1# typical first login (password auth, if provider emailed root password)
2ssh root@YOUR_SERVER_IP
3 
4# if you already added a deploy user + key on the server
5ssh deploy@YOUR_SERVER_IP

1cd ~/Downloads
2# cd "C:\Users\You\Downloads"
3 
4chmod 400 "./YOUR_KEY.pem"
5 
6# Ubuntu AMI — ubuntu@ (Amazon Linux — ec2-user@)
7ssh -i "./YOUR_KEY.pem" ubuntu@YOUR_PUBLIC_DNS_OR_IP
8 
9# ssh -i "./YOUR_KEY.pem" ubuntu@ec2-00-00-00-00.us-east-1.compute.amazonaws.com
10# ssh -i "./YOUR_KEY.pem" ubuntu@203.0.113.10

1sudo fallocate -l 2G /swapfile
2sudo chmod 600 /swapfile
3sudo mkswap /swapfile
4sudo swapon /swapfile
5echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

1sudo apt update && sudo apt -y upgrade
2sudo apt -y install curl git ufw fail2ban unattended-upgrades

1sudo adduser deploy
2sudo usermod -aG sudo deploy
3sudo rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

1# on your laptop
2ssh-keygen -t ed25519 -C "deploy@yourdomain"

1# append public key on server
2sudo mkdir -p /home/deploy/.ssh
3echo "YOUR_PUBLIC_KEY" | sudo tee -a /home/deploy/.ssh/authorized_keys
4sudo chown -R deploy:deploy /home/deploy/.ssh
5sudo chmod 700 /home/deploy/.ssh
6sudo chmod 600 /home/deploy/.ssh/authorized_keys

1# recommended flags (merge carefully)
2PermitRootLogin no
3PasswordAuthentication no
4KbdInteractiveAuthentication no
5ChallengeResponseAuthentication no
6AllowUsers deploy

1# 1) install tools
2sudo apt -y install libpam-google-authenticator qrencode
3 
4# 2) as deploy user
5google-authenticator -t -d -f -r 3 -R 30 -W
6 
7# 3) edit PAM for sshd
8echo "auth required pam_google_authenticator.so" | sudo tee -a /etc/pam.d/sshd
9 
10# 4) sshd_config — enable challenge-response + require MFA after pubkey
11sudo nano /etc/ssh/sshd_config
12# set: ChallengeResponseAuthentication yes
13# append: AuthenticationMethods publickey,keyboard-interactive
14 
15# 5) keep sudo session safe (optional)
16echo "auth required pam_google_authenticator.so" | sudo tee -a /etc/pam.d/sudo
17 
18# 6) reload
19sudo systemctl reload ssh
20 
21# 7) TEST in a second session before closing the first
22 
23# 8) emergency: recovery console / IPMI if locked out
24 
25# 9) backup secret codes offline
26 
27# 10) rotate codes periodically

1sudo ufw default deny incoming
2sudo ufw default allow outgoing
3sudo ufw allow OpenSSH
4sudo ufw allow 80/tcp
5sudo ufw allow 443/tcp
6sudo ufw enable
7sudo ufw status verbose

1[DEFAULT]
2bantime = 1h
3findtime = 10m
4maxretry = 5
5 
6[sshd]
7enabled = true
8port    = ssh
9logpath = %(sshd_log)s
10backend = systemd

1sudo systemctl enable --now fail2ban
2sudo fail2ban-client status sshd

1curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
2sudo apt install crowdsec
3sudo cscli hub update
4sudo cscli collections install crowdsecurity/linux crowdsecurity/sshd
5sudo systemctl enable --now crowdsec

1wget -qO - https://www.mongodb.org/static/pgp/server-7.0.asc | sudo gpg --dearmor -o /usr/share/keyrings/mongodb-server-7.0.gpg
2echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/7.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list
3sudo apt update && sudo apt -y install mongodb-org

1storage:
2  dbPath: /var/lib/mongodb
3systemLog:
4  destination: file
5  path: /var/log/mongodb/mongod.log
6net:
7  port: 27017
8  bindIp: 127.0.0.1
9security:
10  authorization: enabled

