This is the exact runbook we follow on every client server. Print it, paste it, follow it.
Minute 0–15 — the basics
- Create a non-root deploy user with sudo. Disable the root account entirely.
- Swap SSH keys only.
PasswordAuthentication no, then verify a second session before closing the first. - Move SSH off port 22 and set
MaxAuthTries 3. - Enable
ufw: deny inbound, allow SSH, HTTP and HTTPS.
Minute 15–45 — the stack
- Unattended security upgrades, with auto-reboot in your maintenance window.
- TLS via Let's Encrypt with auto-renewal, plus a redirect and HSTS.
- Fail2ban with a short ban window and a jail for nginx auth failures.
- Docker installed from the official repository — not the distro package.
Minute 45–75 — backups that are actually backups
An untested backup is a hope, not a backup. We restore into a throwaway container every week, compare checksums, and alert if the restore fails.
Minute 75–90 — seeing it
- A monitoring agent shipping CPU, memory, disk and certificate expiry.
- Alerts that page a human only for things a human can fix.
- A written runbook: what breaks, how to tell, what to do, who to call.
Ninety minutes, once, per server — and it is the single highest-leverage thing in this entire article.