From 8a88673c320f36bed6887709cbcdb59370f8a2c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1s=20Rivera?= Date: Thu, 23 Jul 2026 17:57:17 +0200 Subject: [PATCH] rewrite to debian --- README.md | 313 +++++++++++++++++++++++++++++++++++++++++++++- bootstrap.sh | 71 +++++++++++ configuration.nix | 36 ------ disko.nix | 39 ------ flake.nix | 39 ------ home.nix | 5 - users.nix | 7 -- 7 files changed, 383 insertions(+), 127 deletions(-) create mode 100755 bootstrap.sh delete mode 100644 configuration.nix delete mode 100644 disko.nix delete mode 100644 flake.nix delete mode 100644 home.nix delete mode 100644 users.nix diff --git a/README.md b/README.md index a725845..89081d0 100644 --- a/README.md +++ b/README.md @@ -1 +1,312 @@ -# vps-config \ No newline at end of file +Uses debian 13 as I had difficulties setting up everything in nixos. + +# Personal Server Setup Guide + +This document explains how to rebuild and deploy the personal server stack on a fresh Debian VPS. + +The server uses: + +* Debian +* Docker CE +* Docker Compose +* Caddy as reverse proxy +* Containers for all self-hosted services +* Git as the source of truth for configuration + +--- + +# 1. Create the VPS + +Recommended: + +* Debian 13 +* SSH key authentication enabled +* Public IPv4 enabled +* Firewall enabled + +After creation: + +```bash +ssh root@SERVER_IP +``` + +--- + +# 2. Bootstrap the server + +Copy the bootstrap script to the server: + +```bash +scp bootstrap.sh root@SERVER_IP: +``` + +Connect: + +```bash +ssh root@SERVER_IP +``` + +Run: + +```bash +chmod +x bootstrap.sh +./bootstrap.sh +``` + +This installs: + +* Docker CE +* Docker Compose +* Git +* Basic administration tools +* Firewall rules + +Verify: + +```bash +docker --version +docker compose version +``` + +--- + +# 3. Create an administrator user + +Do not run everything as root. + +Create a user: + +```bash +adduser USERNAME +``` + +Add permissions: + +```bash +usermod -aG sudo,docker USERNAME +``` + +Copy SSH keys: + +```bash +mkdir -p /home/USERNAME/.ssh +cp /root/.ssh/authorized_keys /home/USERNAME/.ssh/ +chown -R USERNAME:USERNAME /home/USERNAME/.ssh +chmod 700 /home/USERNAME/.ssh +chmod 600 /home/USERNAME/.ssh/authorized_keys +``` + +Test: + +```bash +ssh USERNAME@SERVER_IP +``` + +--- + +# 4. Clone the server configuration + +Create the deployment directory: + +```bash +mkdir -p /opt/server +cd /opt/server +``` + +Clone the configuration repository: + +```bash +git clone YOUR_REPOSITORY_URL . +``` + +The structure should look like: + +``` +server/ +├── compose.yml +├── Caddyfile +├── .env +├── scripts/ +└── README.md +``` + +--- + +# 5. Configure secrets + +Never store passwords or tokens in Git. + +Create: + +```bash +nano .env +``` + +Example: + +```env +DOMAIN=example.com + +FRESHRSS_ADMIN_PASSWORD=change_me + +KDRIVE_USERNAME=user +KDRIVE_PASSWORD=password +``` + +Set permissions: + +```bash +chmod 600 .env +``` + +--- + +# 6. Start the Docker stack + +From `/opt/server`: + +```bash +docker compose up -d +``` + +Check running containers: + +```bash +docker ps +``` + +View logs: + +```bash +docker compose logs -f +``` + +--- + +# 7. Reverse proxy + +Caddy handles HTTPS automatically. + +Example: + +``` +website.com +├── freshrss.website.com +├── archivebox.website.com +├── hledger.website.com +├── calendar.website.com +└── ntfy.website.com +``` + +The `Caddyfile` defines where traffic goes. + +After changing it: + +```bash +docker compose restart caddy +``` + +--- + +# 8. Updating services + +Update images: + +```bash +docker compose pull +``` + +Restart: + +```bash +docker compose up -d +``` + +Remove unused images: + +```bash +docker image prune +``` + +--- + +# 9. Backups + +Important data is stored in Docker volumes. + +List volumes: + +```bash +docker volume ls +``` + +Back up using: + +* restic +* kDrive +* another storage provider + +Recommended backup targets: + +``` +FreshRSS database +ArchiveBox data +Calendar/contact data +hledger files +Caddy configuration +.env secrets +``` + +--- + +# 10. Disaster recovery + +To rebuild: + +1. Install Debian +2. Run `bootstrap.sh` +3. Clone this repository +4. Restore backups +5. Restore `.env` +6. Start Docker: + +```bash +docker compose up -d +``` + +The complete server should be operational again. + +--- + +# Planned services + +Current stack: + +* Caddy +* FreshRSS +* ArchiveBox +* hledger-web +* Calendar/contact server +* ntfy +* Monitoring + +Possible additions: + +* Uptime Kuma +* Authelia or Authentik +* Vaultwarden +* Gitea +* Miniflux +* Mealie +* Paperless-ngx + +--- + +# Principles + +* Configuration belongs in Git +* Data belongs in backups +* Secrets never go into Git +* Containers are disposable +* Volumes contain persistent data +* The server should be reproducible diff --git a/bootstrap.sh b/bootstrap.sh new file mode 100755 index 0000000..8eff7ca --- /dev/null +++ b/bootstrap.sh @@ -0,0 +1,71 @@ +#!