1sudo systemctl enable --now mongod

1mongosh <<'EOF'
2use admin
3db.createUser({ user: "admin", pwd: "STRONG_PASSWORD", roles: ["root"] })
4use appdb
5db.createUser({ user: "app", pwd: "STRONG_PASSWORD", roles: ["readWrite"] })
6EOF

1sudo apt -y install postgresql postgresql-contrib pgbouncer

1[databases]
2app = host=127.0.0.1 port=5432 dbname=app
3 
4[pgbouncer]
5listen_addr = 127.0.0.1
6listen_port = 6432
7auth_type = scram-sha-256
8auth_file = /etc/pgbouncer/userlist.txt
9pool_mode = transaction
10max_client_conn = 200
11default_pool_size = 20

1"appuser" "SCRAM_HASH_FROM_postgres"

1sudo apt -y install redis-server

1bind 127.0.0.1
2protected-mode yes
3requirepass STRONG_REDIS_PASSWORD
4maxmemory 256mb
5maxmemory-policy allkeys-lru

1curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
2source ~/.nvm/nvm.sh
3nvm install --lts
4node -v

1ssh-keygen -t ed25519 -C "deploy-key" -f ~/.ssh/deploy_ed25519 -N ""
2cat ~/.ssh/deploy_ed25519.pub
3# add read-only deploy key in Git provider

1sudo mkdir -p /var/www && sudo chown deploy:deploy /var/www
2cd /var/www
3git clone git@github.com:org/backend.git
4git clone git@github.com:org/frontend.git
5git clone git@github.com:org/dashboard.git

1module.exports = {
2  apps: [{
3    name: "api",
4    cwd: "/var/www/backend",
5    script: "dist/main.js",
6    instances: "max",
7    exec_mode: "cluster",
8    env: { NODE_ENV: "production" }
9  }]
10};

1module.exports = {
2  apps: [{
3    name: "web",
4    cwd: "/var/www/frontend",
5    script: "node_modules/next/dist/bin/next",
6    args: "start -p 3000",
7    env: { NODE_ENV: "production" }
8  }]
9};

1module.exports = {
2  apps: [{
3    name: "dash",
4    cwd: "/var/www/dashboard",
5    script: "dist/server.js",
6    env: { NODE_ENV: "production" }
7  }]
8};

1npm i -g pm2
2cd /var/www/backend && npm ci && npm run build
3cd /var/www/frontend && npm ci && npm run build
4cd /var/www/dashboard && npm ci && npm run build
5pm2 start /var/www/backend/ecosystem.config.js
6pm2 start /var/www/frontend/ecosystem.config.js
7pm2 start /var/www/dashboard/ecosystem.config.js
8pm2 save
9pm2 startup systemd -u deploy --hp /home/deploy

1sudo apt update && sudo apt install -y tmux
2tmux new -s api
3# inside tmux: cd /var/www/backend && node dist/main.js
4# detach: Ctrl+b  then  d
5tmux attach -t api
6tmux ls

1NODE_ENV=production
2PORT=4000
3DATABASE_URL=mongodb://app:password@127.0.0.1:27017/appdb
4REDIS_URL=redis://:password@127.0.0.1:6379

1sudo apt -y install nginx
2sudo systemctl enable --now nginx

1proxy_http_version 1.1;
2proxy_set_header Host $host;
3proxy_set_header X-Real-IP $remote_addr;
4proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
5proxy_set_header X-Forwarded-Proto $scheme;
6proxy_set_header Upgrade $http_upgrade;
7proxy_set_header Connection $connection_upgrade;

1map $http_upgrade $connection_upgrade {
2  default upgrade;
3  ''      close;
4}

1sudo nginx -t && sudo systemctl reload nginx

1server {
2  listen 80;
3  server_name api.yourdomain.com;
4 
5  location / {
6    include proxy_params;
7    proxy_pass http://127.0.0.1:4000;
8  }
9}

