Step 1 — Make Your Key

What you are doing: creating the two-part credential that will be the only way into your server.

Why it matters: you want the private half born on your own machine, never travelling anywhere. If someone emails you a private key, that key has sat in an inbox, and inboxes get breached. Making it yourself means only you have ever held it.

Make it

ssh-keygen -t ed25519 -C "my-agent-server"

It asks where to save — press Enter for the default.

It asks for a passphrase. Set one. It is the difference between someone stealing your laptop and someone stealing your laptop and your server.

Display the public half

cat ~/.ssh/id_ed25519.pub

One long line starting ssh-ed25519. Copy the entire line — it goes into Hetzner in the next step.

The private half never moves

The other file — id_ed25519, with no .pub — is the private half.

Never send it to anyone. Never paste it into a chat. Never put it in a shared drive. Treat it exactly like a password.

Next

Create the Server