Part of the DigitalOcean deploy series. Tested on Ubuntu 24.04, June 2026.

A droplet is a small virtual server that DigitalOcean rents you. In this first step we create one sized for a real Laravel SaaS, set up SSH keys the secure way, point a domain at it, and confirm we can log in.

Make an SSH key first

Do this before opening the DigitalOcean panel. Passwords on a public server get brute forced around the clock, so we use keys only, and we never turn on password login.

Generate an Ed25519 key on your own machine. Ed25519 is shorter and stronger than the old RSA default.

ssh-keygen -t ed25519 -C "you@example.com"

Press enter for the default path. A passphrase is optional. On macOS you can store it in the Keychain so you never type it again.

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Each developer machine should have its own key. There is no need to copy a private key between laptops. You just add each machine's public key to the server. Copy the public half now.

cat ~/.ssh/id_ed25519.pub

Create the droplet

In the DigitalOcean panel, click Create then Droplets, and work through the choices.

  • Region. Pick the data centre closest to most of your users. Distance affects both page first-byte time and how snappy SSH feels.
  • Image. Ubuntu 24.04 (LTS). LTS gives years of security updates.
  • Size. For a version one Laravel SaaS, the Basic plan at 12 dollars a month is the sweet spot: 2 GB RAM, 1 vCPU, 50 GB SSD. That comfortably runs Laravel, MySQL, Redis and Horizon on one box. You can resize later without rebuilding.
  • Authentication. Choose SSH Key, click New SSH Key, and paste the public key from above. Do not enable a password.
  • Extras. Give it a Project name for grouping (cosmetic only) and a clear hostname like yourapp-prod. Enable the free monitoring and improved metrics agent. IPv6 is free, so turn it on.

A word on backups. DigitalOcean's backup add-on is optional. If you skip it to save money, make a plan for off-server backups instead, for example a nightly mysqldump shipped to object storage. Do not run with no backups at all.

Click Create Droplet and note the IP address that appears.

Point your domain at the droplet

You have two clean patterns.

  • Pattern A: keep DNS at your registrar. Add an A record for the apex (yourdomain.com) and one for www, both pointing at the droplet IP.
  • Pattern B: move DNS to DigitalOcean. At your registrar, set the nameservers to ns1.digitalocean.com, ns2.digitalocean.com, ns3.digitalocean.com, then manage all records in the DO panel. This is cleaner to manage long term, so it is the one I recommend.

After changing nameservers, give it time and check that it resolves.

dig +short yourdomain.com

When that returns your droplet IP, DNS is ready. Caddy will need this working in step four to fetch an HTTPS certificate.

Log in for the first time

Connect as root using the IP. We log in as root only this once. The first job in step two is to make a proper user and shut root logins off.

ssh root@your_droplet_ip

Accept the fingerprint with yes and you should land at a root prompt.

That is step one. The droplet exists, your key works, and your domain is on its way. Next we lock the server down and create the user you will actually work as.