rewrite to debian

README.md

@@ -1 +1,312 @@
-# vps-config
+Uses debian 13 as I had difficulties setting up everything in nixos.
+
+# Personal Server Setup Guide
+
+This document explains how to rebuild and deploy the personal server stack on a fresh Debian VPS.
+
+The server uses:
+
+* Debian
+* Docker CE
+* Docker Compose
+* Caddy as reverse proxy
+* Containers for all self-hosted services
+* Git as the source of truth for configuration
+
+---
+
+# 1. Create the VPS
+
+Recommended:
+
+* Debian 13
+* SSH key authentication enabled
+* Public IPv4 enabled
+* Firewall enabled
+
+After creation:
+
+```bash
+ssh root@SERVER_IP
+```
+
+---
+
+# 2. Bootstrap the server
+
+Copy the bootstrap script to the server:
+
+```bash
+scp bootstrap.sh root@SERVER_IP:
+```
+
+Connect:
+
+```bash
+ssh root@SERVER_IP
+```
+
+Run:
+
+```bash
+chmod +x bootstrap.sh
+./bootstrap.sh
+```
+
+This installs:
+
+* Docker CE
+* Docker Compose
+* Git
+* Basic administration tools
+* Firewall rules
+
+Verify:
+
+```bash
+docker --version
+docker compose version
+```
+
+---
+
+# 3. Create an administrator user
+
+Do not run everything as root.
+
+Create a user:
+
+```bash
+adduser USERNAME
+```
+
+Add permissions:
+
+```bash
+usermod -aG sudo,docker USERNAME
+```
+
+Copy SSH keys:
+
+```bash
+mkdir -p /home/USERNAME/.ssh
+cp /root/.ssh/authorized_keys /home/USERNAME/.ssh/
+chown -R USERNAME:USERNAME /home/USERNAME/.ssh
+chmod 700 /home/USERNAME/.ssh
+chmod 600 /home/USERNAME/.ssh/authorized_keys
+```
+
+Test:
+
+```bash
+ssh USERNAME@SERVER_IP
+```
+
+---
+
+# 4. Clone the server configuration
+
+Create the deployment directory:
+
+```bash
+mkdir -p /opt/server
+cd /opt/server
+```
+
+Clone the configuration repository:
+
+```bash
+git clone YOUR_REPOSITORY_URL .
+```
+
+The structure should look like:
+
+```
+server/
+├── compose.yml
+├── Caddyfile
+├── .env
+├── scripts/
+└── README.md
+```
+
+---
+
+# 5. Configure secrets
+
+Never store passwords or tokens in Git.
+
+Create:
+
+```bash
+nano .env
+```
+
+Example:
+
+```env
+DOMAIN=example.com
+
+FRESHRSS_ADMIN_PASSWORD=change_me
+
+KDRIVE_USERNAME=user
+KDRIVE_PASSWORD=password
+```
+
+Set permissions:
+
+```bash
+chmod 600 .env
+```
+
+---
+
+# 6. Start the Docker stack
+
+From `/opt/server`:
+
+```bash
+docker compose up -d
+```
+
+Check running containers:
+
+```bash
+docker ps
+```
+
+View logs:
+
+```bash
+docker compose logs -f
+```
+
+---
+
+# 7. Reverse proxy
+
+Caddy handles HTTPS automatically.
+
+Example:
+
+```
+website.com
+├── freshrss.website.com
+├── archivebox.website.com
+├── hledger.website.com
+├── calendar.website.com
+└── ntfy.website.com
+```
+
+The `Caddyfile` defines where traffic goes.
+
+After changing it:
+
+```bash
+docker compose restart caddy
+```
+
+---
+
+# 8. Updating services
+
+Update images:
+
+```bash
+docker compose pull
+```
+
+Restart:
+
+```bash
+docker compose up -d
+```
+
+Remove unused images:
+
+```bash
+docker image prune
+```
+
+---
+
+# 9. Backups
+
+Important data is stored in Docker volumes.
+
+List volumes:
+
+```bash
+docker volume ls
+```
+
+Back up using:
+
+* restic
+* kDrive
+* another storage provider
+
+Recommended backup targets:
+
+```
+FreshRSS database
+ArchiveBox data
+Calendar/contact data
+hledger files
+Caddy configuration
+.env secrets
+```
+
+---
+
+# 10. Disaster recovery
+
+To rebuild:
+
+1. Install Debian
+2. Run `bootstrap.sh`
+3. Clone this repository
+4. Restore backups
+5. Restore `.env`
+6. Start Docker:
+
+```bash
+docker compose up -d
+```
+
+The complete server should be operational again.
+
+---
+
+# Planned services
+
+Current stack:
+
+* Caddy
+* FreshRSS
+* ArchiveBox
+* hledger-web
+* Calendar/contact server
+* ntfy
+* Monitoring
+
+Possible additions:
+
+* Uptime Kuma
+* Authelia or Authentik
+* Vaultwarden
+* Gitea
+* Miniflux
+* Mealie
+* Paperless-ngx
+
+---
+
+# Principles
+
+* Configuration belongs in Git
+* Data belongs in backups
+* Secrets never go into Git
+* Containers are disposable
+* Volumes contain persistent data
+* The server should be reproducible