1server {
2  listen 80;
3  server_name yourdomain.com www.yourdomain.com;
4 
5  location / {
6    include proxy_params;
7    proxy_pass http://127.0.0.1:3000;
8  }
9}

1server {
2  listen 80;
3  server_name dashboard.yourdomain.com;
4 
5  location / {
6    include proxy_params;
7    proxy_pass http://127.0.0.1:4100;
8  }
9}

1sudo ln -s /etc/nginx/sites-available/api.yourdomain.com /etc/nginx/sites-enabled/
2sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/
3sudo ln -s /etc/nginx/sites-available/dashboard.yourdomain.com /etc/nginx/sites-enabled/
4sudo nginx -t && sudo systemctl reload nginx

1sudo apt -y install certbot python3-certbot-nginx
2 
3# প্রতিটি ডোমেইনের জন্য আলাদা চালান
4sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
5sudo certbot --nginx -d api.yourdomain.com
6sudo certbot --nginx -d dashboard.yourdomain.com

1server {
2  listen 80;
3  server_name yourdomain.com www.yourdomain.com;
4  return 301 https://$host$request_uri;
5}
6 
7server {
8  listen 443 ssl;
9  server_name yourdomain.com www.yourdomain.com;
10 
11  ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
12  ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
13  include /etc/letsencrypt/options-ssl-nginx.conf;
14  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
15 
16  location / {
17    include proxy_params;
18    proxy_pass http://127.0.0.1:3000;
19  }
20}

1# কনফিগ টেস্ট করুন ও Nginx রিলোড
2sudo nginx -t && sudo systemctl reload nginx

1# dry-run: সার্ট expire না হলেও রিনিউ প্রক্রিয়া সিমুলেট করে
2sudo certbot renew --dry-run
3 
4# systemd timer চালু আছে কিনা দেখুন
5sudo systemctl list-timers | grep certbot
6sudo systemctl status certbot.timer

1sudo apt -y install libnginx-mod-http-modsecurity
2sudo mkdir -p /etc/nginx/modsec
3sudo wget -qO /etc/nginx/modsec/modsecurity.conf https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended

1sudo apt -y install git
2sudo git clone https://github.com/coreruleset/coreruleset /etc/nginx/modsec/owasp-crs
3sudo cp /etc/nginx/modsec/owasp-crs/crs-setup.conf.example /etc/nginx/modsec/owasp-crs/crs-setup.conf

1Include /etc/nginx/modsec/modsecurity.conf
2Include /etc/nginx/modsec/owasp-crs/crs-setup.conf
3Include /etc/nginx/modsec/owasp-crs/rules/*.conf
4SecRuleEngine On

1modsecurity on;
2modsecurity_rules_file /etc/nginx/modsec/main.conf;

1sudo nginx -t && sudo systemctl reload nginx

1limit_req_zone $binary_remote_addr zone=perip:10m rate=10r/s;
2limit_conn_zone $binary_remote_addr zone=addr:10m;
3 
4server {
5  limit_req zone=perip burst=20 nodelay;
6  limit_conn addr 20;
7}

1sudo apt -y install certbot python3-certbot-nginx
2sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

1ssl_protocols TLSv1.2 TLSv1.3;
2ssl_prefer_server_ciphers off;
3add_header Strict-Transport-Security "max-age=63072000" always;

1curl -L --output cloudflared.deb \
2  https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb \
3  && sudo dpkg -i cloudflared.deb \
4  && sudo cloudflared service install eyJhIjoiYWJjZGVm...YOUR_TOKEN_HERE

1sudo ufw delete allow 80/tcp
2sudo ufw delete allow 443/tcp
3sudo ufw status verbose
4# এখন শুধু 22 (SSH) খোলা থাকবে

1cd /tmp
2VER=$(curl -s https://api.github.com/repos/prometheus/prometheus/releases/latest | grep tag_name | cut -d '"' -f4)
3VERFILE=$(echo "$VER" | sed 's/^v//')
4wget "https://github.com/prometheus/prometheus/releases/download/${VER}/prometheus-${VERFILE}.linux-amd64.tar.gz"
5tar xvf prometheus-*.linux-amd64.tar.gz
6sudo mv prometheus-*.linux-amd64 /opt/prometheus

