healthtake is small. One cheap VPS runs it beside the other tools worth self-hosting — about ten minutes of work by hand, then you prompt an agent for the rest.
A record and Caddy or nginx in front. Health Auto Export and the Oura callback require public HTTPS — a private VPN name is for SSH, not the phone-facing path.Ubuntu LTS, your SSH public key pasted into the create form so password login never gets enabled at all.
An A record for your host → the instance IP. Do it early; the certificate needs the name to resolve.
Log in as root once, update, create a normal account with sudo, copy your key to it. Then install the coding agent you use and stop typing — from here you direct, review and ask for proof; the agent hardens the box, sets up nginx and the certificate, and installs healthtake from the repo’s README.
Delete the instance and create another. Everything on it is rebuilt by the same few prompts; the one file worth keeping is the SQLite ledger, so back that up off the box.
Cheap instances bill hourly. A box you kill after twenty minutes costs a fraction of a cent — the price of learning is not the interesting number here.
Your health samples and your provider tokens live on this host — its security is your data’s security. Revoke the Oura app and rotate the Hevy key and a wrecked server is inert.
Install healthtake from https://github.com/iXanadu/healthtake on this server, following the repo's README. Run it as its own service user, never as root. Bind it to loopback and put nginx in front with the certificate you just set up. Tell me what it requires before you start, and show me the command that proves each step took effect.
That is the whole technique: one step at a time, an explanation before the change, evidence after it. The full deploy notes live in the repository README.