name: vps-python-script-deploy

description: Write Python script locally, SCP to VPS, execute — bypass bash interpretation issues when patching remote files

category: devops

VPS Python Script Deploy — bypass bash interpretation

Problem

When trying to run Python scripts via sshpass ssh ... "python3 - << 'EOF' ...", bash interprets Python content as shell commands (backticks, $, etc.), causing syntax errors.

Solution

Write the Python script locally, SCP it to the VPS, then execute it:

`bash

sshpass -p 'PASSWORD' scp -o StrictHostKeyChecking=no /tmp/script.py root@VPS:/tmp/script.py

sshpass -p 'PASSWORD' ssh -o StrictHostKeyChecking=no root@VPS "python3 /tmp/script.py"

`

Why this works

• - No bash interpretation of Python content
• - No heredoc escaping issues
• - Clean separation between transport layer (SSH) and content layer (Python)

Common use cases

• - Applying multi-line patches to files on VPS
• - Complex file content modifications via Python (regex, string replacement)
• - Any time inline Python over SSH fails due to special characters

Prerequisites

• - sshpass installed locally
• - SSH password or key access to VPS
• - Python 3 on VPS

Gotchas

• - If the script needs to write to paths like /var/www/..., run as root or via sudo python3 /tmp/script.py
• - The SCP approach also works when the Python script contains complex regex patterns with special characters that would break in shell quoting
• - For very large scripts, consider bzip2 compression before SCP if bandwidth is a concern

Critical: NGINX configs with $ variables

HEREDOC OVER SSH CORRUPTS $ VARIABLES. Nginx configs contain $host, $request_uri, $scheme, $proxy_add_x_forwarded_for, $1, $2 etc. When you pass these through an SSH heredoc, the local shell interpolates the $ variables before sending, corrupting the config.

Wrong approach (CORRUPTS $ vars):

`bash

sshpass -p 'PASS' ssh root@VPS "cat > /etc/nginx/sites-available/example.com << 'EOF'

server {

server_name $host; # ← local shell empties this!

location / {

proxy_pass http://127.0.0.1:$port; # ← $port also gone

}

}

EOF"

`

Correct approach (write locally + SCP):

`bash

Write the nginx config locally with $ variables intact

cat > /tmp/example.com nginx.conf

server {

server_name $host;

location / {

proxy_pass http://127.0.0.1:$1;

}

}

EOF

SCP to VPS

sshpass -p 'PASS' scp -o StrictHostKeyChecking=no /tmp/example.com root@VPS:/etc/nginx/sites-available/example.com

Enable and reload

sshpass -p 'PASS' ssh root@VPS "ln -sf /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/ && nginx -t && nginx -s reload"

`

Also applies to:

• - Docker Compose files ($COMPOSE_PROJECT_NAME, $PASSWORD, etc.)
• - .env files with $ variables
• - Any config file containing shell metacharacters

Rule: If the file contains $ characters that should survive to the remote side, write locally and SCP. Never pipe through SSH heredoc.

Related

• - lovable-vps-disaster-recovery — for Lovable/TanStack Start VPS recovery
• - documentos-vps-debug — for DocCorretor-specific debugging