AI Agent VPS Deployment Cost Optimization: A Step-by-Step Playbook

1# Install monitoring tools
2sudo apt-get install -y sysstat htop
3
4# Run your agent locally and capture resource usage over 30 minutes
5sar -u -r -d 5 360 > agent_profile_$(date +%Y%m%d).log
6
7# Quick summary: peak CPU, average memory, disk I/O
8echo "=== CPU Peak ==="
9sar -u -f /var/log/sysstat/sa$(date +%d) | awk 'NR>3 {print 100-$NF}' | sort -rn | head -1
10echo "=== Memory Peak (MB) ==="
11sar -r -f /var/log/sysstat/sa$(date +%d) | awk 'NR>3 {print $4/1024}' | sort -rn | head -1

1# main.tf — Vultr VPS for AI agent deployment
2terraform {
3  required_providers {
4    vultr = {
5      source  = "vultr/vultr"
6      version = "~> 2.19"
7    }
8  }
9}
10
11provider "vultr" {
12  api_key = var.vultr_api_key
13}
14
15resource "vultr_instance" "ai_agent" {
16  plan     = "vc2-2c-4gb"  # 2 vCPU, 4GB RAM — USD $24/month
17  region   = "sgp"          # Singapore
18  os_id    = 2136            # Ubuntu 24.04 LTS
19  hostname = "agent-prod-sgp-01"
20  label    = "ai-agent-production"
21
22  backups          = "disabled"  # Use snapshots instead — saves ~20%
23  enable_ipv6      = true
24  ddos_protection  = false        # Enable only if public-facing
25
26  tags = ["ai-agent", "production", "cost-optimized"]
27}
28
29output "instance_ip" {
30  value = vultr_instance.ai_agent.main_ip
31}

1# Deploy
2terraform init
3terraform plan -out=agent.plan
4terraform apply agent.plan
5
6# When you need to destroy (stops billing immediately)
7terraform destroy -auto-approve

1# docker-compose.yml
2version: '3.8'
3
4services:
5  ai-agent:
6    build:
7      context: ./agent
8      dockerfile: Dockerfile
9    container_name: agent-primary
10    restart: unless-stopped
11    deploy:
12      resources:
13        limits:
14          cpus: '1.5'
15          memory: 2G
16        reservations:
17          cpus: '0.5'
18          memory: 512M
19    environment:
20      - OPENAI_API_KEY=${OPENAI_API_KEY}
21      - AGENT_MAX_ITERATIONS=25
22      - AGENT_TIMEOUT_SECONDS=120
23      - TOKEN_BUDGET_PER_RUN=8000
24    volumes:
25      - agent-data:/app/data
26      - ./logs:/app/logs
27    logging:
28      driver: json-file
29      options:
30        max-size: "10m"
31        max-file: "3"
32
33  redis:
34    image: redis:7-alpine
35    container_name: agent-cache
36    restart: unless-stopped
37    deploy:
38      resources:
39        limits:
40          cpus: '0.25'
41          memory: 256M
42    command: redis-server --maxmemory 200mb --maxmemory-policy allkeys-lru
43    volumes:
44      - redis-data:/data
45
46volumes:
47  agent-data:
48  redis-data:

1# cost_controller.py — Token budget enforcement
2import os
3import json
4from datetime import datetime, timezone
5from pathlib import Path
6
7class TokenBudgetController:
8    """Enforces per-run and daily token budgets for AI agents."""
9
10    def __init__(self):
11        self.per_run_limit = int(os.getenv("TOKEN_BUDGET_PER_RUN", 8000))
12        self.daily_limit = int(os.getenv("TOKEN_BUDGET_DAILY", 200000))
13        self.cost_per_1k_input = float(os.getenv("COST_PER_1K_INPUT", 0.003))   # GPT-4o-mini
14        self.cost_per_1k_output = float(os.getenv("COST_PER_1K_OUTPUT", 0.012))
15        self.ledger_path = Path("/app/data/token_ledger.json")
16        self._load_ledger()
17
18    def _load_ledger(self):
19        if self.ledger_path.exists():
20            self.ledger = json.loads(self.ledger_path.read_text())
21        else:
22            self.ledger = {"date": self._today(), "total_tokens": 0, "total_cost_usd": 0}
23
24        # Reset daily counter if new day
25        if self.ledger["date"] != self._today():
26            self.ledger = {"date": self._today(), "total_tokens": 0, "total_cost_usd": 0}
27
28    def _today(self):
29        return datetime.now(timezone.utc).strftime("%Y-%m-%d")
30
31    def can_spend(self, estimated_tokens: int) -> bool:
32        return (self.ledger["total_tokens"] + estimated_tokens) <= self.daily_limit
33
34    def record_usage(self, input_tokens: int, output_tokens: int):
35        total = input_tokens + output_tokens
36        cost = (input_tokens / 1000 * self.cost_per_1k_input) + \
37               (output_tokens / 1000 * self.cost_per_1k_output)
38        self.ledger["total_tokens"] += total
39        self.ledger["total_cost_usd"] += round(cost, 6)
40        self.ledger_path.write_text(json.dumps(self.ledger, indent=2))
41        return {"tokens_used": total, "cost_usd": cost, "daily_remaining": self.daily_limit - self.ledger["total_tokens"]}
42
43    def get_daily_spend(self) -> float:
44        return self.ledger["total_cost_usd"]

