aidevsandbox

Spin up a hardened DigitalOcean dev box — Docker-ready, with Claude Code preinstalled — using one command. Networking is locked down so only your current public IP can reach the droplet, on every port. Terraform state stays local, in a folder you own.

npx aidevsandbox@latest

What it does

1. Scaffolds a Terraform project (local state) into ./aidevsandbox.
2. Auto-detects your public IP and locks the droplet's cloud firewall to it.
3. Installs your SSH public key (key-only login; root login & passwords disabled).
4. Provisions an Ubuntu 24.04 droplet (default 2 vCPU / 4 GB, region sgp1) with Docker, Node.js LTS, Claude Code, and your git identity configured.
5. Runs terraform init / plan / apply and prints your ssh command.

You finish by SSHing in and running claude to log in (no secrets are stored in Terraform state).

Requirements

• Terraform ≥ 1.5 on your PATH
• A DigitalOcean API token (read/write)
• An SSH key pair (~/.ssh/id_ed25519 recommended)

Usage

# token via env (recommended) — never written to disk:
export DIGITALOCEAN_TOKEN=dop_v1_xxx
npx aidevsandbox@latest

Options:

| Flag | Description | | --- | --- | | --dir <path> | Target directory (default ./aidevsandbox) | | --force | Overwrite templates if the dir already has *.tf | | --dry-run | Scaffold + detect IP/key, but don't run terraform | | -h, --help | Show help |

Security model

• Cloud firewall (network edge): inbound tcp/udp/icmp allowed only from your <ip>/32; everything else denied. Outbound is open so the box can pull packages and reach the Anthropic API.
• Host firewall (ufw) mirrors the same rule as defense-in-depth, plus fail2ban and unattended-upgrades.
• SSH is key-only: PermitRootLogin no, PasswordAuthentication no.
• The DO token is passed to Terraform via the environment and is never written to terraform.tfvars. State files are git-ignored.

When your IP changes

Re-run the CLI (or terraform apply inside the project folder) — it re-detects your IP and updates just the firewall rule. The droplet is left untouched.

Tear down

cd aidevsandbox
terraform destroy

License

MIT