VPS Hosting (Hetzner, etc.) implementation checklist

Modify /etc/ssh/sshd_config to set PermitRootLogin no and verify you can login as a sudo user.

Set PasswordAuthentication no in SSH config to prevent brute-force password attacks.

Set a default deny policy and explicitly allow only ports 22, 80, and 443.

Configure jails for SSH and your web server to automatically ban IP addresses with multiple failed login attempts.

Install the unattended-upgrades package and configure it to automatically install security patches daily.

Configure Caddy or Nginx with Certbot to ensure Let's Encrypt certificates renew before the 90-day expiration.

Add the Strict-Transport-Security header to proxy responses to force HTTPS-only connections.

Verify the VPS has a valid AAAA record and the reverse proxy is listening on [::] to support European mobile networks.

Define limit_req zones in Nginx or use Caddy's rate_limit directive to prevent application-layer DoS.

Configure the reverse proxy to check the backend service status before routing traffic to prevent 502 errors.

Set max-size and max-file in /etc/docker/daemon.json to prevent container logs from filling the system disk.

Verify Dockerfiles include a USER directive so the application process does not run with root privileges inside the container.

Apply memory and CPU limits in docker-compose.yml to prevent a single container from crashing the entire VPS.

Schedule a weekly cron job for 'docker system prune -f' to remove unused images and build cache.

Configure post-deployment health checks to verify the new container is responding before shutting down the old one.

Enable daily automated snapshots in the Hetzner or OVH control panel for full-server recovery.

Configure a cron job to stream encrypted database dumps to S3-compatible storage outside the VPS provider's network.

Manually restore a database backup to a local development environment to verify data integrity.

Ensure all database data and user uploads are stored on attached block storage volumes, not the local OS disk.

Store an encrypted copy of the .env file or secrets in a secure password manager or vault.

Set up an external service to ping the application's health endpoint every 60 seconds.

Configure a monitoring agent (e.g., Netdata or Prometheus) to alert when disk usage exceeds 80%.

Create a swap file (2-4GB) to provide a buffer for memory spikes on low-RAM VPS instances.

Ensure systemd-timesyncd is active to prevent clock drift, which can cause issues with SSL and auth tokens.

Forward system and application logs to a dedicated logging server or service for post-mortem analysis.