A backup strategy for root servers that holds up when it matters
The 3-2-1 rule on a single root server, restic and Borg with examples, retention and encryption. Plus the step almost everyone skips: actually testing the restore.
Linux guides for root servers
From a fresh Debian install to a hardened web server: the fundamentals, services and maintenance tasks that come up on every root server.
Changing the hostname permanently on Linux: hostnamectl, /etc/hosts and cloud-init
hostnamectl, /etc/hostname and /etc/hosts working together, the switch against cloud-init resetting the name, and the effects on sudo, mail servers and certificates.
journalctl: analyzing systemd logs and keeping them permanently
Time windows, unit filters, priorities and search patterns: how to cut out exactly the section that belongs to the incident, in three or four commands. Plus a journal that survives reboots, with the error messages quoted verbatim.
Updating a Linux server safely with apt
The difference between upgrade, full-upgrade and dist-upgrade, packages kept back, dpkg configuration prompts, kernel reboots with needrestart, and the release upgrade as a category of its own.
Fixing nginx 504 Gateway Time-out: find the cause instead of raising the timeout
With a 504 the backend was reachable, it only answered too slowly. How to use a timing log to pin down where the time goes, which of the many timeouts really applies, and why a higher timeout usually only postpones the outage.
Calculating pm.max_children for PHP-FPM instead of guessing
The message server reached pm.max_children does not mean you should double the value. Measure, calculate, choose the process manager mode, and then prove that the value really fits.
Set up simple server monitoring with built-in tools
A check script, a systemd timer and a tested notification path are enough for a single root server. This guide shows what to monitor, how to verify every step and when the big toolbox starts to pay off.
Changing the SSH port without locking yourself out: sshd, socket activation and SELinux
Changing the SSH port almost always fails on the order of the steps. This guide keeps the server listening on both ports while you work, so the old one only goes away once the new one is proven to work.
Creating a user with sudo privileges and no longer working as root
adduser vs useradd, the sudo and wheel groups, editing sudoers safely with visudo and the test that proves you have not locked yourself out before you switch root off.
Setting up automatic security updates with unattended-upgrades
How to set up unattended-upgrades so that it really runs: allowed origins, excluded packages, reboot behavior, the mail report and the proof in the log that something actually happened.
Set up the time zone and time synchronization on a Linux server
A wrong server clock never shows up as a clock problem: it shows up as a rejected certificate, as a package source apt refuses, or as a cron job at the wrong hour. How to set the time zone and the time service correctly, and how to prove that synchronization is running.
Fixing the apt error "Could not get lock"
Why apt is suddenly locked, which process is behind it and how to find it with lsof and fuser. Plus how to remove the lock file without damaging the package database.
Installing Nextcloud on your own server
From an empty server to an overview page without warnings: web server, PHP modules, database, data directory permissions, trusted_domains, upload limits and background jobs via cron.
Setting up nginx as a reverse proxy
From proxy_pass to the WebSocket upgrade: the complete guide to nginx as a reverse proxy, including the four headers without which your application thinks every visitor is 127.0.0.1.
Fixing the SSH error "Permission denied (publickey)"
Your SSH login fails with Permission denied (publickey)? Seven causes, from file permissions and AllowUsers through to SELinux, each with the exact log line and the matching fix.
Migrating WordPress to a new server without downtime
The order is what decides it: prepare the new server, copy the data, test under the real domain via the hosts file, issue the certificate in advance, and only then switch DNS. With a rollback path and the error messages you will actually see.
Set up a cron job: schedule, permissions and the most common mistakes
The job runs in your shell but not in cron. This guide explains the five time fields, the difference between the user crontab and /etc/cron.d, the PATH trap and how to prove that a job really succeeded.
Installing Docker and Docker Compose on Debian and Ubuntu
Why docker.io is too old on Debian 12 but perfectly fine on Ubuntu, how to add the official repository with a keyring instead of apt-key, why Compose is a plugin now and why the docker group effectively means root.
Set up fail2ban and block brute force attacks automatically
How to configure fail2ban cleanly through jail.local, get the sshd jail running on all four current LTS distributions, verify and lift bans, and which mistakes will otherwise slow you down.
