I self-hosted an AI coding agent on a $20/year VPS. Here's what I learned.

Last weekend I set up DeepSeek Harness on a small VPS behind Nginx with HTTPS, and it turned into a masterclass in reverse-proxy debugging.

Three things bit me:

"Reconnecting..." is almost never a WebSocket problem.
The UI kept saying it couldn't connect. Nginx logs showed connect() failed (111) — the backend wasn't even running. The process had died when my SSH session dropped. Lesson: systemd, not npx in a terminal.
Reverse proxies need to be trusted, not just proxied.
The app enforces a "browser-trust fence" on its /api routes. My domain wasn't in the allow-list, so every request 403'd silently. One flag fixed it: --trusted-host.
The Host header is load-bearing.
Session cookies were HMAC-bound to the Host authority. Rewriting Host in Nginx — which many tutorials tell you to do — would have silently broken auth. Read your app's security model before copy-pasting configs.

Bonus: I also confirmed that Cloudflare in front of a WebSocket app can mask the real issue. Greying the record (DNS-only) is the fastest way to isolate whether the problem is your origin or your proxy.

What I ended up with:

Nginx with proper WS upgrade, buffering off, 1-hour timeouts
Let's Encrypt auto-renewal
systemd unit with Restart=always
Zero-downtime across reboots and disconnects

The full write-up (config, systemd unit, troubleshooting flow) contact me.

#SelfHosted #DevOps #Nginx #AI #Linux #VPS #DeepSeek #DeepSeekHarness