Hardening a Contributor Verification VPS Without Breaking Production
Hardening a Contributor Verification VPS Without Breaking Production Running contributor verification workloads on the same VPS as production services creates an uncomfortable engineering constraint: you want stronger isolation, but you cannot casually restart, reconfigure, or “clean up” the server. That was the situation we faced while turning a MyZubster VPS into a more structured Contributor…
The article describes the process of hardening a contributor verification VPS without disrupting production services. The original VPS was running multiple workloads, including production MyZubster gateway, PM2-managed applications, Docker-based verification environments, and various other services. To avoid breaking production, the author adopted a cautious approach of observing, making incremental changes, and verifying each step before persisting the modifications.
First, the author mapped the listening services using the command "ss -lntp" to categorize them into local-only and globally bound services. The local services were already following a reasonable internal-service model, while the globally bound services were identified and inspected.
Next, the author examined the reverse-proxy graph and discovered that the Node process on port 5173 should have listened only on localhost. By changing only that listener, the application was secured while preserving its functionality. The same method was then applied to another API service (port 5002) that was found to be listening beyond localhost.
After each modification, the author verified the socket, tested the service directly, and checked the reverse-proxy configuration before persisting the changes. This disciplined approach ensured that the VPS remained stable while improving its isolation and security.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
