🏠 Home← Back to .

Self-Hosting TODO — eagleserver

What’s done, what’s missing, and what to do next.

✅ Already Completed

  • [x] Ubuntu server installed and updated
  • [x] nginx landing page live (eaglehub.dev, /var/www/landing/) — hub with links to Vaultwarden, Uptime Kuma, 2nd Brain
  • [x] HTTPS via Let’s Encrypt / Certbot
  • [x] SSH hardened: port 2222, PermitRootLogin no, PasswordAuthentication no
  • [x] UFW enabled: allows 2222/tcp, 80/tcp, 443/tcp, default deny incoming
  • [x] fail2ban active for sshd
  • [x] unattended-upgrades enabled for automatic security patches
  • [x] ssh.service enabled (replaced socket activation)
  • [x] Hermes running natively (not Docker) on eagleserver
  • [x] Obsidian vault at ~/ObsidianVaults/2nd-brain/
  • [x] nginx reverse proxy /brain/ → 127.0.0.1:8080 (uvicorn)
  • [x] EaglePi at 192.168.1.13: key-only SSH, ports 22/53/3001 open
  • [x] Tailscale VPN installed and mesh verified (eagleserver + other devices)
  • [x] Restic backups installed, initialized on /mnt/backup (RAID10)
  • [x] Automated daily backup via systemd timer (restic-backup.timer)
  • [x] Local backup targets: vault, nginx, ssh, landing page
  • [x] Eagleserver port scan clean (only 2222, 80, 443, 8080, 53)
  • [x] Vaultwarden deployed at https://vault.eaglehub.dev (self-hosted Bitwarden)
  • [x] Uptime Kuma on eagleserver via Docker at http://192.168.1.7:3001
  • [x] Unused services disabled: ModemManager, xrdp, udisks2, upower, wpa_supplicant

🔴 High Priority

1. Add Uptime Kuma monitors on EaglePi

  • [x] Reinstalled Uptime Kuma on EaglePi with correct systemd user service
  • [x] Service running on http://192.168.1.13:3001
  • [ ] Create admin account and add monitors:
  • https://eaglehub.dev
  • https://eaglehub.dev/brain/
  • ssh://eaglehub.dev:2222
  • [ ] Set up notifications (Discord webhook, email, Telegram, etc.)

2. Add nginx security headers

  • [x] Added to landing page and /brain/ proxy config:
  • Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  • X-Content-Type-Options: nosniff
  • X-Frame-Options: DENY
  • Referrer-Policy: strict-origin-when-cross-origin
  • [x] Verified with curl -sI https://eaglehub.dev

3. SSH config hardening

  • [x] Added to /etc/ssh/sshd_config:
  • ClientAliveInterval 300
  • ClientAliveCountMax 2
  • MaxAuthTries 3
  • AllowUsers eagle
  • X11Forwarding no
  • TCPKeepAlive no
  • AllowTcpForwarding no
  • [x] Restarted sshd and verified access

4. System hardening

  • [x] Apply sysctl hardening:
  • rp_filter=1, accept_redirects=0, log_martians=1
  • [x] Disable unused services:
  • ModemManager, xrdp, udisks2, upower, wpa_supplicant, open-vm-tools, vgauth

5. Offsite backup (complete 3-2-1)

  • [x] Signed up for Backblaze B2 (10 GB free tier)
  • [x] Offsite repo initialized at b2:eagleserver-backups
  • [x] First offsite backup completed
  • [x] Offsite backup automated in backup.sh with B2 credentials

🟡 Medium Priority

6. Service inventory

  • [x] Documented services in service-inventory.md
  • [ ] Review and update quarterly

7. Security verification

  • [ ] Run Lynis audit: bash sudo apt install lynis sudo lynis audit system Target score > 70.
  • [ ] Review firewall rules quarterly

8. Password manager

  • [x] Vaultwarden deployed at https://vault.eaglehub.dev
  • [ ] Generate unique passwords for every service and import into Vaultwarden
  • [ ] Enable 2FA everywhere

9. Secrets hygiene

  • [ ] Move any plaintext creds to .env files with 600 perms
  • [ ] Add .env and *.key to .gitignore
  • [ ] Consider sops + age for encrypted secrets in git

10. Compiler hardening

  • [x] Removed build-essential, gcc, g++, make
  • [x] Retained gcc-16-base/libgcc because system libraries depend on it

11. DNS hardening

  • [ ] Enable DNSSEC on domain registrar
  • [ ] Use encrypted DNS (DoH/DoT) on server and clients

🟢 Low Priority / Nice to Have

11. Intrusion detection

  • [x] Installed auditd and loaded critical file watch rules
  • /etc/passwd, /etc/group, /etc/sudoers
  • /root/.ssh, /home/eagle/.ssh
  • /etc/ssh/sshd_config, /etc/fail2ban/jail.local
  • [ ] Review audit logs periodically for unauthorized changes

13. Network segmentation

  • [ ] Put IoT devices on a separate VLAN
  • [ ] Isolate servers from personal devices

14. Cloudflare proxy

  • [ ] Consider proxying eaglehub.dev through Cloudflare for DDoS protection and IP hiding

📅 Maintenance Cadence

Frequency Task
Daily Security updates run automatically, backups execute
Weekly sudo apt update && sudo apt upgrade -y, review auth logs
Monthly Fail2ban stats, port scan, Lynis audit, backup restore test
Quarterly Service inventory review, update runbooks, DR test
Annually Major OS upgrade, hardware health check

Next Immediate Steps

  1. AIDE file integrity — baseline critical files
  2. Generate unique passwords — import all service passwords into Vaultwarden
  3. Enable 2FA — everywhere it’s supported (SSH, Vaultwarden, etc.)
  4. DNSSEC + encrypted DNS — on domain registrar and server/clients
  5. auditd rules — watch /etc/passwd, /etc/sudoers, .ssh/