This is an automated archive made by the Lemmit Bot.
The original was posted on /r/selfhosted by /u/No-Card-2312 on 2025-12-08 06:39:19+00:00.
Hey folks,
I’d like to hear how you prepare a fresh Linux server before deploying a new web application.
Scenario:
A web API, a web frontend, background jobs/workers, and a few internal-only routes that should be reachable from specific IPs only (though I’m not sure how to handle IP rotation reliably).
These are the areas I’m trying to understand:
- Security and basic hardening
What are the first things you lock down on a new server?
How do you handle firewall rules, SSH configuration, and restricting internal-only endpoints?
- Users and access management
When a developer joins or leaves, how do you add/remove their access?
Separate system users, SSH keys only, or automated provisioning tools (Ansible/Terraform)?
- Deployment workflow
What do you use to run your services: systemd, Docker, PM2, something else?
CI/CD or manual deployments?
Do you deploy the web API, web frontend, and workers through separate pipelines, or a single pipeline that handles everything?
- Monitoring and notifications
What do you keep an eye on (CPU, memory, logs, service health, uptime)?
Which tools do you prefer (Prometheus/Grafana, BetterStack, etc.)?
How do you deliver alerts?
- Backups
What exactly do you back up (database only, configs, full system snapshots)?
How do you trigger and schedule backups?
How often do you test restoring them?
- Database setup
Do you host the database on the same VPS or use a managed service?
If it's local, how do you secure it and handle updates and backups?
- Reverse proxy and TLS
What reverse proxy do you use (Nginx, Traefik, Caddy)?
How do you automate certificates and TLS management?
- Logging
How do you handle logs? Local storage, log rotation, or remote logging?
Do you use ELK/EFK stacks or simpler solutions?
- Resource isolation
Do you isolate services with containers or run everything directly on the host?
How do you set CPU/memory limits for different components?
- Automatic restarts and health checks
What ensures your services restart automatically when they fail?
systemd, Docker health checks, or another tool?
- Secrets management
How do you store environment variables and secrets?
Simple .env files, encrypted storage, or tools like Vault/SOPS?
- Auditing and configuration tracking
How do you track changes made on the server?
Do you rely on audit logs, command history, or Git-backed config management?
- Network architecture
Do you use private/internal networks for internal services?
What do you expose publicly, and what stays behind a reverse proxy?
- Background job handling
On Windows, Task Scheduler caused deployment issues when jobs were still running.
How should this be handled on Linux?
If a job is still running during a new deployment, do you stop it, let it finish, or rely on a queue system to avoid conflicts?
- Securing tools like Grafana and admin-only routes
What’s the best way to prevent tools like Grafana from being publicly reachable?
Is IP allowlisting reliable, or does IP rotation make it impractical?
For admin-only routes, would using a VPN be a better approach—especially for non-developers who need the simplest workflow?
I asked ChatGPT these questions as well, but I’m more interested in how people actually handle these things in real-world.
