---
title: "Servers · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/servers
updated: 2026-10-20
licence: "All rights reserved"
---

# Servers

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Replace servers instead of changing them by hand. Rebuild any server from code, install security updates by themselves, and close every port you do not use.

These rules cover virtual machines and rented servers, from a fleet behind a load balancer to one small machine that runs everything. Containers have their own [chapter in the operations playbook](https://agentwranglers.se/playbook/operations/containers). How each service runs on the machine is covered in [Run each service as its own user](https://agentwranglers.se/playbook/operations/running-the-service/service-user) and [Lock the service in a sandbox](https://agentwranglers.se/playbook/operations/running-the-service/service-sandbox).

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/servers`.

## Required

- [Configure long-lived servers from code](https://agentwranglers.se/playbook/infrastructure/servers/configuration-management): When a server lives for months, set up its packages, files and services from code that can run again without changing anything.
- [Rebuild any server from code](https://agentwranglers.se/playbook/infrastructure/servers/rebuild-from-scratch): Keep everything needed to rebuild each server in code, so one command builds a fresh one. Prove it on a new machine in the quarterly [restore drill](https://agentwranglers.se/playbook/operations/disaster-recovery/restore-drills).
- [Install security updates by themselves](https://agentwranglers.se/playbook/infrastructure/servers/automatic-security-updates): Let every server install security updates by itself every day, and reboot in a set window when the kernel needs it.
- [Turn on a firewall on every host](https://agentwranglers.se/playbook/infrastructure/servers/host-firewall): Run a firewall on every server that refuses all incoming traffic except the ports it serves. Allow SSH only from named admin addresses.
- [Allow SSH with keys only](https://agentwranglers.se/playbook/infrastructure/servers/ssh-keys-only): Turn off password logins and direct root logins over SSH. Give each person their own key, and remove it the day they leave.

## Recommended

- [Replace servers instead of patching them](https://agentwranglers.se/playbook/infrastructure/servers/immutable-servers): Build a new machine image for every change, start new servers from it and stop the old ones. Never change a running server by hand.

- Previous: [Policy as code](https://agentwranglers.se/playbook/infrastructure/policy-as-code)
- Next: [Cost and ownership](https://agentwranglers.se/playbook/infrastructure/cost-and-ownership)
- [All chapters](https://agentwranglers.se/playbook/infrastructure)