Set Up Paperclip on a VPS for Remote Agent Control

Updated 5 November 2026 · Standard formula, shown below

Running Paperclip on a virtual private server lets you reach its agent-management interface from another device without keeping a workstation online. The safe approach is to install it using the project’s current instructions, keep the service private while configuring it, and expose access only through a protected network path.

What You’ll Need

A VPS running a Linux distribution supported by Paperclip’s current documentation, with administrator access.
A domain name pointed at the VPS if you plan to use HTTPS through a reverse proxy.
An SSH client, a terminal, and basic familiarity with Linux commands.
The official Paperclip project repository and installation instructions. Confirm the project you mean before installing: similarly named software can have different setup requirements.
Any agent-provider credentials Paperclip requires. Store these as secrets; do not paste them into public logs or commit them to a repository.

Step-by-Step

Confirm the project and deployment method. Open Paperclip’s official documentation or repository and check its supported operating systems, prerequisites, install command, default listen address, and upgrade process. Prefer a documented container or service setup if the project provides one. Avoid commands copied from unrelated tutorials, and inspect installation scripts before running them with administrator privileges.
Connect to the VPS over SSH. Use the server’s address and your assigned account, for example ssh username@server-address. If your provider offers SSH keys, use them rather than password login where practical. Confirm you are on the intended machine with hostname and check available disk space with df -h.
Update the operating system and install prerequisites. Apply the update procedure for your distribution, then install only the dependencies Paperclip documents. For Debian- or Ubuntu-based systems, package commands differ from those on other distributions, so follow the VPS provider and project guidance. Reboot if an update requires it, then reconnect before continuing.
Create a dedicated service account and working directory. Unless the official instructions require another arrangement, run the application as a non-root user rather than as root. Keep application files and configuration in a directory readable only by the account that needs them. This limits the damage a compromised service could cause.
Install Paperclip using the documented method. Follow the current official steps exactly, including any required runtime or database setup. Pin a release or image version when the project supports it; avoid using an unpinned “latest” image for a long-running setup. Record the version and installation method so you can reproduce or roll back the deployment.
Configure credentials and local access. Add required provider keys and application settings using the documented environment-file or secret-management method. Restrict the file permissions, for example with chmod 600 on a file that contains secrets. Set the service to listen on localhost or a private interface unless the documentation explicitly requires otherwise. Do not expose an unauthenticated control panel directly to the public internet.
Start Paperclip and test it from the VPS. Use the project’s documented startup command or service manager. Check its status and logs, then request the local health or web address specified in its documentation. A successful local response confirms the process is running, but does not yet confirm remote access or secure authentication.
Choose a protected remote-access route. For personal or small-team use, a VPN or SSH tunnel can keep the interface off the public internet. With SSH tunneling, forward a local port to the VPS’s localhost port using the actual port from your configuration; then open the local address in your browser. If you need a public hostname, configure a maintained reverse proxy, HTTPS, and strong authentication, and allow only the required traffic through the VPS firewall.
Set up HTTPS and DNS if using a public hostname. Point the domain’s DNS record at the VPS and configure the reverse proxy according to its documentation. Obtain and renew a trusted TLS certificate, redirect HTTP to HTTPS, and avoid forwarding the application’s internal port directly to the internet. Test the site from a separate network, not only from the server itself.
Enable startup, backups, and maintenance. Configure the documented service manager or container restart policy so Paperclip returns after a reboot. Back up its database and configuration securely, excluding secrets from unprotected archives. Keep the operating system and Paperclip updated, review logs for failed access, and test that a backup can be restored.
Connect and verify an agent. Sign in through the protected route, configure one agent using the project’s documented process, and run a low-risk test task. Confirm that the agent can reach its required services and that its permissions are limited to what it needs. Do not give an agent broad VPS or account access simply to make a first test succeed.

Common Mistakes

Opening every port: Only allow the ports required for SSH and your chosen access route. An application’s internal port should normally remain private.
Running as root: A service vulnerability is more serious when the process has full system privileges. Use a dedicated account where supported.
Leaving setup credentials in shell history: Commands containing tokens may be saved in history or logs. Use the project’s secret configuration method and rotate any credential accidentally exposed.
Assuming a running process is remotely reachable: Binding to localhost is safer, but requires a tunnel or proxy. Conversely, binding to all interfaces can expose the service if firewall rules are wrong.
Skipping authentication or TLS: A public control interface can expose agents, tasks, and connected services. Do not treat an obscure URL as access control.
Ignoring persistence: A process started in a temporary terminal session may stop when the session ends or the server reboots. Use the documented persistent service method.

Tips

Keep a note of the Paperclip version, configuration path, listening address, and backup location, but keep secrets out of that note.
Use separate credentials for each connected provider when possible, with the narrowest permissions the integration supports.
Test access from both inside and outside the VPS network. This helps distinguish application problems from firewall, DNS, or proxy problems.
Before an upgrade, read the release notes, back up persistent data, and confirm the documented rollback procedure.

Troubleshooting

The service will not start: Check its status and recent logs using the service manager or container commands specified by the installation method. Look for missing environment variables, invalid configuration, unavailable dependencies, or a port already in use. Fix the reported cause, then restart and check the logs again.
The page works on the VPS but not remotely: Verify the configured bind address, firewall rules, and route. With a tunnel, confirm the local and remote ports match the application’s configured port. With a domain, check DNS resolution and reverse-proxy logs.
The browser reports a certificate warning: Confirm the domain points to the right VPS, the certificate covers that hostname, and the reverse proxy serves the certificate correctly. Check renewal status; do not bypass the warning to enter credentials.
Agent connections fail: Review Paperclip and agent logs for authentication, network, or provider errors. Check that the relevant credential is valid and that outbound network access is available. Avoid printing secrets while debugging.
The service stops after logout or reboot: Check whether it was launched in an interactive shell. Configure the project’s supported system service or container restart policy, enable it at boot if needed, and test with a controlled restart.

Frequently Asked Questions

Can I control Paperclip from my laptop?
Yes. Use a VPN, SSH tunnel, or an HTTPS reverse proxy with authentication. The remote device needs network access to the VPS through that protected route.

Do I need a domain name?
No, not for a VPN or SSH tunnel. A domain is useful for a public HTTPS endpoint, but it does not replace authentication or firewall controls.

Which port should I open?
Use the ports required by your chosen access method, such as SSH or HTTPS. Keep Paperclip’s internal application port private unless its official deployment guidance specifically says otherwise.

Can I run Paperclip as root?
Avoid it unless the official setup explicitly requires it. A dedicated, non-root service account reduces the privileges available to the application.

How do I keep Paperclip running after a reboot?
Use the system service or container restart configuration recommended by the project, enable it at boot where applicable, and test by restarting the VPS.

What should I back up?
Back up Paperclip’s persistent database and necessary configuration using the project’s guidance. Protect backups, limit access to secrets, and periodically verify that restoration works.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.