Initial infrastructure: Caddy reverse proxy and Forgejo git server
- Ubuntu 24.04 base on dedicated hardware with software RAID 1 - Docker Compose stacks for Caddy and Forgejo (PostgreSQL-backed) - Automatic TLS via Let's Encrypt - SSH hardening, UFW firewall, fail2ban - Setup documentation in docs/setup.md
This commit is contained in:
warnason
commit
648d4e6b98
2 changed files with 224 additions and 0 deletions
60
README.md
Normal file
60
README.md
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
# Infrastructure
|
||||
|
||||
Self-hosted development and deployment infrastructure for personal technical projects.
|
||||
|
||||
Runs a private Git forge (Forgejo), an automated reverse proxy with TLS (Caddy), and serves prototype applications under development.
|
||||
|
||||
## Overview
|
||||
|
||||
- **Host:** Ubuntu 24.04 LTS on dedicated hardware (Hetzner, Falkenstein)
|
||||
- **Storage:** Software RAID 1 for the operating system, separate disk for non-critical data
|
||||
- **Orchestration:** Docker Compose
|
||||
- **Reverse proxy:** Caddy 2, with automatic Let's Encrypt certificates
|
||||
- **Git hosting:** Forgejo with PostgreSQL backend
|
||||
- **Firewall:** UFW, restricting inbound traffic to SSH, HTTP, HTTPS, and Git-over-SSH
|
||||
- **Intrusion prevention:** fail2ban on SSH
|
||||
|
||||
## Services
|
||||
|
||||
| Service | URL | Purpose |
|
||||
|---------|--------------------------|--------------------------------|
|
||||
| Forgejo | https://git.stifting.at | Self-hosted Git and CI/CD |
|
||||
| App | https://bim.stifting.at | Currently hosted prototype |
|
||||
|
||||
## Repository layout
|
||||
|
||||
```
|
||||
.
|
||||
├── caddy/ # Reverse proxy configuration
|
||||
│ ├── docker-compose.yml
|
||||
│ └── Caddyfile
|
||||
├── forgejo/ # Git server configuration
|
||||
│ ├── docker-compose.yml
|
||||
│ └── .env.example
|
||||
├── docs/ # Setup notes and runbooks
|
||||
│ └── setup.md
|
||||
└── README.md
|
||||
```
|
||||
|
||||
## Bootstrapping a new host
|
||||
|
||||
See [docs/setup.md](docs/setup.md) for the full installation procedure.
|
||||
|
||||
High-level steps:
|
||||
|
||||
1. Provision Ubuntu 24.04 via `installimage` with RAID 1
|
||||
2. Harden SSH, create an admin user, enable UFW and fail2ban
|
||||
3. Install Docker and create the shared `web` network
|
||||
4. Deploy Caddy, then Forgejo
|
||||
5. Configure DNS records for the relevant subdomains
|
||||
|
||||
## Security notes
|
||||
|
||||
- SSH uses key-only authentication; root login is disabled
|
||||
- Secrets (`.env`, passwords) are never committed; templates are provided as `.env.example`
|
||||
- Unattended security upgrades are enabled
|
||||
- TLS certificates are issued and renewed automatically via ACME
|
||||
|
||||
## License
|
||||
|
||||
MIT
|
||||
164
docs/setup.md
Normal file
164
docs/setup.md
Normal file
|
|
@ -0,0 +1,164 @@
|
|||
# Host setup guide
|
||||
|
||||
Step-by-step procedure for provisioning a new host running this infrastructure.
