docs: Update root.ermnvldmr.com via prompt

This commit is contained in:
deytenit committed 2026-01-28 23:25:39 +03:00
1 parent ac54562996
commit bd83b2f676
3 files changed
+50 -53

No files matched your search

+14 -5
View File
@@ -1,12 +1,21 @@
--- ---
title: "root.ermnvldmr.com" title: "Root Infrastructure"
description: "Documentation for the root.ermnvldmr.com infrastructure" description: "Documentation for the root.ermnvldmr.com infrastructure."
weight: 1
type: docs type: docs
cascade:
type: docs
--- ---
Various notes made during the development of personal infrastructure. Comprehensive documentation for the personal infrastructure deployment and management, including setup guides and operational recipes.
## Sections ## Sections
- **[Recipes](recipes/)** -- Step-by-step instructions, {{% cards %}}
that I don't want to remember each time I need one. {{< card link="recipes" title="Recipes" icon="beaker" subtitle="Collection of step-by-step procedures for infrastructure maintenance and deployment." >}}
{{% /cards %}}
---
**See also:**
- [GitHub: root.ermnvldmr.com](https://github.com/deytenit/root.ermnvldmr.com)
@@ -1,20 +1,19 @@
--- ---
title: "Recipes" title: "Recipes"
description: "Step-by-step instructions, that I don't want to remember each time I need one." description: "Collection of step-by-step procedures for infrastructure maintenance and deployment."
weight: 50 weight: 50
type: docs type: docs
--- ---
Step-by-step instructions, Step-by-step instructions for reproducible tasks and infrastructure maintenance.
that I don't want to remember each time I need one.
## What's in here ## Available Recipes
### [Initial Host Setup](initial-setup/) (EN only) {{% cards %}}
{{< card link="initial-setup" title="Initial Host Setup" icon="server" subtitle="Hardened setup for a fresh Debian host from zero to deployment." >}}
{{% /cards %}}
Setting up a new host on Debian from scratch. ---
## Why “Recipes”? **See also:**
- [GitHub: root.ermnvldmr.com](https://github.com/deytenit/root.ermnvldmr.com)
These are not abstract troubleshooting guides.
These are specific actions you will need to perform.
@@ -1,21 +1,20 @@
--- ---
title: "Initial Host Setup" title: "Initial Host Setup"
description: "Setting up a fresh Debian host from scratch" description: "Setting up a fresh Debian host from scratch."
weight: 1 weight: 1
type: docs
--- ---
# Initial Host Setup Hardened setup for a fresh Debian host from zero to deployment.
**Description:** Hardened setup for a fresh Debian host from zero to deployment. ## Setup Procedure
--- {{% steps %}}
## 1. System User & Privileges ### System User & Privileges
We use the `adam` user for all administrative tasks. To minimize friction while maintaining security, we utilize SSH-key authentication and passwordless `sudo` via the `wheel` group. The `adam` user handles all administrative tasks. SSH-key authentication and passwordless `sudo` via the `wheel` group minimize friction while maintaining security.
### Create the Admin User **Create the Admin User**
```bash ```bash
# Create the user with a bash shell # Create the user with a bash shell
@@ -30,18 +29,15 @@ echo "%wheel ALL=(ALL) NOPASSWD: ALL" | sudo visudo -c -f /etc/sudoers.d/99-root
# Add adam to the necessary groups # Add adam to the necessary groups
usermod -aG wheel,docker adam usermod -aG wheel,docker adam
``` ```
--- ### SSH Hardening & Key Management
## 2. SSH Hardening & Key Management
Passwords are disabled. Access is strictly via SSH keys. Passwords are disabled. Access is strictly via SSH keys.
### Secure SSH Directory **Secure SSH Directory**
We set strict permissions immediately to prevent the SSH daemon from rejecting the keys. Set strict permissions immediately to prevent the SSH daemon from rejecting the keys.
```bash ```bash
# Setup directories as root for the adam user # Setup directories as root for the adam user
@@ -52,10 +48,9 @@ chmod 700 /home/adam/.ssh