/usr/bin/env bash +set -euo pipefail + +echo "== Updating system ==" +apt update +apt upgrade -y + +echo "== Installing base packages ==" +apt install -y \ + ca-certificates \ + curl \ + gnupg \ + git \ + vim \ + htop \ + unzip \ + rsync \ + jq \ + ufw + +echo "== Installing Docker repository key ==" +install -m 0755 -d /etc/apt/keyrings + +curl -fsSL https://download.docker.com/linux/debian/gpg \ + -o /etc/apt/keyrings/docker.asc + +chmod a+r /etc/apt/keyrings/docker.asc + +echo "== Adding Docker repository ==" +echo \ + "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \ + https://download.docker.com/linux/debian \ + $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \ + > /etc/apt/sources.list.d/docker.list + +apt update + +echo "== Installing Docker ==" +apt install -y \ + docker-ce \ + docker-ce-cli \ + containerd.io \ + docker-buildx-plugin \ + docker-compose-plugin + +systemctl enable docker +systemctl start docker + +echo "== Configuring firewall ==" +ufw default deny incoming +ufw default allow outgoing + +# SSH +ufw allow 22/tcp + +# Web +ufw allow 80/tcp +ufw allow 443/tcp + +ufw --force enable + +echo "== Enabling useful services ==" +systemctl enable --now ssh + +echo +echo "================================" +echo "Bootstrap finished!" +echo +docker --version +docker compose version +echo "================================" diff --git a/configuration.nix b/configuration.nix deleted file mode 100644 index ef75e95..0000000 --- a/configuration.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ pkgs, ... }: - -{ - system.stateVersion = "26.05"; - - networking.hostName = "server"; - - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - - services.openssh = { - enable = true; - - settings = { - PasswordAuthentication = false; - PermitRootLogin = "prohibit-password"; - }; - }; - - networking.firewall = { - enable = true; - - allowedTCPPorts = [ - 22 - 80 - 443 - ]; - }; - - environment.systemPackages = with pkgs; [ - git - vim - curl - wget - ]; -} diff --git a/disko.nix b/disko.nix deleted file mode 100644 index c11c398..0000000 --- a/disko.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ - disko.devices = { - disk = { - main = { - device = "/dev/sda"; - - type = "disk"; - - content = { - type = "gpt"; - - partitions = { - ESP = { - size = "512M"; - - type = "EF00"; - - content = { - type = "filesystem"; - format = "vfat"; - mountpoint = "/boot"; - }; - }; - - root = { - size = "100%"; - - content = { - type = "filesystem"; - format = "ext4"; - mountpoint = "/"; - }; - }; - }; - }; - }; - }; - }; -} diff --git a/flake.nix b/flake.nix deleted file mode 100644 index 8777f40..0000000 --- a/flake.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ - description = "Hetzner NixOS vps"; - - inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; - - disko = { - url = "github:nix-community/disko"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - - nixos-anywhere.url = "github:numtide/nixos-anywhere"; - - home-manager = { - url = "github:nix-community/home-manager/release-26.05"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - }; - - outputs = { self, nixpkgs, disko, home-manager, ... }: - { - nixosConfigurations.server = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - - modules = [ - disko.nixosModules.disko - ./disko.nix - ./configuration.nix - ./users.nix - - home-manager.nixosModules.home-manager - - { - home-manager.users.root = import ./home.nix; - } - ]; - }; - }; -} diff --git a/home.nix b/home.nix deleted file mode 100644 index 0933233..0000000 --- a/home.nix +++ /dev/null @@ -1,5 +0,0 @@ -{ - home.stateVersion = "26.05"; - - programs.bash.enable = true; -} diff --git a/users.nix b/users.nix deleted file mode 100644 index a450f7e..0000000 --- a/users.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ - users.users.root = { - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC6WNm4YAQO85j0aNQkKSH7QnmhgzKA4hA2ggi6cDyKk" - ]; - }; -}