Deploying a self-hosted environment on a fresh Linux instance requires establishing a secure baseline before you start spinning up web services or databases. A naked Ubuntu server exposed to the public internet is vulnerable to automated scanning and brute-force attacks within minutes of deployment.

Read, Understand, and Apply Selectively

Please read this entire guide carefully before executing commands. Take the time to understand what each phase does, and only apply the configurations required for your specific architecture. Some steps (like strict cloud-provider rules or swap memory) may not be necessary for every environment. If a step doesn't fit your use case, skip it.

This guide establishes a chronological, production-ready DevSecOps baseline from the moment you first SSH into your new virtual machine.

Phase 1: Initial System Provisioning

Before configuring any services, you must ensure the base operating system is up-to-date and accurately tracking time.…