Personal Debian Infrastructure

The public website is served by nginx. Remote administration uses SSH over the local network or Tailscale rather than exposing SSH as a general Internet service. UFW expresses the host-level policy, and listening sockets are checked directly so that firewall rules are not mistaken for a complete inventory of services.

BitTorrent requires its own deliberate exposure for peer connectivity. Public and private services are treated separately instead of assuming that every process on the machine has the same trust boundary.

The website consists of generated HTML and assets. No database, account system, plugin framework, or server-side content application is required. This removes several common classes of web vulnerability and greatly simplifies recovery.

Static does not mean harmless: nginx, SSH, the operating system, deployment credentials, DNS, and TLS configuration remain part of the attack surface.

Long-running services are managed by systemd where appropriate. After a reboot or major upgrade, I verify:

• the expected network interfaces and routes;
• mounted data volumes;
• active services and failed units;
• listening sockets and firewall state;
• website and HTTPS availability;
• private SSH access;
• storage space and relevant logs.

A service reported as enabled is not necessarily healthy. Verification must include observable behaviour.

The server uses a separate data volume for substantial content. Mount configuration, ownership, service users, and permissions must be recoverable, not remembered informally.

Backups should cover irreplaceable data, configurations, credentials, and the procedure required to restore them. Replicable public data, such as Debian images, does not necessarily deserve the same backup policy as original work.

The main defended scenarios are automated Internet attacks, accidental service exposure, weak remote access, configuration mistakes, and failures discovered after maintenance. Physical compromise and an unencrypted system disk remain explicit limitations.

The system is not presented as invulnerable. Its security comes from reducing exposure, strong authentication, updates, inspection, and the ability to understand what the machine is actually doing.