and application state can grow without filling the system. The chart shows provisioned capacity, not current utilisation.

  • System20 GiB7.4%
  • Data250 GiB92.6%

SYSTEM · EXT4

/dev/sda1

39%used
Capacity20 GiB
Available≈ 12 GiB

Reduced from 97% to 39% after moving data, cleaning caches and limiting journal growth.

DATA · EXT4

/mnt/data

2%used
Capacity250 GiB
Available≈ 229 GiB

The Marco service and every published application verify the data volume identity. If it is missing, they fail safely.

COMPUTE

4vCPU

AMD EPYC · KVM/OpenStack virtualisation

MEMORY

11GiB

Dedicated RAM · no swap partition

03 / Services

A small inventory, clearly defined.

Every retained service has an explicit purpose. Historical applications and routes without confirmed use were removed, with recovery evidence kept off the system disk.

ServiceRoleExposureStatus
CaddyTLS and web routing80 / 443Active
gab-locApplication + APIVia CaddyActive
Marco / OpenClawPrivate non-sudo agent127.0.0.1:18790Active
Marco DeployConstrained web publishingLocal Unix socketActive
Health timerCheck every 5 minLocalActive

04 / Security

The public surface fits on four ports.

The guest firewall is active for IPv4 and IPv6. Private applications are not published directly. Marco has no sudo: only controlled deployment operations cross a dedicated root-owned socket.

  • Key-only SSH; root and password login disabled
  • Automatic TLS, HSTS, CSP and unknown-host rejection
  • OpenClaw secrets referenced from protected files
  • Separate Marco account with no sudo, adm, docker or lxd
  • Zero updates pending at the last verified check
INGRESS POLICYUFW · ACTIVE
22Primary SSHLIMIT
515Secondary SSHLIMIT
80HTTP → HTTPSALLOW
443HTTPS / TLSALLOW

Everything else
Rejected at host level

05 / Evolution

From experimental VPS to a healthy foundation.

The server keeps its flexibility, but responsibilities are now separated, obsolete components removed, and every significant operation documented with a recovery path.

  1. 01

    System creation

    Ubuntu 24.04 on a 20 GiB OpenStack/KVM VPS.

  2. 02

    Data volume

    Addition of the 250 GiB disk and the first application workloads.

  3. 03

    Full audit

    Mapping storage, services, websites and network exposure.

  4. 04

    Marco takes its role

    Unified Caddy edge, separate non-sudo OpenClaw agent, guarded deployments and Docker stopped.

06 / Compared with the VPS image

What was added — and why.

EDGE

Caddy + TLS

One web entry point, automated certificates and explicit host rules.

DATA

250 GiB volume

Large data and runtimes moved away from the system disk.

AI

Marco / OpenClaw

Private gateway, dedicated identity and strict Telegram policy.

SEC

Least privilege

UFW, key-only SSH, non-sudo Marco and a constrained deployment broker.

Reference state

Stable. Documented. Recoverable.

OSUbuntu 24.04 LTS

Kernel6.8.0-137

EdgeCaddy

Appgab-loc

AgentMarco · OpenClaw 2026.7.1-2

Monitoring5 minutes