1# Quick test
2export TOKEN_BUDGET_PER_RUN=8000
3export TOKEN_BUDGET_DAILY=200000
4export COST_PER_1K_INPUT=0.003
5export COST_PER_1K_OUTPUT=0.012
6python -c "
7from cost_controller import TokenBudgetController
8ctrl = TokenBudgetController()
9print('Can spend 5000 tokens:', ctrl.can_spend(5000))
10result = ctrl.record_usage(input_tokens=3000, output_tokens=1500)
11print('Usage recorded:', result)
12"

1Can spend 5000 tokens: True
2Usage recorded: {'tokens_used': 4500, 'cost_usd': 0.027, 'daily_remaining': 195500}

1# cache_layer.py
2import hashlib
3import json
4import redis
5
6class ResponseCache:
7    def __init__(self, redis_url="redis://agent-cache:6379", ttl_hours=24):
8        self.client = redis.from_url(redis_url)
9        self.ttl = ttl_hours * 3600
10
11    def _hash_prompt(self, messages: list) -> str:
12        content = json.dumps(messages, sort_keys=True)
13        return f"llm_cache:{hashlib.sha256(content.encode()).hexdigest()[:16]}"
14
15    def get(self, messages: list) -> dict | None:
16        key = self._hash_prompt(messages)
17        cached = self.client.get(key)
18        if cached:
19            return json.loads(cached)
20        return None
21
22    def set(self, messages: list, response: dict):
23        key = self._hash_prompt(messages)
24        self.client.setex(key, self.ttl, json.dumps(response))

1# Install node_exporter for VPS metrics
2wget https://github.com/prometheus/node_exporter/releases/download/v1.8.1/node_exporter-1.8.1.linux-amd64.tar.gz
3tar xvf node_exporter-1.8.1.linux-amd64.tar.gz
4sudo cp node_exporter-1.8.1.linux-amd64/node_exporter /usr/local/bin/
5
6# Create systemd service
7sudo tee /etc/systemd/system/node_exporter.service > /dev/null <<EOF
8[Unit]
9Description=Node Exporter
10After=network.target
11
12[Service]
13User=nobody
14ExecStart=/usr/local/bin/node_exporter
15Restart=always
16
17[Install]
18WantedBy=multi-user.target
19EOF
20
21sudo systemctl daemon-reload
22sudo systemctl enable --now node_exporter

1#!/usr/bin/env python3
2# daily_cost_alert.py — runs via cron at 23:00 UTC
3import json
4import os
5import urllib.request
6from pathlib import Path
7
8LEDGER = Path("/app/data/token_ledger.json")
9VPS_DAILY_COST = float(os.getenv("VPS_MONTHLY_COST", 24)) / 30
10ALERT_THRESHOLD = float(os.getenv("DAILY_COST_ALERT_USD", 15.0))
11WEBHOOK_URL = os.getenv("SLACK_WEBHOOK_URL", "")
12
13def send_alert(message: str):
14    if not WEBHOOK_URL:
15        print(message)
16        return
17    payload = json.dumps({"text": message}).encode()
18    req = urllib.request.Request(WEBHOOK_URL, data=payload,
19                                  headers={"Content-Type": "application/json"})
20    urllib.request.urlopen(req)
21
22def main():
23    ledger = json.loads(LEDGER.read_text()) if LEDGER.exists() else {"total_cost_usd": 0}
24    api_cost = ledger.get("total_cost_usd", 0)
25    total_daily = api_cost + VPS_DAILY_COST
26
27    report = (f":bar_chart: Daily AI Agent Cost Report\n"
28              f"• VPS: ${VPS_DAILY_COST:.2f}\n"
29              f"• API: ${api_cost:.2f}\n"
30              f"• Total: ${total_daily:.2f}\n"
31              f"• Monthly projection: ${total_daily * 30:.2f}")
32
33    if total_daily > ALERT_THRESHOLD:
34        report = f":rotating_light: COST ALERT — daily spend ${total_daily:.2f} exceeds ${ALERT_THRESHOLD:.2f}\n" + report
35
36    send_alert(report)
37
38if __name__ == "__main__":
39    main()

1# Add to crontab
2(crontab -l 2>/dev/null; echo "0 23 * * * /usr/bin/python3 /app/scripts/daily_cost_alert.py") | crontab -

1# Basic hardening script — run after initial provisioning
2#!/bin/bash
3set -euo pipefail
4
5# Disable root login
6sudo sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
7sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
8sudo systemctl restart sshd
9
10# Install and configure UFW
11sudo apt-get install -y ufw
12sudo ufw default deny incoming
13sudo ufw default allow outgoing
14sudo ufw allow 22/tcp    # SSH
15sudo ufw allow 443/tcp   # HTTPS (if serving API)
16sudo ufw --force enable
17
18# Install fail2ban
19sudo apt-get install -y fail2ban
20sudo tee /etc/fail2ban/jail.local > /dev/null <<EOF
21[sshd]
22enabled = true
23maxretry = 3
24bantime = 3600
25findtime = 600
26EOF
27sudo systemctl enable --now fail2ban
28
29# Automatic security updates
30sudo apt-get install -y unattended-upgrades
31sudo dpkg-reconfigure -plow unattended-upgrades
32
33echo "Hardening complete. Verify with: sudo ufw status && sudo fail2ban-client status sshd"

1Status: active
2To                         Action      From
3--                         ------      ----
422/tcp                     ALLOW       Anywhere
5443/tcp                    ALLOW       Anywhere
6
7Status for the jail: sshd
8|- Filter
9|  |- Currently failed: 0
10|  |- Total failed:     0
11|  `- File list:        /var/log/auth.log
12`- Actions
13   |- Currently banned: 0
14   |- Total banned:     0
15   `- Banned IP list: