I’ve always liked the idea of a blog to go back and review past projects, but never, until now, pulled the trigger on building one. And what better a first post than the construction of the blog itself.
Thankfully, I’ve owned some domains now for a while just in case I ever needed them, meaning I could fast track past the decision-paralysis step of this process and get straight into the site construction.
Starting with a basic VPS (2 core, 4GB RAM, 80GB SSD) from Clouvider I moved on to securing the remote access and SSH key authentication.
A LEMP stack was then implemented and WordPress installed. DNS configured, HTTPS Certificated supplied by LetsEncrypt, custom domain email hosting provided by Zoho. SMTP2GO API for email delivery, Google Analytics and Recaptcha V3.
A concerted effort was made to secure the server along the way, it wouldn’t be wise to go in to too much detail regarding these steps, but broadly, service accounts were configured, minimal permissions were applied. Stack elements were locked down to local communication where possible, and firewalls configured to allow only what was necessary. Access to files, site areas and code execution was restricted.
Now it was time for the second most time consuming part of the process, selecting a theme, finally settling on Yuki Westa Blog.
Once done it was time to refamiliarise myself with the WordPress UI and get the site looking mostly like what you’re seeing today.
Now to make the server easier to maintain and recover.
Encrypted, deduplicated backup was configured with Restic. Running daily with daily, weekly and annual retention policies. Some Bash and Python scripts were created, scheduled through systemd timers, to coordinate backups, Ubuntu security updates and WordPress scheduled tasks. (Some of these WordPress tasks would usually be triggered on a page view, but with a low traffic blog that could leave significant periods of vulnerability.)
Certbot handles automated certificate renewal.
Netdata is used to provide resource monitoring, and also includes a live dashboard.
VnStat tracks network usage.
Fail2Ban blocks repeated SSH and private-area authentication failures.
SMTP2GO and msmtp is again utilised for twice daily management reports, provide alerting for warning and critical issues and recovery notifications.
UptimeRobot is utilised for basic external uptime monitoring, which their free tier is perfect for.
Cockpit is also configured for a management interface, accessed securely via SSH. (The bug fixes are currently held due to phasing, don’t panic.)
And here we are, with a few weekly and monthly manual checks we have a reliable, secure and redundant server, perfect for hosting the post you’re reading. Now, what to use it for..
