Welcome to Your AI Employee's First Day

Open PowerShell on your computer. Windows ships with SSH built in, so this one line gets you into your new server. Replace YOUR.SERVER.IP with the IP from your Contabo welcome email.

ssh root@YOUR.SERVER.IP

The first time, it asks if you trust this server's fingerprint. Type yes. Then paste the root password from the email. If you see a welcome banner and a prompt that ends in #, congratulations: you're standing in your employee's future office.

Typing a password every time is fine for a visitor. Employees get a key to the building. That's section 2.

This is the most important section in today's onboarding. Passwordless SSH is what turns Claude Code into a real employee that can walk into the server on its own. You don't type the commands. You open Claude Code on your computer and hand it this:

Set up passwordless SSH to root@YOUR.SERVER.IP. Generate an ed25519 key if I don't have one, copy it to the server (I'll type the root password one time when you ask), and add a Host alias called "vps" to my ~/.ssh/config so I can just type "ssh vps".

When Claude Code asks you for that one-time password, remember section 1: the screen stays blank while you type. Paste it and press Enter.

Behind the scenes, Claude Code runs something like this. Watch it work so you know what's happening:

ssh-keygen -t ed25519

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@YOUR.SERVER.IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

It also adds a few lines to your ~/.ssh/config file so the server gets a short name. When it's done, test it yourself:

ssh vps

No password prompt? Perfect. From this moment, every command Claude Code sends through ssh vps just works. Your AI employee now has a badge that opens the door.

Before anyone moves in, we lock the building and open a personnel file. Three locks: close every port except the ones you use, hire a bouncer named fail2ban, and stop accepting passwords at the door entirely. Then a full security check, and every detail about the server goes into its own manual. One prompt does all of it. Hand this to Claude Code on your computer:

SSH into my server "vps" and do a full security setup: enable ufw allowing only OpenSSH, HTTP, and HTTPS. Install and enable fail2ban with the default sshd jail. Verify my key login works, then disable password login for SSH so we do not lock ourselves out. After that, run a full security audit of the server and report what you found and what you fixed. Finally, collect the server's specs (CPU, RAM, disk, OS version, IP address) and create a file on my computer called server-manual.md that records everything about this server: the specs, exactly how I log in, what is installed, and what security is enabled. From now on, every time we change this server, update server-manual.md.

The security work it runs behind the scenes:

ufw allow OpenSSH && ufw allow 80 && ufw allow 443 && ufw enable
apt install -y fail2ban
systemctl enable --now fail2ban

It also sets PasswordAuthentication no in /etc/ssh/sshd_config and restarts SSH. After that, the only way in is the key from section 2, and bots guessing passwords are guessing at a door with no keyhole. Then it reads the specs with commands like lscpu, free -h, and df -h, and writes it all into server-manual.md on your computer.

server-manual.md is this server's page in your AI Employee Manual. Specs, keys, what is installed, what is locked. Every time Claude Code touches the server, end with "update server-manual.md." A personnel file that never goes stale. That's the whole philosophy of this website, by the way. Warmly, Emmanuel

Your AI employee should also live on the server, not just visit it. And here's the good news: from this section on, you never SSH anywhere yourself again. Claude Code has the key from section 2, so it does the commuting. You just hand it prompts on your computer:

SSH into my server "vps" and install Claude Code on it using the official installer. Confirm the install worked, then update server-manual.md.

What it runs over SSH, if you're curious or ever want to do it by hand:

ssh vps "curl -fsSL https://claude.ai/install.sh | bash"

One part is yours, because logging in is personal: connect once and start Claude Code on the server so it can link to your account.

ssh vps
claude

It prints a login link. Open that link in the browser on your computer, approve it, and paste the code back into the terminal. Now you have Claude Code in two places: on your computer driving the server from the outside, and on the server itself working from the inside.

Two desks, one employee. Very efficient. HR approves. And per section 3: tell it to add itself to server-manual.md.

An office needs power and plumbing. For a web server, that's nginx (serves your websites) and SQLite (stores your data). You stay at your desk. Hand this to Claude Code on your computer and let it make the trip:

SSH into my server "vps", update Ubuntu, and install nginx and sqlite3. Enable nginx to start on boot, confirm the default page is being served, and update server-manual.md.

What it runs over SSH, if you ever want to do it by hand:

apt update && apt upgrade -y
apt install -y nginx sqlite3
systemctl enable --now nginx

Visit http://YOUR.SERVER.IP in your browser. If you see the nginx welcome page, your office has lights. One note on SQLite: there is nothing to "run." It's a file, not a service. No database server to babysit. Your apps just open a .db file, per the manual's strong preference for fewer moving parts.

Time to give the office an address people can actually remember. This half happens at your domain registrar (GoDaddy, Cloudflare, Namecheap), not in the terminal: add an A record for @ and another for www, both pointing at YOUR.SERVER.IP. Then check that the world can see it:

nslookup yourdomain.com

When that returns your server's IP, hand the rest to Claude Code on your computer. It makes the trip, you stay put:

SSH into my server "vps" and configure nginx to serve yourdomain.com and www.yourdomain.com. Get a free SSL certificate with certbot, with auto-renewal, and update server-manual.md.

It installs certbot, writes the nginx config, and runs the certificate setup. A few minutes later your site loads at https://yourdomain.com with the padlock. Free, and it renews itself.

The finale: message your AI employee from your pocket. Four parts. The middle two trip everyone up, so we go slow, per the manual.

Part 1: Put Telegram in your browser. You are about to copy and paste codes, and that is miserable on a phone. On your computer, open web.telegram.org and choose Log in by QR code. On your phone, open Telegram and go to Settings > Devices > Link Desktop Device, then scan the QR code on your screen. Telegram is now on your computer, right next to Claude Code, where copy and paste lives.

Part 2: Create your bot with BotFather. In Telegram's search bar, type BotFather and pick @BotFather, the one with the blue verified check. Send it this:

/newbot

It asks you for two names, in this order:

1. A display name. Make it cute: your first name with Claude after it, like Joe Claude.

2. A username. This one has rules: no spaces, and it MUST end with the word bot, like joeclaude_bot. If it's taken, add a number.

BotFather then hands you a token: a long code with a colon in the middle, something like 1234567890:AAH8s7q... That token IS your bot. Copy it and treat it like a password.

Part 3: Find your chat ID. Here is where everyone gets stuck, so read closely: Telegram has no button anywhere that shows you your chat ID. It only exists in the API. First, search for your new bot by its username, press Start, and send it any message, even just "hi". Your bot cannot see you until you message it first. Then let Claude Code go find the number for you:

Here is my Telegram bot token: PASTE_TOKEN. Call the Telegram getUpdates API with it and tell me the numeric chat ID from the message I just sent my bot. Add the bot's username and my chat ID to server-manual.md, but not the token.

Prefer to see it with your own eyes? Open this in your browser, with your token in the middle, and look for "chat":{"id": followed by a number. That number is you:

https://api.telegram.org/bot<YOUR_TOKEN>/getUpdates

Part 4: Build the bridge. Hand Claude Code on your computer the whole job:

SSH into my server "vps" and build me a Telegram bridge: a Python script running as a systemd service that long-polls my Telegram bot (token: PASTE_TOKEN), only accepts messages from my chat ID (PASTE_CHAT_ID), passes each message to "claude -p" in headless mode, and sends the reply back to me on Telegram. Log everything to a file. When it works, update server-manual.md.

When it's running, text your bot from your phone and watch your AI employee answer from its own office. That's not a demo. That's an employee.