Fresh / occupied gate and prerequisites
Use this guide for a new server. If the host already holds data you care about, stop and complete control writes → final export → verified restore before rebuild or terminate.
Private prerequisites: monthly vs hourly, Type A/B/D/T hypothesis, vCPU/RAM/disk, DC preference, traffic package expectation (especially Asia 1 TB), OS vs marketplace app, backup/managed checkboxes, budget, and a terminate calendar for trials. The reader performs purchase in the Kamatera console.
Build the server in the live calculator
Order path checklist (follow live labels):
| Field | Verify | Fail if |
|---|---|---|
| Datacenter | Users/data residency; confirm code appears live | Assuming marketing 25 equals stock |
| CPU type | A / B / D / T semantics from the review | Type T without overage monitoring |
| vCPU / RAM / NVMe | Hypothesis from scenario table | Treating starter cards as the only SKUs |
| Traffic package | 5 TB vs Asia 1 TB vs unmetered 50 Mbps | Inventing overage math |
| OS or marketplace app | Ubuntu vs n8n/WP/Ollama/OpenClaw image | Assuming hardened production defaults |
| Extended daily backup / Managed | Optional lines; managed ~$50/mo seed in captured calculator | Equating managed with ScalaHosting WP Manager |
| Monthly vs hourly | Cash mode intentional | Leaving hourly leftovers without terminate date |
Type T reminder: calculator UI is hourly-only; burst overage risk is real.
Read the order summary like a bill
- Confirm traffic package matches the DC story you intended.
- Confirm Extended daily backup and Managed lines if checked.
- Confirm billing mode; if Type A, keep the FAQ vs calculator hourly conflict labeled—do not “fix” the rate.
- Save a private screenshot/PDF of the summary; never publish secrets.
First login: discover, then harden
Marketplace default credentials and first-login panels are UNKNOWN without deploy—discover what the console actually delivered.
- Read-only inventory: OS version, listening ports, containers/services, mounts, public IP, any cloud firewall state.
- Create a sudo admin with SSH keys; prove a second session works; then narrow password/root login per your policy; keep console recovery.
- Host firewall: intentional 22/80/443 unless an app requires more—document exceptions.
- If a marketplace image is present: record admin URL, ports, and version paths; do not leave admin UIs world-open.
# Placeholders only — discover real users/paths on your host.
ss -tulpn
df -h
docker ps --format 'table {{{{.Names}}}}\t{{{{.Ports}}}}' 2>/dev/null || true
Day-zero acceptance receipt
Acceptance checklist: billing mode recorded; CPU type/size; DC; traffic package; add-ons; SSH key-only working; firewall map; image/app inventory; optional snapshot/image before first risky change; off-host export destination named.
Handoff: n8n operations, AI apps, billing / backup / cancel.
Stop conditions: unexpected public listeners, reused root passwords, unintended paid add-ons, Asia traffic mismatch on the summary.