Part 6: Security layer

26. The security layer: what and why#

Parts 1–3 already made the server safe: SSH keys only, a firewall, automatic updates, and no router port forwarding. This part adds extra locks and a way to watch the server.

You need: Parts 1–3 done. Part 5 (AI) is optional; the steps tell you what to skip if you don't have it.

The layers#

flowchart TB
  A["Router: forwards nothing"] --> B["Tailscale: only your devices"]
  B --> C["Firewall (UFW): SSH only from home network and Tailscale"]
  C --> D["Fail2ban: bans anyone who keeps guessing"]
  D --> E["SSH: keys only, no extras"]
  E --> F["Accounts: ai account locked and offline"]
  G["Dashboard (Cockpit): watch it all<br/>127.0.0.1 only, through a tunnel"]
  H["Encrypted backup of settings"]
  G -. "watches" .- C
  H -. "can restore" .- E

Each layer would stop an attacker on its own. Together they make the server a boring target.

The order (don't skip around)#

Chapter	Does	Time
27	Save a snapshot of the settings, so you can undo	5 min
28	Tighten SSH settings and test your tunnels still work	15 min
29	Tighten the firewall and check the router	20 min
30	Check the clock is synchronised	5 min
31	Fail2ban: ban password-guessers	10 min
32	Cockpit: a private monitoring dashboard	15 min
33	Encrypted backup of the settings, with a restore test	15 min
34	Final check and a reboot test	15 min

Golden rule for this whole part

Keep one SSH window open the whole time and test every change from a second window. If something breaks, fix it from the first window. If all else fails, use the server's own keyboard.

Next: 27. Save a snapshot first