Part 6: Security layer

34. Final check and reboot test#

What you'll do: check every layer, then restart the server and make sure everything comes back by itself. Time: 15 minutes. Do it when you can reach the server's keyboard if needed.

Step 1: Check before restarting#

sudo ufw status verbose
sudo fail2ban-client status sshd
timedatectl | grep synchronized
sudo ss -lntp
systemctl --failed

In ss, check the addresses:

Anything on 0.0.0.0 that you don't recognise: find out what it is before going on.

With Part 5, also:

systemctl is-active ai-egress-guard llama-model
curl -s http://127.0.0.1:8095/health

Step 2: Restart#

Make sure no AI job is running, then:

sudo reboot

Wait 2–3 minutes.

Step 3: Check after restarting#

ssh homeserver

systemctl --failed
sudo ufw status
sudo fail2ban-client status sshd
systemctl is-active cockpit.socket
timedatectl | grep synchronized

Expected: 0 loaded units listed, firewall active, the jail running, active, yes.

With Part 5:

systemctl is-active ai-egress-guard llama-model
systemctl --user is-active aisystem
sudo ss -lntp | grep -E '8095|8097|9090'

All 127.0.0.1. Give the model a minute to load, then curl -s http://127.0.0.1:8095/health.

Finally, open the Cockpit tunnel (Chapter 32) and check the dashboard loads.

Every week from now on#

• Look at Cockpit: services, logs, disk.
• systemctl --failed shows nothing.
• After big changes: new encrypted backup (Chapter 33).

The full list is in the Monthly health check.