Custom cloud-init: set up your VPS automatically on first boot

With cloud-init, you add a file during installation that your VPS runs by itself on first boot. Your server then immediately installs your usual packages, creates your own user and runs your commands. Handy if you reinstall often or always want to start from the same base. You don't need an API or a terminal for this.

Where do you enter it?

1. Open the VPS screen via My Products.
2. New VPS: you'll see the Install your VPS block (see Installing your VPS: operating system, password and SSH key). Reinstalling: choose the Advanced tab and, under Reinstall, click Reinstall... (see Reinstalling or attaching an ISO).
3. Choose the operating system and enter the root password and, if you like, your SSH key, as usual.
4. Below the SSH key, click Custom cloud-init. The field expands.
5. Paste your file into the field.
6. Click the button to install, for example Install Debian 13, or when reinstalling, Erase everything and reinstall.

You still need the root password or the SSH key, even with a custom cloud-init. With these you can always get in, including via the console (see The console: your VPS in your browser).

What can go in the file?

The field accepts user-data, the file that cloud-init reads on first boot. The first line determines what it is:

• A maximum of 256 KB, and text only (UTF-8).
• In YAML, indent with spaces, never with tabs.
• WebOké takes care of the network (IPv4 and IPv6). A custom network-config isn't used, so don't put any network settings in it.

An example

This file updates all packages, installs htop and fail2ban, creates the user anna with your SSH key and sudo, gives the server its own name and sets the time zone:

#cloud-config
hostname: web1
fqdn: web1.example.com
package_update: true
package_upgrade: true
packages:
  - htop
  - fail2ban
users:
  - default
  - name: anna
    shell: /bin/bash
    sudo: "ALL=(ALL) NOPASSWD:ALL"
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3Nza... anna@laptop
runcmd:
  - timedatectl set-timezone Europe/Amsterdam

Replace the key with your own public key (see Creating an SSH key on Windows, Mac and Linux). The line - default keeps the default user, so the root password and SSH key from the form keep working as normal. After the first boot, log in with ssh anna@203.0.113.10. How to then disable root login and set up fail2ban is explained in Disabling password login and root login and fail2ban against password guessing.

Tip: The example is for Debian and Ubuntu. On AlmaLinux and Rocky Linux, htop and fail2ban are in the extra EPEL repository. There, leave out packages and under runcmd first add dnf install -y epel-release and then dnf install -y htop fail2ban.

What does WebOké add itself?

WebOké always passes on the hostname, the root password (as a hash only) and your SSH key. Your file is merged with these. If you set users, password, chpasswd or ssh_authorized_keys yourself, yours take precedence over what WebOké passes on.

Please note: If you set ssh_authorized_keys or password yourself at the top level of your file, they replace the key and password from the form. In that case, add the key you want to log in with yourself, or you'll only be able to get in via the console.

Did it work?

cloud-init runs once, on the first boot after installation. This sometimes takes a few minutes longer than the installation itself, especially if packages are being installed. Log in and check:

anna@web1:~$ cloud-init status --long
anna@web1:~$ sudo tail -n 30 /var/log/cloud-init-output.log
anna@web1:~$ sudo cloud-init schema --system

• cloud-init status --long shows status: done when everything is done, running while it's still running and error if something went wrong, along with the error. Use cloud-init status --wait to wait until it's finished.
• /var/log/cloud-init-output.log contains the output of your packages, commands and scripts. More details are in /var/log/cloud-init.log.
• cloud-init schema --system checks your file for errors. If the YAML isn't valid, cloud-init skips the parts it doesn't understand, without the installation failing.

Did something go wrong? Fix it by hand on the server, or adjust your file and reinstall. Bear in mind that reinstalling erases everything on your VPS.

Good to know

• It works for all operating systems in the list: Ubuntu 24.04 and 26.04, Debian 12 and 13, AlmaLinux 9 and 10 and Rocky Linux 9 and 10.
• Your file is passed on encrypted and isn't stored in the task history of your VPS. Even so, don't put any passwords or other secrets in it that you don't need.
• All the options are in the cloud-init documentation at docs.cloud-init.io.

Please note: The content of your cloud-init is your own responsibility. Support doesn't look at your file and doesn't help with writing or improving it.