Whenever I used to spin up a new Linux server, my manual setup routine was always the same: SSH in, update system packages, configure UFW firewall rules, set up Fail2ban jails, write Nginx proxy configurations with security headers, and verify that services were enabled at boot.

Manually running through that checklist took roughly 25 minutes per machine . On a single test box it wasn't a blocker, but repeating those steps across multiple environments quickly became repetitive, tedious, and prone to small human errors—like forgetting a header or mistyping a firewall port.

Industry incident data shows that over 80% of unauthorized access incidents on internet-facing compute nodes stem from basic configuration drift and missed hardening steps , such as unrestricted default ports or unpatched vulnerabilities.

To eliminate manual toil and ensure consistent infrastructure, I decided to automate the entire process using an idempotent Ansible playbook .

Here are my live test notes, configuration files, and…