|
||||
|
||||
## 1. Operating system installation
|
||||
|
||||
From the Hetzner rescue system, use `installimage` with the following configuration:
|
||||
|
||||
- **Image:** Ubuntu 24.04 LTS
|
||||
- **RAID:** Software RAID 1 across two NVMe drives for `/`, `/boot`, and swap
|
||||
- **Additional disks:** Formatted ext4 and mounted at `/data` for non-critical storage
|
||||
- **Hostname:** set as appropriate
|
||||
|
||||
## 2. Hardening
|
||||
|
||||
After the first boot, performed as `root`:
|
||||
|
||||
```bash
|
||||
apt update && apt upgrade -y
|
||||
apt install -y curl wget git vim htop tmux ufw fail2ban unattended-upgrades \
|
||||
ca-certificates gnupg lsb-release
|
||||
|
||||
timedatectl set-timezone Europe/Vienna
|
||||
|
||||
adduser <admin-user>
|
||||
usermod -aG sudo <admin-user>
|
||||
|
||||
# Copy authorized_keys from root to the new user
|
||||
mkdir -p /home/<admin-user>/.ssh
|
||||
cp /root/.ssh/authorized_keys /home/<admin-user>/.ssh/
|
||||
chown -R <admin-user>:<admin-user> /home/<admin-user>/.ssh
|
||||
chmod 700 /home/<admin-user>/.ssh
|
||||
chmod 600 /home/<admin-user>/.ssh/authorized_keys
|
||||
```
|
||||
|
||||
### SSH hardening
|
||||
|
||||
Create `/etc/ssh/sshd_config.d/99-hardening.conf`:
|
||||
|
||||
```
|
||||
PermitRootLogin no
|
||||
PasswordAuthentication no
|
||||
PubkeyAuthentication yes
|
||||
KbdInteractiveAuthentication no
|
||||
AllowUsers <admin-user>
|
||||
X11Forwarding no
|
||||
AllowAgentForwarding no
|
||||
ClientAliveInterval 300
|
||||
ClientAliveCountMax 2
|
||||
```
|
||||
|
||||
Validate and reload:
|
||||
|
||||
```bash
|
||||
sshd -t && systemctl reload ssh
|
||||
```
|
||||
|
||||
### Firewall
|
||||
|
||||
```bash
|
||||
ufw default deny incoming
|
||||
ufw default allow outgoing
|
||||
ufw allow 22/tcp comment 'SSH'
|
||||
ufw allow 80/tcp comment 'HTTP'
|
||||
ufw allow 443/tcp comment 'HTTPS'
|
||||
ufw allow 2222/tcp comment 'Forgejo Git SSH'
|
||||
ufw enable
|
||||
```
|
||||
|
||||
### fail2ban
|
||||
|
||||
`/etc/fail2ban/jail.local`:
|
||||
|
||||
```ini
|
||||
[DEFAULT]
|
||||
bantime = 1h
|
||||
findtime = 10m
|
||||
maxretry = 5
|
||||
backend = systemd
|
||||
|
||||
[sshd]
|
||||
enabled = true
|
||||
port = 22
|
||||
```
|
||||
|
||||
Then enable:
|
||||
|
||||
```bash
|
||||
systemctl enable --now fail2ban
|
||||
```
|
||||
|
||||
### Unattended upgrades
|
||||
|
||||
```bash
|
||||
dpkg-reconfigure -plow unattended-upgrades
|
||||
```
|
||||
|
||||
In `/etc/apt/apt.conf.d/50unattended-upgrades`:
|
||||
|
||||
```
|
||||
Unattended-Upgrade::Automatic-Reboot "true";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
|
||||
```
|
||||
|
||||
## 3. Docker
|
||||
|
||||
```bash
|
||||
install -m 0755 -d /etc/apt/keyrings
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
|
||||
chmod a+r /etc/apt/keyrings/docker.asc
|
||||
|
||||
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
|
||||
https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo $VERSION_CODENAME) stable" \
|
||||
| tee /etc/apt/sources.list.d/docker.list
|
||||
|
||||
apt update
|
||||
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
||||
|
||||
usermod -aG docker <admin-user>
|
||||
```
|
||||
|
||||
Configure `/etc/docker/daemon.json` for log rotation:
|
||||
|
||||
```json
|
||||
{
|
||||
"log-driver": "json-file",
|
||||
"log-opts": {
|
||||
"max-size": "10m",
|
||||
"max-file": "3"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Start Docker and create the shared network:
|
||||
|
||||
```bash
|
||||
systemctl enable --now docker
|
||||
docker network create web
|
||||
```
|
||||
|
||||
## 4. DNS
|
||||
|
||||
Set the following records for your domain:
|
||||
|
||||
| Type | Name | Value |
|
||||
|------|------|---------------|
|
||||
| A | git | <server-ipv4> |
|
||||
| A | bim | <server-ipv4> |
|
||||
| AAAA | git | <server-ipv6> |
|
||||
| AAAA | bim | <server-ipv6> |
|
||||
|
||||
## 5. Deploy services
|
||||
|
||||
```bash
|
||||
cd ~/projects/infra/caddy
|
||||
docker compose up -d
|
||||
|
||||
cd ~/projects/infra/forgejo
|
||||
cp .env.example .env
|
||||
# Edit .env and set a strong DB_PASSWORD (e.g. openssl rand -base64 32)
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
Complete the Forgejo setup via the web interface.
|
||||
Loading…
Add table
Reference in a new issue