Loading...

​​​📟​ appendix: setting up a self-hosted server

​​or, the “tear your hair out” part.

​​tl;dr

• ​​initialization: DigitalOcean, LEMP, add domain, email (optionally), add user

• ​​setup: MySQL update, nginx, swapfile

• ​​securing: Let’s Encrypt, HTTP/2, HSTS, X-XSS-Protection, X-Content-Type-Options, Referrer-Policy, CSP, HttpOnly/Secure, SameSite

• ​​node.js: setup and PM2, deno

• ​​sv/runit: for non-node.js setups

• ​​WordPress: for you poor saps still maintaining your family’s random blogs…

• ​​resources: Observatory, xip.io

​​

​​

​​

• ​​“Dearest server, I am Chrome, the 64th of that name, child of WebKit, grandchild of KHTML, a disciple of Gecko, follower of the great Mozilla/5.0, running on Windows NT 10”

• ​​— Amelia Bellamy-Royds

​​

​​

​​

​​i’m lovin’ the DigitalOcean service. a lot of these tutorials are based on their service and using Ubuntu 18.04. 

​​initialization

​​once you create an account at DigitalOcean you’ll want to go through these steps to get started:

​​

1. ​​create server

1. ​​create project

2. ​​create → droplets

3. ​​one-click apps → LEMP

2. ​​LEMP (Linux + nginx + MySQL + PHP)

1. ​​add backup! It’s just once-a-week though so if you need something more than that, look into something more custom.

2. ​​add IPv6

3. ​​add SSH key

4. ​​add monitoring

5. ​​optionally, create firewall via the UI. if you need to fine tune this part you can read about using ufw​ on the command line in this article.

3. ​​add domain(s)

1. ​​A and AAAA records for @​, *​, www​

2. ​​mail, A → mail.example.com and MX → example.com

4. ​​email (optional)

1. ​​setting up postfix

2. ​​preventing spoofing

1. ​​recommended: TXT @ v=spf1 a mx include:_spf.google.com -all​

3. ​​rename your droplet to have a FQDN (e.g. example.com) — this will set up a PTR record for email to help verify your mail server.

4. ​​secure email:

​​# first, need to shutdown nginx

​​sudo systemctl stop nginx

​​sudo certbot certonly --standalone -d mail.example.com

​​


​​# then in /etc/postfix/main.cf update:

​​# pay attention to `smtp_use_tls=yes` because it's usually `smtpd_use_tls=yes`

​​# with a 'd' which doesn't work :-/

​​smtpd_tls_cert_file=/etc/ssl/certs/fullchain.pem (change to suit your system)

​​smtpd_tls_key_file=/etc/ssl/private/privkey.pem (change to suit your system)