rewrite to debian

README.md

@@ -1 +1,312 @@
-# vps-config
+Uses debian 13 as I had difficulties setting up everything in nixos.
+
+# Personal Server Setup Guide
+
+This document explains how to rebuild and deploy the personal server stack on a fresh Debian VPS.
+
+The server uses:
+
+* Debian
+* Docker CE
+* Docker Compose
+* Caddy as reverse proxy
+* Containers for all self-hosted services
+* Git as the source of truth for configuration
+
+---
+
+# 1. Create the VPS
+
+Recommended:
+
+* Debian 13
+* SSH key authentication enabled
+* Public IPv4 enabled
+* Firewall enabled
+
+After creation:
+
+```bash
+ssh root@SERVER_IP
+```
+
+---
+
+# 2. Bootstrap the server
+
+Copy the bootstrap script to the server:
+
+```bash
+scp bootstrap.sh root@SERVER_IP:
+```
+
+Connect:
+
+```bash
+ssh root@SERVER_IP
+```
+
+Run:
+
+```bash
+chmod +x bootstrap.sh
+./bootstrap.sh
+```
+
+This installs:
+
+* Docker CE
+* Docker Compose
+* Git
+* Basic administration tools
+* Firewall rules
+
+Verify:
+
+```bash
+docker --version
+docker compose version
+```
+
+---
+
+# 3. Create an administrator user
+
+Do not run everything as root.
+
+Create a user:
+
+```bash
+adduser USERNAME
+```
+
+Add permissions:
+
+```bash
+usermod -aG sudo,docker USERNAME
+```
+
+Copy SSH keys:
+
+```bash
+mkdir -p /home/USERNAME/.ssh
+cp /root/.ssh/authorized_keys /home/USERNAME/.ssh/
+chown -R USERNAME:USERNAME /home/USERNAME/.ssh
+chmod 700 /home/USERNAME/.ssh
+chmod 600 /home/USERNAME/.ssh/authorized_keys
+```
+
+Test:
+
+```bash
+ssh USERNAME@SERVER_IP
+```
+
+---
+
+# 4. Clone the server configuration
+
+Create the deployment directory:
+
+```bash
+mkdir -p /opt/server
+cd /opt/server
+```
+
+Clone the configuration repository:
+
+```bash
+git clone YOUR_REPOSITORY_URL .
+```
+
+The structure should look like:
+
+```
+server/
+├── compose.yml
+├── Caddyfile
+├── .env
+├── scripts/
+└── README.md
+```
+
+---
+
+# 5. Configure secrets
+
+Never store passwords or tokens in Git.
+
+Create:
+
+```bash
+nano .env
+```
+
+Example:
+
+```env
+DOMAIN=example.com
+
+FRESHRSS_ADMIN_PASSWORD=change_me
+
+KDRIVE_USERNAME=user
+KDRIVE_PASSWORD=password
+```
+
+Set permissions:
+
+```bash
+chmod 600 .env
+```
+
+---
+
+# 6. Start the Docker stack
+
+From `/opt/server`:
+
+```bash
+docker compose up -d
+```
+
+Check running containers:
+
+```bash
+docker ps
+```
+
+View logs:
+
+```bash
+docker compose logs -f
+```
+
+---
+
+# 7. Reverse proxy
+
+Caddy handles HTTPS automatically.
+
+Example:
+
+```
+website.com
+├── freshrss.website.com
+├── archivebox.website.com
+├── hledger.website.com
+├── calendar.website.com
+└── ntfy.website.com
+```
+
+The `Caddyfile` defines where traffic goes.
+
+After changing it:
+
+```bash
+docker compose restart caddy
+```
+
+---
+
+# 8. Updating services
+
+Update images:
+
+```bash
+docker compose pull
+```
+
+Restart:
+
+```bash
+docker compose up -d
+```
+
+Remove unused images:
+
+```bash
+docker image prune
+```
+
+---
+
+# 9. Backups
+
+Important data is stored in Docker volumes.
+
+List volumes:
+
+```bash
+docker volume ls
+```
+
+Back up using:
+
+* restic
+* kDrive
+* another storage provider
+
+Recommended backup targets:
+
+```
+FreshRSS database
+ArchiveBox data
+Calendar/contact data
+hledger files
+Caddy configuration
+.env secrets
+```
+
+---
+
+# 10. Disaster recovery
+
+To rebuild:
+
+1. Install Debian
+2. Run `bootstrap.sh`
+3. Clone this repository
+4. Restore backups
+5. Restore `.env`
+6. Start Docker:
+
+```bash
+docker compose up -d
+```
+
+The complete server should be operational again.
+
+---
+
+# Planned services
+
+Current stack:
+
+* Caddy
+* FreshRSS
+* ArchiveBox
+* hledger-web
+* Calendar/contact server
+* ntfy
+* Monitoring
+
+Possible additions:
+
+* Uptime Kuma
+* Authelia or Authentik
+* Vaultwarden
+* Gitea
+* Miniflux
+* Mealie
+* Paperless-ngx
+
+---
+
+# Principles
+
+* Configuration belongs in Git
+* Data belongs in backups
+* Secrets never go into Git
+* Containers are disposable
+* Volumes contain persistent data
+* The server should be reproducible