A hardened Ubuntu web server, managed from Git
The server this site runs on: key-only SSH, a firewall, Caddy with automatic HTTPS, and every setting kept in a Git repo.
- Where
- Home lab
- When
- 2026
- My role
- Everything
This site runs on a small Ubuntu virtual server that I built and manage myself. It’s on the internet, so I assume something is always knocking on the door.
- SSH hardening: key-only login, no root login, and keys stored in a password manager.
- Firewall: only SSH and web traffic are allowed in.
- Caddy web server with automatic HTTPS certificates (no more calendar reminders for certificate renewals).
- One PHP pool and Unix user per site for the blog sites it hosts, so one site can’t read another’s files.
- Nightly backups of site content, kept for two weeks.
- Configuration as code: every setting lives in a Git repo, applied by an idempotent setup script that shows a diff of each change. Rebuilding from scratch is a documented procedure, not a weekend of trying to remember what I did.
- This site is built with Hugo. Publishing is just a Git push (the server pulls and rebuilds it every couple of minutes).