VM bootstrap mechanism: a user-data script provided at droplet creation time runs on first boot and sets up the system. Strzibny uses it to avoid Ansible for simple setups — running apt upgrade, installing Docker, curl and utilities, enabling unattended-upgrades and fail2ban, configuring UFW, adding swap, creating a non-root 'pass_admin' sudo user in the docker group with the provisioned SSH key, disabling root login and optionally installing Tailscale.