Set up a personal family VPN with an AI agent

The goal and what the post actually shows

The goal is a personal VPN for a family without manually performing every administration step. The post proposes a rented VPS, agent SSH access, and separate connection links and QR codes for three people.

The picture illustrates the workflow; it is not a completed deployment screenshot or an importable configuration. In this guide OpenCode runs on your computer, connects to a model through Void API, and executes permitted SSH commands against your VPS.

Read the source post (Russian)

1. Prepare the VPS and device details

Use a VPS you control, with a public address, supported Linux installation, SSH port, user, and an authentication method. The source mentions VDSka as an example; VPS hosting is separate from your Void API balance. Confirm access to the hosting control panel’s recovery console before server changes.

List each participant’s device, operating system, and existing client. Decide which apps need a direct connection and which traffic should use the tunnel. Hysteria 2 needs usable UDP connectivity; VLESS requirements depend on transport and client support.

Hosting provider mentioned in the post

2. Install and connect OpenCode using the Void API guide

Open the OpenCode connection guide on Void API. It links to the tool’s site for installation and provides the provider configuration and launch steps. If needed, follow that link, install the version for your OS, and return to configure Void API. Run the agent on the computer from which you will administer the VPS.

Create a gateway API key and check your balance. Use a separate project folder. The same three setup steps are reproduced below directly from the Void API guide generator: VOID_API_KEY, opencode.json, and launch. Replace MODEL_ID with a current tool-capable model ID from the catalog; keep the real key in the environment variable, not the JSON file.

Launch OpenCode, run /models, and select the Void API model. Test a short text response, then ask it to list project files, before connecting to the VPS. For a 401 check the key and terminal environment; for balance or model errors check the account and current catalog.

export VOID_API_KEY='void_your_key'

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "void-api": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Void API",
      "options": {
        "baseURL": "https://void-api.tech/v1",
        "apiKey": "{env:VOID_API_KEY}"
      },
      "models": {
        "MODEL_ID": {
          "name": "MODEL_ID",
          "attachment": true,
          "modalities": {
            "input": [
              "text",
              "image"
            ],
            "output": [
              "text"
            ]
          }
        }
      }
    }
  }
}

opencode
/models

Full OpenCode setup guide on Void API·Create an API key·Account balance·Model catalog

3. Establish SSH access from the agent computer

First test a normal SSH login using the address, port, and user supplied by the host. Complete any initial password change in your terminal. If using keys, install the public key on the VPS and retain the private key locally.

A local SSH alias such as family-vps makes the handoff simpler. The example belongs in SSH configuration, not opencode.json. Replace the documentation address, user, port, and key path; then test ssh family-vps. Give the agent the alias rather than pasting your private key or password into a prompt.

Ask for a read-only inspection of the OS, resources, occupied ports, services, and firewall. Mention existing websites or applications so the installation preserves their configuration and does not reinstall the OS.

Host family-vps
  HostName 203.0.113.10
  User YOUR_SSH_USER
  Port 22
  IdentityFile ~/.ssh/family-vps

ssh family-vps

4. Brief the agent

State that you own the server and that it is reachable as family-vps. Provide participant and device details. Ask the agent to clarify missing information and propose a plan before executing it.

The translated source prompt below requests not only a service but also separate profiles, device instructions, and repeatable deployment. Replace the participant descriptions as appropriate.

Set up a personal VPN on my VPS for three people.
Inspect the server and choose a suitable option: VLESS or Hysteria 2.
Configure the service, firewall, security updates, and automatic startup.
Create separate profiles for me and two family members.
Help configure split routing on our devices: selected local apps and sites directly, other selected traffic through the VPN. Ask about our devices and apps first.
Provide connection links, QR codes, and a short connection guide.
Prepare a repeatable deployment procedure for moving to a new server.

5. Select a protocol after inspection

Ask the agent to explain the VLESS or Hysteria 2 choice based on server OS, connectivity, and support across the devices. Domain and certificate requirements vary by mode; establish them for the actual configuration rather than assuming one universal setup.

The plan should identify services, ports, configuration locations, updates, and automatic startup. Preserve the active SSH port when changing the firewall. Verify service status and logs after installation instead of relying solely on an installer success message.

Xray documentation·Hysteria 2 documentation

6. Generate three separate profiles and QR codes

Request individual credentials or configurations for all participants. Independent profiles let you replace or revoke one without changing the others. Provide a clear name, connection link, and QR code where supported.

Save a short guide, profile-to-participant mapping, and connection files in the project. Links and QR codes grant access to your server; share each only with its intended participant, not in a public case study or repository.

7. Connect one device at a time

Select clients supporting the actual protocol and operating systems. Ask for device-specific steps for importing a link, scanning a QR code, and enabling a profile. Different platforms can use different clients as long as protocol and configuration support match.

Import the first participant’s profile, enable it, and test the intended connection. Repeat for the remaining devices. If import fails, verify the URI type, client support, and configuration completeness before generating replacement profiles.

8. Configure split routing on the devices

The source suggests direct routing for Russian apps and sites and tunneling selected other traffic. Available controls vary: domain lists, per-app rules, TUN mode, or other routing options. The agent must know the actual devices and clients first.

Create a small test list and ask which rule applies to each service. Check DNS together with the client mode. Installing a server does not automatically configure split routing on every phone and computer.

Verify both direct and VPS-routed traffic. Split routing controls network paths; it does not guarantee access to every site or protect the server IP against blocking. The scenario concerns a personal protected connection.

9. Verify and document the result

Request a report covering protocol choice, service, port, configuration paths, startup status, profiles, and verification steps. Test each participant’s connection, intended routes, and reconnection behavior.

Confirm SSH remains available and arrange a VPS reboot check. Give the agent exact error text and time so it can inspect the corresponding logs. A QR code or the source illustration is not evidence that a connection works.

10. Prepare repeatable deployment and migration

Save an installation procedure and README describing the supported OS, dependencies, services, ports, firewall, and checks. Keep profile secrets separate from public instructions.

For migration, prepare another VPS, verify SSH, and give the agent a new alias. Apply the saved procedure, update endpoint details, and test all devices before retiring the old server. Repeatability helps but does not guarantee an instant migration.

Troubleshooting: what to tell the agent

If OpenCode fails, check the environment key, /v1 base URL, selected model ID, balance, and tool support using the Void API guide. For SSH failures, independently verify the host, port, user, and local authentication.

For an imported profile that cannot connect, provide OS, client version, protocol, attempt time, and a redacted error. Check the correct TCP or UDP port, firewall, service log, and profile parameters. If only some apps fail, inspect routing and DNS separately.

Locate the failing layer before reinstalling: model access, SSH, server service, client profile, or routing. Fixing the specific cause preserves working settings.

Void API OpenCode guide·API reference·Original case (Russian)

Frequently asked questions

More guides to LLM API access

LLM API from Russia: one AI API aggregator·How to buy LLM API access and estimate your costs·How to try an AI API for free with promo credit·LLM subscription or pay-as-you-go API access from Russia·Popular and powerful AI models: online LLM usage ranking·Practical AI chat and agent use cases with Void Chat·Audit a website with AI and build an actionable SEO plan·Create PDFs with AI: five labels from one reference image·Plan a trip with AI: a China itinerary and travel PDF·Edit a 3D model through chat with Claude