What this step is
Configure the server you bought in step 1: install the nodes, get a certificate, install the AI API and harden security. Both routes do exactly the same thing; only who types differs.
Afterwards:
ssh your-namelogs you in without a password (using a key instead);- your desktop has a new file
小小东VPS-your-name-登录信息.md(orXXD-VPS-your-name-login-en.mdif you ask for English) with the subscription URLs and the panel and AI API logins.
Pick a name first, such as bwg or la1: letters, digits and hyphens only, starting with a letter. From then on, ssh bwg logs you in.
1. Send this message to the AI
Open claude or codex in the terminal, copy the message below, fill in the IP and name, and send it:
Please configure my new server with the "xiaoxiaodong VPS" setup.
Setup: https://github.com/nevertoday/xiaoxiaodong-vps
Download the project first, read skills/xiaoxiaodong-vps/SKILL.md in full,
and follow its steps and rules strictly, using the project's scripts for deployment and verification.
Please talk to me in English and save the login file in English.
My server:
- IP:
- Login: initial password (please let me type it in the terminal myself)
- SSH user and port: default
- Name I want to use to log in: bwgWhat to change:
- IP: the server IP from step 1.
- Login: if the provider gave you a key file, change it to
key file: path(a zip works too). - SSH user and port: if they aren’t root and 22, replace “default” with the real values.
- Name: replace
bwgwith your chosen name.
2. Type the password once when asked
The AI will ask you to type the server’s root password in the terminal yourself (nothing shows while typing — that’s normal).
3. Wait for it to finish
Usually about 10 minutes. The AI works stage by stage and reports progress: base setup → certificate → nodes → subscription → AI API → maintenance → verification.
If something goes wrong, the AI fixes it using the setup’s troubleshooting notes and reruns that stage. You only answer its questions.
If the AI can’t download the project, download the ZIP yourself, unzip it, and add “the project is already at: folder path” to the message.
Each block below: copy → paste into the terminal → Enter → wait for it to finish, then the next. Replace your-IP and bwg with your own.
1. Download the setup
git clone https://github.com/nevertoday/xiaoxiaodong-vps.git
cd xiaoxiaodong-vps/skills/xiaoxiaodong-vpsThe first time you use git on a Mac, a pop-up may offer to install the “command line developer tools”. Install them, then run the command again.
2. Set up passwordless login
bash scripts/local/connect.sh --alias bwg --host your-IP --port 22 --user root --password-promptIf your SSH port isn’t 22, change --port 22. Seeing 完成：以后用 ssh bwg 登录 (“done: log in with ssh bwg from now on”) means it worked — the scripts print messages in Chinese.
3. Choose a time zone
Pick by the server’s city; you’ll use it in the next block:
| Data center | Time zone |
|---|---|
| Los Angeles, San Jose, US West | America/Los_Angeles |
| New York, US East | America/New_York |
| Hong Kong | Asia/Hong_Kong |
| Tokyo | Asia/Tokyo |
| Singapore | Asia/Singapore |
| Not sure | Etc/UTC |
4. Run the configuration in order
R=scripts/local/remote.sh
bash $R bwg upload
bash $R bwg init --ip your-IP --alias bwg --timezone America/Los_Angeles
bash $R bwg base
bash $R bwg cert
bash $R bwg xui
bash $R bwg sub
bash $R bwg cliproxy
bash $R bwg maintEach stage ends with xxx 完成 (“xxx done”), e.g. cert 完成. To show traffic usage in your apps, add --quota-gb 1000 --reset-day 1 to the end of the init line (1000 GB a month, resetting on the 1st — use your plan’s numbers).
5. Verify and save the login info
bash $R bwg verify --full
bash $R bwg save --lang enHow you know it worked
Where the login-info file is:
- Mac: on your desktop.
- Windows (WSL): WSL has no desktop, so it’s in your Ubuntu home folder. Type
explorer.exe .in the terminal to open that folder in File Explorer.
The file contains: the Clash subscription URL, the Shadowrocket subscription URL, the 3x-ui panel login and the CLIProxyAPI address and keys. You’ll need the subscription URL in the next step.
How to open it: it’s a plain-text file. On Mac, right-click → “Open With” → “TextEdit”; on Windows, right-click → “Open with” → “Notepad”. A subscription URL is one long line starting with https:// — copy the whole line.
Stuck?
The certificate stage failed?
Most often the provider’s “security group” or firewall blocks port 80. Allow TCP 80 in the provider’s dashboard and rerun cert. The setup never falls back to a self-signed certificate.
It says the OS isn't supported?
Only Ubuntu 22.04+ and Debian 12+ are supported. Reinstall as Ubuntu 24.04 from the provider’s dashboard — see Reinstall the OS as Ubuntu. The password changes after reinstalling; start again from passwordless login with the new one.
The password is right, but key login fails?
Some provider images disable SSH key login by default. Current versions of the scripts turn it back on automatically; if you have an old copy, update the setup and try again.
One or two verification items FAIL?
Read the note after the FAIL line, fix it, rerun that stage, then run verify --full again. On the AI route, just let the AI handle it.
After reinstalling the OS, my ssh name won't connect?
Reinstalling changes the server’s identity fingerprint, and sometimes the port. See Reinstall the OS as Ubuntu for the clean-up commands.
Before moving on, check
✓ All ticked — on to the next step.