From bd83b2f6762e6f9cbcdad1b7f3929a117e768f0b Mon Sep 17 00:00:00 2001 From: Vladimir Eremin Date: Wed, 28 Jan 2026 23:25:39 +0300 Subject: [PATCH] docs: Update root.ermnvldmr.com via prompt --- services/docs/content/en/root/_index.md | 19 ++++-- .../docs/content/en/root/recipes/_index.md | 19 +++--- .../content/en/root/recipes/initial-setup.md | 65 ++++++++----------- 3 files changed, 50 insertions(+), 53 deletions(-) diff --git a/services/docs/content/en/root/_index.md b/services/docs/content/en/root/_index.md index 062110b..51b6239 100644 --- a/services/docs/content/en/root/_index.md +++ b/services/docs/content/en/root/_index.md @@ -1,12 +1,21 @@ --- -title: "root.ermnvldmr.com" -description: "Documentation for the root.ermnvldmr.com infrastructure" +title: "Root Infrastructure" +description: "Documentation for the root.ermnvldmr.com infrastructure." +weight: 1 type: docs +cascade: + type: docs --- -Various notes made during the development of personal infrastructure. +Comprehensive documentation for the personal infrastructure deployment and management, including setup guides and operational recipes. ## Sections -- **[Recipes](recipes/)** -- Step-by-step instructions, -that I don't want to remember each time I need one. +{{% cards %}} + {{< card link="recipes" title="Recipes" icon="beaker" subtitle="Collection of step-by-step procedures for infrastructure maintenance and deployment." >}} +{{% /cards %}} + +--- + +**See also:** +- [GitHub: root.ermnvldmr.com](https://github.com/deytenit/root.ermnvldmr.com) diff --git a/services/docs/content/en/root/recipes/_index.md b/services/docs/content/en/root/recipes/_index.md index 8b1dc34..193631c 100644 --- a/services/docs/content/en/root/recipes/_index.md +++ b/services/docs/content/en/root/recipes/_index.md @@ -1,20 +1,19 @@ --- title: "Recipes" -description: "Step-by-step instructions, that I don't want to remember each time I need one." +description: "Collection of step-by-step procedures for infrastructure maintenance and deployment." weight: 50 type: docs --- -Step-by-step instructions, -that I don't want to remember each time I need one. +Step-by-step instructions for reproducible tasks and infrastructure maintenance. -## What's in here +## Available Recipes -### [Initial Host Setup](initial-setup/) (EN only) +{{% cards %}} + {{< card link="initial-setup" title="Initial Host Setup" icon="server" subtitle="Hardened setup for a fresh Debian host from zero to deployment." >}} +{{% /cards %}} -Setting up a new host on Debian from scratch. +--- -## Why “Recipes”? - -These are not abstract troubleshooting guides. -These are specific actions you will need to perform. +**See also:** +- [GitHub: root.ermnvldmr.com](https://github.com/deytenit/root.ermnvldmr.com) diff --git a/services/docs/content/en/root/recipes/initial-setup.md b/services/docs/content/en/root/recipes/initial-setup.md index 9119346..a390cfd 100644 --- a/services/docs/content/en/root/recipes/initial-setup.md +++ b/services/docs/content/en/root/recipes/initial-setup.md @@ -1,21 +1,20 @@ --- title: "Initial Host Setup" -description: "Setting up a fresh Debian host from scratch" +description: "Setting up a fresh Debian host from scratch." weight: 1 -type: docs --- -# Initial Host Setup +Hardened setup for a fresh Debian host from zero to deployment. -**Description:** Hardened setup for a fresh Debian host from zero to deployment. +## Setup Procedure ---- +{{% steps %}} -## 1. System User & Privileges +### System User & Privileges -We use the `adam` user for all administrative tasks. To minimize friction while maintaining security, we utilize SSH-key authentication and passwordless `sudo` via the `wheel` group. +The `adam` user handles all administrative tasks. SSH-key authentication and passwordless `sudo` via the `wheel` group minimize friction while maintaining security. -### Create the Admin User +**Create the Admin User** ```bash # Create the user with a bash shell @@ -30,18 +29,15 @@ echo "%wheel ALL=(ALL) NOPASSWD: ALL" | sudo visudo -c -f /etc/sudoers.d/99-root # Add adam to the necessary groups usermod -aG wheel,docker adam - ``` ---- - -## 2. SSH Hardening & Key Management +### SSH Hardening & Key Management Passwords are disabled. Access is strictly via SSH keys. -### Secure SSH Directory +**Secure SSH Directory** -We set strict permissions immediately to prevent the SSH daemon from rejecting the keys. +Set strict permissions immediately to prevent the SSH daemon from rejecting the keys. ```bash # Setup directories as root for the adam user @@ -52,10 +48,9 @@ chmod 700 /home/adam/.ssh echo "[PASTE_PUB_KEY_HERE]" > /home/adam/.ssh/authorized_keys chmod 600 /home/adam/.ssh/authorized_keys chown -R adam:adam /home/adam/.ssh - ``` -### Harden SSH Daemon +**Harden SSH Daemon** Modify the SSH configuration to change the default port and disable password entry. @@ -70,14 +65,11 @@ EOF # Validate syntax before restarting to avoid lockout sshd -t && systemctl restart ssh - ``` ---- +### GitHub Access (Deploy Key) -## 3. GitHub Access (Deploy Key) - -Since the repository is hosted on GitHub, the host needs its own identity to pull updates. +The host requires its own identity to pull updates from the GitHub repository. ```bash # Generate a host-specific SSH key (no passphrase for automation) @@ -85,28 +77,22 @@ ssh-keygen -t ed25519 -f /home/adam/.ssh/adam-at-deytenit_github_com_ed25519 -N # Display the public key to be added to GitHub (Settings > Deploy Keys) cat /home/adam/.ssh/adam-at-deytenit_github_com_ed25519.pub - ``` > [!TIP] -> Add the output above to your [GitHub Repository Deploy Keys](https://www.google.com/search?q=https://github.com/deytenit/root.ermnvldmr.com/settings/keys) with **read access**. +> Add the output above to the [GitHub: Repository Deploy Keys](https://github.com/deytenit/root.ermnvldmr.com/settings/keys) with **read access**. ---- +### Install Docker Engine -## 4. Install Docker Engine - -Standard Docker installation for Debian - [Docs: Docker - Install on Debian](https://docs.docker.com/engine/install/debian/). +Install the standard Docker Engine for Debian. ```bash # Follow official guide: https://docs.docker.com/engine/install/debian/ # Once installed, verify (Adam can run this without sudo now) docker run --rm hello-world - ``` ---- - -## 5. Repository Deployment +### Repository Deployment Clone the infrastructure repository and initialize the node. @@ -123,10 +109,9 @@ sudo -u adam git clone git@github.com:deytenit/root.ermnvldmr.com.git $REPO_DIR export NODE="daedalus" cd $REPO_DIR sudo -u adam ./init.sh - ``` -### Node-Specific Configuration +**Node-Specific Configuration** Run the staged initialization scripts in order: @@ -136,12 +121,9 @@ Run the staged initialization scripts in order: ./$NODE/.host/.scripts/10-ufw ./$NODE/.host/.scripts/20-crowd ./$NODE/.host/.scripts/30-cron - ``` ---- - -## 6. Storage & Hardening +### Storage & Hardening Define the data tiers and secure the environment by creating non-root users for containerized services. @@ -156,5 +138,12 @@ sudo -u adam .scripts/ops/setup-tiers $NODE \ /srv/com-ermnvldmr-root-$NODE-tier3 sudo -u adam .scripts/ops/setup-noroot-users $NODE - ``` + +{{% /steps %}} + +--- + +**See also:** +- [Doc: Docker - Install on Debian](https://docs.docker.com/engine/install/debian/) +- [GitHub: root.ermnvldmr.com](https://github.com/deytenit/root.ermnvldmr.com)