RUNBOOK: Hetzner VPS Phase 1 Deployment

ssh root@<SERVER_IP>

apt update && apt upgrade -y
apt install -y ufw fail2ban auditd curl git unzip htop

adduser atlantis
usermod -aG sudo atlantis
# Copy SSH key to new user
rsync --archive --chown=atlantis:atlantis ~/.ssh /home/atlantis

nano /etc/ssh/sshd_config

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
X11Forwarding no
AllowUsers atlantis

systemctl restart sshd

ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status verbose

systemctl enable fail2ban
systemctl start fail2ban

[sshd]
enabled = true
port = ssh
maxretry = 5
bantime = 3600

systemctl restart fail2ban

cat >> /etc/audit/rules.d/docker.rules << 'EOF'
-w /usr/bin/dockerd -k docker
-a exit,always -F path=/run/containerd -F perm=war -k docker
-a exit,always -F path=/var/lib/docker -F perm=war -k docker
-w /etc/docker -k docker
-w /lib/systemd/system/docker.service -k docker
-w /lib/systemd/system/docker.socket -k docker
-w /etc/docker/daemon.json -k docker
-w /etc/containerd/config.toml -k docker
-w /usr/bin/containerd -k docker
-w /usr/bin/containerd-shim -k docker
-w /usr/bin/runc -k docker
EOF

systemctl restart auditd
auditctl -l | grep docker

# Verify Docker root dir is on its own mount after Docker install
mountpoint -- "$(docker info -f '{{ .DockerRootDir }}')"

# Install Docker via official script
curl -fsSL https://get.docker.com | sh

# Verify version (CIS 1.2.2 - keep Docker up to date)
docker --version

# Do NOT add atlantis user to docker group (CIS 1.1.2)
# Use sudo docker or configure rootless mode

{
  "icc": false,
  "log-level": "info",
  "live-restore": true,
  "userland-proxy": false,
  "no-new-privileges": true,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

systemctl restart docker
docker info | grep -E "Logging|Live Restore|UserProxy"

# daemon.json ownership and permissions
chown root:root /etc/docker/daemon.json
chmod 644 /etc/docker/daemon.json

# /etc/docker directory
chown root:root /etc/docker
chmod 755 /etc/docker

# Docker socket
chown root:docker /var/run/docker.sock
chmod 660 /var/run/docker.sock

apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudflare.com/public/packages/repos/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudflare.com/public/packages/repos/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
apt update && apt install caddy

forgejo.atlantisits.co {
    reverse_proxy localhost:3000
}

n8n.atlantisits.co {
    reverse_proxy localhost:5678
}

ntfy.atlantisits.co {
    reverse_proxy localhost:2586
}

systemctl enable caddy
systemctl start caddy

mkdir -p /opt/atlantis/forgejo/data
mkdir -p /opt/atlantis/forgejo/config

version: "3.8"

services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:latest
    container_name: forgejo
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - FORGEJO__server__DOMAIN=forgejo.atlantisits.co
      - FORGEJO__server__ROOT_URL=https://forgejo.atlantisits.co
      - FORGEJO__server__HTTP_PORT=3000
    volumes:
      - /opt/atlantis/forgejo/data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:3000:3000"
    security_opt:
      - no-new-privileges:true
    read_only: false
    user: "1000:1000"

cd /opt/atlantis/forgejo
docker compose up -d
docker compose logs -f

mkdir -p /opt/atlantis/n8n/data

N8N_HOST=n8n.atlantisits.co
N8N_PORT=5678
N8N_PROTOCOL=https
WEBHOOK_URL=https://n8n.atlantisits.co/
N8N_BASIC_AUTH_ACTIVE=true
N8N_BASIC_AUTH_USER=admin
N8N_BASIC_AUTH_PASSWORD=<STRONG_PASSWORD>
N8N_ENCRYPTION_KEY=<RANDOM_32_CHAR_KEY>

version: "3.8"

services:
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    env_file:
      - .env
    volumes:
      - /opt/atlantis/n8n/data:/home/node/.n8n
    ports:
      - "127.0.0.1:5678:5678"
    security_opt:
      - no-new-privileges:true
    user: "node"

