Project: A Server from Scratch

Aroma Café has a brand-new server. The site already answers on plain http — nothing else is done. Marta left a checklist:

cat ~/new-server.txt

Everything on it is something you've done in a lesson — now all together, on one server, in the order a real setup goes.

1. Firewall

Only SSH, HTTP and HTTPS may come in. Allow SSH before you turn the firewall on:

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

2. SSH: keys only, no root

Your key is in ~/.ssh/authorized_keys. Then a drop-in file that comes first, a test and a reload:

sudo nano /etc/ssh/sshd_config.d/10-hardening.conf
sudo sshd -t && sudo systemctl reload ssh

3. fail2ban

sudo apt install fail2ban
sudo fail2ban-client status sshd

4. HTTPS

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d aroma.example -d www.aroma.example

5. A nightly backup to backup01

rsync the site to backup@backup01:/srv/backups/aroma/, from a oneshot service that runs as student (your key is the one backup01 accepts) and a timer that starts it every night:

# /etc/systemd/system/site-backup.service
[Unit]
Description=Back up the web site to backup01

[Service]
Type=oneshot
User=student
ExecStart=/usr/bin/rsync -a --delete /var/www/aroma/ backup@backup01:/srv/backups/aroma/

# /etc/systemd/system/site-backup.timer
[Unit]
Description=Back up the web site every night

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true

[Install]
WantedBy=timers.target

sudo apt install rsync
sudo systemctl daemon-reload
sudo systemctl start site-backup.service
sudo systemctl enable --now site-backup.timer

Run the service once by hand — then you know the backup works before the first night.