Server Setup (for self-hosting web applications)

Setting up and securing a new server for self-hosting web applications can be a daunting task. This repo contains bash scripts for automating the process!

The scripts in this repo are intended to set up and secure a new Ubuntu server for self-hosting web applications. Running the setup.sh script from the repo's root will copy the server's configuration variables (defined in the .env file) to the server and run all the following setup scripts:

• configure-firewall.sh - Configures the ufw firewall to rate limit SSH connections and allow HTTP/HTTPS connections.

• configure-ssh.sh - Disables password authentication and only allow connections via SSH keys.

• create-user.sh - Creates a new, non-root user with their own home directory, bash shell, and sudo privileges. The username is taken from the .env file.

• install-fail2ban.sh - Installs and configures fail2ban to block brute force SSH attacks.

• install-lazy-vim.sh - Installs the base LazyVim requirements and clones the starter configuration to the root and non-root user's home directories.

• install-zsh.sh - Installs ZSH and sets it as the default shell for the non-root user. Also copies the .zshrc and .gitconfig files from the dotfiles repo to the non-root user's home directory. This is optional and can be customized by setting the DOTFILES_REPO variable in the .env file or skipped entirely by setting it to an empty string (e.g. DOTFILES_REPO="").

• setup-db-backups.sh – Sets up automated database backups for PostgreSQL using rclone to periodically save backups to a remote server. This is optional and can be enabled by setting all of the POSTGRES_-prefixed variables in the .env file, or skipped entirely by setting POSTGRES_LOCAL_BACKUP_DIR to an empty string (e.g., POSTGRES_LOCAL_BACKUP_DIR=""). For backups to work, it is assumed that (1) you have a local PostgreSQL instance running on your server at 127.0.0.1:5432, and (2) you have an rclone remote configured for backups. Setting up the remote must be done manually by connecting to the server and running rclone config after the setup.sh script has completed successfully. See the Configuring rclone section below for more details.

• upgrade-packages.sh - Upgrades all installed packages.

Usage

1. Copy the .env.example file to .env and fill in the values.

cp .env.example .env

2. Run the setup script.

bash setup.sh

3. The server is set up and ready to use! You can connect to the server with:

ssh ${YOUR_USERNAME}@${YOUR_SERVER_IP}

Notes

• It is assumed that the server is already set up for SSH connections. This is usually done via the hosting provider on server creation. See SSH Key Creation section below if you need to do this manually.
• Scripts must be ran as the root user to avoid needing to enter a password for sudo.
• Last tested on Ubuntu 24.04.3 LTS.

Verification

To verify that password authentication is disabled, you can try signing in without SSH keys.

ssh ${YOUR_USERNAME}@${YOUR_SERVER_IP} -o PubkeyAuthentication=no

You should see a message like this:

Permission denied (publickey).

SSH Key Creation

If you need to create a new SSH key pair, run the ssh-keygen command:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -C "${your_email@example.com}"

Optionally, you can add the public key to the server manually if your hosting provider does not support adding SSH keys to the server during creation. Run the ssh-copy-id command:

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@${YOUR_SERVER_IP}

Using a Custom Name for SSH

To connect to your server with a custom domain name, add an A record to your DNS records that points your custom domain to your server's IP address.

For example, if your custom domain name is example.com and your server's IP address is 123.456.789.0, you would add the following A record to your DNS records.

Type	Name	Content
A	example.com	123.456.789.0

After DNS propagation, you can connect to your server using the custom domain:

ssh ${YOUR_USERNAME}@${example.com}

To further simplify the connection process, you can add the following to your ~/.ssh/config file:

Host ${ANY_NAME_YOU_WANT}
    HostName ${example.com}
    User ${YOUR_USERNAME}
    IdentityFile ~/.ssh/id_ed25519

You can now connect using a custom name like this:

ssh ${ANY_NAME_YOU_WANT}

Configuring rclone

To configure rclone, after the setup.sh script has completed successfully, first connect to your server via SSH:

ssh ${YOUR_USERNAME}@${YOUR_SERVER_IP}

Then, run the following command to start an interactive configuration session:

rclone config

Notes for Google Drive users

• Be sure to create your own client_id and client_secret for the Google Drive API. See: https://rclone.org/drive/#making-your-own-client-id
• When prompted for scope, select option 1 (Full access all files, excluding Application Data Folder).
• If running on a headless server, you will need to authenticate on machine with a web browser. See: https://rclone.org/remote_setup/