echo "[PASTE_PUB_KEY_HERE]" > /home/adam/.ssh/authorized_keys echo "[PASTE_PUB_KEY_HERE]" > /home/adam/.ssh/authorized_keys
chmod 600 /home/adam/.ssh/authorized_keys chmod 600 /home/adam/.ssh/authorized_keys
chown -R adam:adam /home/adam/.ssh chown -R adam:adam /home/adam/.ssh
``` ```
### Harden SSH Daemon **Harden SSH Daemon**
Modify the SSH configuration to change the default port and disable password entry. Modify the SSH configuration to change the default port and disable password entry.
@@ -70,14 +65,11 @@ EOF
# Validate syntax before restarting to avoid lockout # Validate syntax before restarting to avoid lockout
sshd -t && systemctl restart ssh sshd -t && systemctl restart ssh
``` ```
--- ### GitHub Access (Deploy Key)
## 3. GitHub Access (Deploy Key) The host requires its own identity to pull updates from the GitHub repository.
Since the repository is hosted on GitHub, the host needs its own identity to pull updates.
```bash ```bash
# Generate a host-specific SSH key (no passphrase for automation) # Generate a host-specific SSH key (no passphrase for automation)
@@ -85,28 +77,22 @@ ssh-keygen -t ed25519 -f /home/adam/.ssh/adam-at-deytenit_github_com_ed25519 -N
# Display the public key to be added to GitHub (Settings > Deploy Keys) # Display the public key to be added to GitHub (Settings > Deploy Keys)
cat /home/adam/.ssh/adam-at-deytenit_github_com_ed25519.pub cat /home/adam/.ssh/adam-at-deytenit_github_com_ed25519.pub
``` ```
> [!TIP] > [!TIP]
> Add the output above to your [GitHub Repository Deploy Keys](https://www.google.com/search?q=https://github.com/deytenit/root.ermnvldmr.com/settings/keys) with **read access**. > Add the output above to the [GitHub: Repository Deploy Keys](https://github.com/deytenit/root.ermnvldmr.com/settings/keys) with **read access**.
--- ### Install Docker Engine
## 4. Install Docker Engine Install the standard Docker Engine for Debian.
Standard Docker installation for Debian - [Docs: Docker - Install on Debian](https://docs.docker.com/engine/install/debian/).
```bash ```bash
# Follow official guide: https://docs.docker.com/engine/install/debian/ # Follow official guide: https://docs.docker.com/engine/install/debian/
# Once installed, verify (Adam can run this without sudo now) # Once installed, verify (Adam can run this without sudo now)
docker run --rm hello-world docker run --rm hello-world
``` ```
--- ### Repository Deployment
## 5. Repository Deployment
Clone the infrastructure repository and initialize the node. Clone the infrastructure repository and initialize the node.
@@ -123,10 +109,9 @@ sudo -u adam git clone git@github.com:deytenit/root.ermnvldmr.com.git $REPO_DIR
export NODE="daedalus" export NODE="daedalus"
cd $REPO_DIR cd $REPO_DIR
sudo -u adam ./init.sh sudo -u adam ./init.sh
``` ```
### Node-Specific Configuration **Node-Specific Configuration**
Run the staged initialization scripts in order: Run the staged initialization scripts in order:
@@ -136,12 +121,9 @@ Run the staged initialization scripts in order:
./$NODE/.host/.scripts/10-ufw ./$NODE/.host/.scripts/10-ufw
./$NODE/.host/.scripts/20-crowd ./$NODE/.host/.scripts/20-crowd
./$NODE/.host/.scripts/30-cron ./$NODE/.host/.scripts/30-cron
``` ```
--- ### Storage & Hardening
## 6. Storage & Hardening
Define the data tiers and secure the environment by creating non-root users for containerized services. Define the data tiers and secure the environment by creating non-root users for containerized services.
@@ -156,5 +138,12 @@ sudo -u adam .scripts/ops/setup-tiers $NODE \
/srv/com-ermnvldmr-root-$NODE-tier3 /srv/com-ermnvldmr-root-$NODE-tier3
sudo -u adam .scripts/ops/setup-noroot-users $NODE sudo -u adam .scripts/ops/setup-noroot-users $NODE
``` ```
{{% /steps %}}
---
**See also:**
- [Doc: Docker - Install on Debian](https://docs.docker.com/engine/install/debian/)
- [GitHub: root.ermnvldmr.com](https://github.com/deytenit/root.ermnvldmr.com)