A first week on Debian 13 for a tiny VPS

I rebuilt the box that serves this site last week, moving it from a cramped Debian 12 image to a fresh trixie install. The rebuild took about an hour of actual work; writing down what I did took longer. Here are the notes.

What I noticed first

Trixie feels like bookworm after a good cleanup. The installer is the same dance, but a few defaults shifted underneath:

• apt now warns that its CLI is unstable in scripts — the nag is new, the advice is not. Use apt-get in anything automated.
• OpenSSH splits drop-in config under /etc/ssh/sshd_config.d/ more aggressively; a stray 50-cloud-init.conf re-enabled password auth until I removed it.
• systemd 257's default journal limits are sane out of the box — 10% of the filesystem, capped — so I dropped my old override file entirely.

The two packages I install before anything else

Before nginx, before dotfiles, before anything: ufw and fail2ban. Every minute a fresh VPS spends on the public internet with port 22 open, it accumulates login attempts. The first apt install on a new box is always the same:

apt install -y ufw fail2ban
ufw default deny incoming
ufw allow ssh
ufw enable

Fail2ban's stock sshd jail is fine. I don't tune it — a machine this small doesn't need cleverness, it needs the front door to not be the most interesting thing about it.

What I kept boring

No swap (2 GB RAM, mostly idle), no monitoring agent beyond journald and a weekly df -h habit, no unattended-upgrades — I run upgrades by hand on weekends so a bad Tuesday update is never a surprise. The whole provisioning story fits in a 30-line shell script in the same git repo as this site.

A week in: load average has never printed above 0.05. Exactly what a tiny VPS is for.