Disk full: finding and freeing up space on a Linux server
When df reports 100% and du finds nothing: the complete path from measuring to freeing up space, for Debian 12 and 13 as well as Ubuntu 22.04 and 24.04.
Let's Encrypt wildcard certificate over DNS validation
A wildcard certificate cannot be validated through the web server, it always goes through a TXT record in DNS. This guide shows the manual and the automatic route on Debian 13, Debian 12, Ubuntu 24.04 and Ubuntu 22.04, plus the errors it actually fails on.
Fixing nginx 502 Bad Gateway: causes and solutions
502 Bad Gateway means nginx got no valid response from the backend. The five most common causes, the matching line in the error log, and how to prove that the fix really works.
Installing and configuring nginx on Debian and Ubuntu
From the apt package to the first server block with PHP-FPM and HTTPS: which nginx version each distribution ships, what is different about the nginx.org repository, and how to get rid of the typical errors.
Setting up swap and preventing out of memory crashes
Service gone, no crash report, the log file ends mid-sentence: how to prove an OOM kill, create a swap file cleanly and tell when swap only postpones the problem.
Setting up a new root server: checklist for the first 30 minutes
The first 30 minutes on a new root server decide how it will run. Nine steps in the right order, including the Debian 13 and Ubuntu 24.04 pitfalls that most guides leave out.
Securing SSH: key login, blocking root login, disabling password authentication
ed25519 on Linux, macOS and Windows, the cloud-init trap in /etc/ssh/sshd_config.d, socket activation on Ubuntu 24.04, proof through sudo sshd -T and the rescue route via the console.
Connecting to a server via SSH: Windows, macOS and Linux
The first SSH connection step by step: PuTTY and OpenSSH on Windows, Terminal on macOS and Linux, checking the fingerprint properly, transferring files and fixing the usual error messages.
Setting up a static IP address on Debian and Ubuntu
Fixed IPv4 and IPv6 addresses on Ubuntu 24.04, Ubuntu 22.04, Debian 13 and Debian 12: netplan, ifupdown and systemd-networkd compared, with a rollback strategy and extra IPs.
Create your own systemd service and run it automatically at boot
The unit file line by line: Type, User, WorkingDirectory, Restart and network-online.target. With the error messages verbatim and the proof that the service really survives a reboot.
Setting up the UFW firewall without locking yourself out
The correct order when building a UFW rule set, IPv6 rules, nftables as the backend, rate limiting with ufw limit and the way back in through the console if it does go wrong.
Set up a WireGuard VPN on your own server
From an empty server to a working WireGuard tunnel: key pairs, NAT with nftables, wg-quick as a service, a QR code for your phone and the three failure modes that really cost you time.
Run programs automatically at server startup (systemd and cron)
How applications, game servers and scripts start by themselves after every reboot: with a systemd service unit as today's standard, or alternatively through a cron entry with @reboot.
Install htop on AlmaLinux, Rocky Linux, RHEL and Oracle Linux
Two commands are enough on any system in the Red Hat family: enable EPEL, install htop. Why CRB and PowerTools are not needed for it, measured in real containers.
apt update fails: switching an old Debian release to the archive
Once a Debian release reaches its end of life, apt update aborts with a 404 error. Here is how to switch sources.list over to archive.debian.org and make the server updatable again.
Install your own mail server with Modoboa on Debian
The Modoboa installer sets up Postfix, Dovecot, webmail and SSL in a single run. Here is how to install your own mail server on Debian and set the DNS records it needs.
Setting up a free SSL certificate with Let's Encrypt and Certbot
A free SSL certificate for your Linux server: install Certbot on Debian and Ubuntu, issue a Let's Encrypt certificate for Apache and let it renew itself automatically.
Redirect HTTP to HTTPS with .htaccess (301 redirect)
Visitors still landing on the unencrypted page? A few lines in the .htaccess file are enough to redirect every HTTP request permanently to HTTPS with a 301 redirect.
Installing Node.js and npm on Debian
Node.js 10 and 12 have been out of support for years. Here is how to install the current LTS release together with npm on Debian, using NodeSource with the signing key in /etc/apt/keyrings.
