AZiT

Web server

The cloud server this site runs on: locked down, with strict headers, write-only deploys, and its logs fetched from home.

Needs For the first three chapters, nothing from the other guides: a small cloud server and a domain of your own. The last one sends the server's logs to the SIEM from the Cluster and SIEM guide.

  1. 1A small cloud server, locked downDebian 13 with keys-only SSH, automatic updates, and a host firewall loaded with a dead-man switch.
  2. 2nginx, TLS and the headersA Let's Encrypt certificate, strict security headers, and nothing at all for requests that do not name the site.
  3. 3Deploys that can only write filesA deploy user locked to rsync into the web root, and deploys from the laptop only.
  4. 4Its logs, fetched from homeThe server's journal in the SIEM every 15 minutes, fetched with a key that can read it and do nothing else.