cd /opt/atlantis/n8n
docker compose up -d
docker compose logs -f

mkdir -p /opt/atlantis/ntfy/data

base-url: https://ntfy.atlantisits.co
listen-http: ":2586"
cache-file: /var/cache/ntfy/cache.db
auth-file: /var/lib/ntfy/user.db
auth-default-access: deny-all
behind-proxy: true

version: "3.8"

services:
  ntfy:
    image: binwiederhier/ntfy:latest
    container_name: ntfy
    restart: unless-stopped
    command: serve
    volumes:
      - /opt/atlantis/ntfy/server.yml:/etc/ntfy/server.yml:ro
      - /opt/atlantis/ntfy/data:/var/lib/ntfy
    ports:
      - "127.0.0.1:2586:2586"
    security_opt:
      - no-new-privileges:true

cd /opt/atlantis/ntfy
docker compose up -d

# Create admin user
docker exec -it ntfy ntfy user add --role=admin <USERNAME>

# No privileged containers (5.5)
docker ps -q | xargs docker inspect --format '{{ .Name }}: Privileged={{ .HostConfig.Privileged }}'

# Memory limits set (5.11)
docker ps -q | xargs docker inspect --format '{{ .Name }}: Memory={{ .HostConfig.Memory }}'

# No host network namespace sharing (5.10)
docker ps -q | xargs docker inspect --format '{{ .Name }}: NetworkMode={{ .HostConfig.NetworkMode }}'

# No sensitive host dirs mounted (5.6)
docker ps -q | xargs docker inspect --format '{{ .Name }}: Mounts={{ .Mounts }}'

# no-new-privileges active (5.4)
docker ps -q | xargs docker inspect --format '{{ .Name }}: NoNewPrivileges={{ .HostConfig.SecurityOpt }}'

# Restart policy on-failure max 5 (5.15)
docker ps -q | xargs docker inspect --format '{{ .Name }}: RestartPolicy={{ .HostConfig.RestartPolicy }}'

# Verify no containers running as root (4.1)
docker ps -q | xargs docker inspect --format '{{ .Name }}: User={{ .Config.User }}'

# Verify content trust is enabled (4.5)
echo $DOCKER_CONTENT_TRUST
# Should return 1 — if not: export DOCKER_CONTENT_TRUST=1 in /etc/environment

docker info | grep -E "Logging Driver|Live Restore"
cat /etc/docker/daemon.json

stat -c '%U:%G %a %n' /etc/docker/daemon.json
stat -c '%U:%G %a %n' /var/run/docker.sock
stat -c '%U:%G %a %n' /etc/docker

# Verify all three subdomains resolve to Hetzner IP
dig forgejo.atlantisits.co
dig n8n.atlantisits.co
dig ntfy.atlantisits.co

# Verify SSL certs issued by Caddy
curl -I https://forgejo.atlantisits.co
curl -I https://n8n.atlantisits.co
curl -I https://ntfy.atlantisits.co

#!/bin/bash
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_DIR="/opt/atlantis/backups"

mkdir -p $BACKUP_DIR

# Forgejo
tar -czf $BACKUP_DIR/forgejo_$TIMESTAMP.tar.gz /opt/atlantis/forgejo/data

# n8n
tar -czf $BACKUP_DIR/n8n_$TIMESTAMP.tar.gz /opt/atlantis/n8n/data

# NTFY
tar -czf $BACKUP_DIR/ntfy_$TIMESTAMP.tar.gz /opt/atlantis/ntfy/data

# Retain last 7 days only
find $BACKUP_DIR -name "*.tar.gz" -mtime +7 -delete

echo "Backup complete: $TIMESTAMP"

chmod +x /opt/atlantis/backup.sh

# Schedule daily at 2am
crontab -e
# Add: 0 2 * * * /opt/atlantis/backup.sh >> /var/log/atlantis-backup.log 2>&1

# Check all running containers
docker ps -a

# View logs for a service
docker compose -f /opt/atlantis/forgejo/docker-compose.yml logs -f

# Restart a service
docker compose -f /opt/atlantis/n8n/docker-compose.yml restart

# Update a service image
docker compose -f /opt/atlantis/forgejo/docker-compose.yml pull
docker compose -f /opt/atlantis/forgejo/docker-compose.yml up -d

# Check Caddy status
systemctl status caddy
journalctl -u caddy -f

# Check firewall
ufw status verbose

# Check fail2ban
fail2ban-client status sshd

# Check audit logs
ausearch -k docker | tail -20