The Complete Guide to Self-Hosting AI Agents

Cloud GPUs are expensive. Running agents on your own VPS is cheaper and gives you full control. Here's the production setup for my opclsumo01 (Tencent Cloud, $12/month) that runs 24/7.

The goal isn't zero downtime — it's auto-recovery before you notice.

VPS selection

Minimum specs for 24/7 agent workload:

• CPU: 2+ cores (AMD EPYC or Intel Xeon)
• RAM: 4GB+ (8GB preferred — LLMs love RAM)
• Storage: 40GB SSD+ (logs eat disk fast)
• Network: unmetered or 1TB+ monthly transfer
• Location: nearest to your latency-sensitive users

My VPS: Tencent Cloud Lighthouse, 2 vCPU / 4GB / 80GB SSD, Singapore region. $12/month.

Avoid: AWS/GCP on-demand ($$$), budget VPS with oversold CPUs (agent cron jitter).

OS hardening

Baseline security before installing anything:

# 1. Update everything
sudo apt update && sudo apt upgrade -y

# 2. Create non-root user
sudo adduser deploy
sudo usermod -aG sudo deploy

# 3. SSH hardening
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# 4. Firewall (ufw)
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 10000:10100/udp  # Tailscale
sudo ufw enable

# 5. Fail2ban
sudo apt install fail2ban -y
sudo systemctl enable fail2ban

Also: automatic security updates, disable unused services, set timezone to UTC for cron consistency.

Tailscale mesh network

Your agents need to talk across VPSs and your home network. Tailscale gives you a secure mesh VPN without port forwarding:

# Install
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

# Verify mesh
tailscale status
# Shows all your devices on the same 100.x.y.z network

Benefits:

• Your VPS agents reach your home server via 100.x.y.z IPs
• No open ports beyond 443
• ACLs restrict which devices can see each other
• Works behind NAT without port forwarding

I run Tailscale on: opclsumo01 (VPS), asus-um3406ha (laptop), manager-thinkpad-t560 (Linux box). All three see each other at 100.101.147.71, 100.103.192.57, 100.97.198.108.

24/7 monitoring

You can't fix what you don't know is broken. Monitoring stack:

• Uptime: uptime-robot.com (free tier, 5min checks)
• Resource: htop + df -h via cron
• Logs: pm2 logs for agent processes
• Alerting: Telegram bot on failure (Discus sends /alert)

Quick health check script:

#!/bin/bash
# health-check.sh
CPU=$(top -bn1 | grep "Cpu(s)" | awk {'{print $2}'})
MEM=$(free -m | awk {'/Mem:/{print $3'}})
DISK=$(df / | awk {'NR==2{print $5'}})
UPTIME=$(uptime -p)

curl -s -X POST "https://api.telegram.org/bOT_TOKEN/sendMessage" \
  -d "chat_id=YOUR_CHAT_ID" \
  -d "text=opclsumo01 health: CPU=$CPU% MEM=${MEM}M DISK=$DISK UPTIME=$UPTIME"

Run every hour via cron. Silence is good — alerts mean something died.

Cron job management

Don't use raw crontab -e. Use a process manager:

# Install pm2
npm install -g pm2

# Agent process
pm2 start "python3 agent-runtime.js" --name discus-agent
pm2 save
pm2 startup  # auto-start on reboot

# Monitoring
pm2 monit
pm2 logs discus-agent

PM2 restarts crashed processes, rotates logs, and survives reboots. Better than systemd for JS/Python agents.

Hermes cron jobs (hermes cron create) are separate — those run inside the agent runtime.

Disaster recovery

Assume your VPS will die. Prepare:

• Daily backups: rclone to Backblaze B2 ($0.005/GB/month)
• Config in git: nginx.conf, agent configs, cron definitions
• Spin-up script: one command to rebuild from scratch
• Offsite secrets: vault (not on the VPS itself)

Recovery time from bare VPS: 15 minutes if you have a setup script. Test it once.

Next: How to Build a Memory System for AI Agents — GrayMatter integration for cross-agent recall.