bootstrap.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "== Updating system =="
+apt update
+apt upgrade -y
+
+echo "== Installing base packages =="
+apt install -y \
+  ca-certificates \
+  curl \
+  gnupg \
+  git \
+  vim \
+  htop \
+  unzip \
+  rsync \
+  jq \
+  ufw
+
+echo "== Installing Docker repository key =="
+install -m 0755 -d /etc/apt/keyrings
+
+curl -fsSL https://download.docker.com/linux/debian/gpg \
+  -o /etc/apt/keyrings/docker.asc
+
+chmod a+r /etc/apt/keyrings/docker.asc
+
+echo "== Adding Docker repository =="
+echo \
+  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
+  https://download.docker.com/linux/debian \
+  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
+  > /etc/apt/sources.list.d/docker.list
+
+apt update
+
+echo "== Installing Docker =="
+apt install -y \
+  docker-ce \
+  docker-ce-cli \
+  containerd.io \
+  docker-buildx-plugin \
+  docker-compose-plugin
+
+systemctl enable docker
+systemctl start docker
+
+echo "== Configuring firewall =="
+ufw default deny incoming
+ufw default allow outgoing
+
+# SSH
+ufw allow 22/tcp
+
+# Web
+ufw allow 80/tcp
+ufw allow 443/tcp
+
+ufw --force enable
+
+echo "== Enabling useful services =="
+systemctl enable --now ssh
+
+echo
+echo "================================"
+echo "Bootstrap finished!"
+echo
+docker --version
+docker compose version
+echo "================================"

configuration.nix

@@ -1,36 +0,0 @@
-{ pkgs, ... }:
-
-{
-  system.stateVersion = "26.05";
-
-  networking.hostName = "server";
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  services.openssh = {
-    enable = true;
-
-    settings = {
-      PasswordAuthentication = false;
-      PermitRootLogin = "prohibit-password";
-    };
-  };
-
-  networking.firewall = {
-    enable = true;
-
-    allowedTCPPorts = [
-      22
-      80
-      443
-    ];
-  };
-
-  environment.systemPackages = with pkgs; [
-    git
-    vim
-    curl
-    wget
-  ];
-}

disko.nix

@@ -1,39 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      main = {
-        device = "/dev/sda";
-
-        type = "disk";
-
-        content = {
-          type = "gpt";
-
-          partitions = {
-            ESP = {
-              size = "512M";
-
-              type = "EF00";
-
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-              };
-            };
-
-            root = {
-              size = "100%";
-
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/";
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

flake.nix

@@ -1,39 +0,0 @@
-{
-  description = "Hetzner NixOS vps";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
-
-    disko = {
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    nixos-anywhere.url = "github:numtide/nixos-anywhere";
-
-    home-manager = {
-      url = "github:nix-community/home-manager/release-26.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-  };
-
-  outputs = { self, nixpkgs, disko, home-manager, ... }:
-  {
-    nixosConfigurations.server = nixpkgs.lib.nixosSystem {
-      system = "x86_64-linux";
-
-      modules = [
-        disko.nixosModules.disko
-        ./disko.nix
-        ./configuration.nix
-        ./users.nix
-
-        home-manager.nixosModules.home-manager
-
-        {
-          home-manager.users.root = import ./home.nix;
-        }
-      ];
-    };
-  };
-}

home.nix

@@ -1,5 +0,0 @@
-{
-  home.stateVersion = "26.05";
-
-  programs.bash.enable = true;
-}

users.nix

@@ -1,7 +0,0 @@
-{
-  users.users.root = {
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC6WNm4YAQO85j0aNQkKSH7QnmhgzKA4hA2ggi6cDyKk"
-    ];
-  };
-}