1global:
2  scrape_interval: 15s
3 
4scrape_configs:
5  - job_name: node
6    static_configs:
7      - targets: ["127.0.0.1:9100"]

1# GPG কী — apt-key deprecated (Ubuntu 22.04+), keyring পদ্ধতি ব্যবহার করুন
2sudo mkdir -p /etc/apt/keyrings
3wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor | sudo tee /etc/apt/keyrings/grafana.gpg > /dev/null
4echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" | sudo tee /etc/apt/sources.list.d/grafana.list
5sudo apt update && sudo apt -y install grafana
6sudo systemctl enable --now grafana-server

1docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1

1sudo mkdir -p /var/www/staging && sudo chown deploy:deploy /var/www/staging
2cd /var/www/staging
3git clone -b staging git@github.com:org/backend.git
4cp /var/www/staging/backend/.env.example /var/www/staging/backend/.env.staging
5# edit DATABASE_URL, secrets for staging
6cd /var/www/staging/backend && npm ci && npm run build
7pm2 start ecosystem.config.js --env staging

1#!/usr/bin/env bash
2set -euo pipefail
3 
4# non-interactive SSH-এ ~/.bashrc source হয় না — nvm manually load করতে হবে
5export NVM_DIR="$HOME/.nvm"
6[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
7 
8APP_DIR="/var/www/backend"
9git -C "$APP_DIR" fetch --all --prune
10git -C "$APP_DIR" checkout main
11git -C "$APP_DIR" pull --ff-only
12cd "$APP_DIR" && npm ci && npm run build
13pm2 reload ecosystem.config.js --only api

1sudo chmod +x /opt/scripts/deploy.sh

1name: Deploy
2on:
3  push:
4    branches: [main]
5 
6jobs:
7  deploy:
8    runs-on: ubuntu-latest
9    steps:
10      - uses: actions/checkout@v4
11      - name: SSH deploy
12        uses: appleboy/ssh-action@v1.0.3
13        with:
14          host: ${{ secrets.PROD_HOST }}
15          username: deploy
16          key: ${{ secrets.SSH_PRIVATE_KEY }}
17          script: |
18            /opt/scripts/deploy.sh

1#!/usr/bin/env bash
2set -euo pipefail
3ACTIVE=$(readlink -f /var/www/active)
4if [[ "$ACTIVE" == "/var/www/blue" ]]; then
5  TARGET="/var/www/green"
6else
7  TARGET="/var/www/blue"
8fi
9git clone --depth 1 git@github.com:org/backend.git "$TARGET"
10# build, healthcheck, flip nginx upstream symlink
11ln -sfn "$TARGET" /var/www/active
12sudo nginx -s reload

1#!/usr/bin/env bash
2set -euo pipefail
3APP_DIR="/var/www/backend"
4LAST_GOOD="${1:-}"
5if [[ -z "$LAST_GOOD" ]]; then
6  echo "usage: rollback.sh <commit_sha>"
7  exit 1
8fi
9git -C "$APP_DIR" checkout "$LAST_GOOD"
10cd "$APP_DIR" && npm ci && npm run build
11pm2 reload ecosystem.config.js --only api

1#!/usr/bin/env bash
2mongodump --uri="$MONGO_URI" --archive=/backups/mongo-$(date +%F).gz --gzip

1docker exec stack-mongo-1 mongodump --archive=/tmp/dump.gz --gzip
2docker cp stack-mongo-1:/tmp/dump.gz ./mongo-$(date +%F).gz

1pg_dump -h 127.0.0.1 -U appuser app | gzip > /backups/pg-$(date +%F).sql.gz

1docker exec stack-postgres-1 pg_dump -U appuser app | gzip > pg-$(date +%F).sql.gz

10 2 * * * /opt/scripts/backup-mongo.sh
215 2 * * * /opt/scripts/backup-pg.sh
330 3 * * * /opt/scripts/offsite-sync.sh

1# AWS CLI ইনস্টল
2sudo apt -y install awscli
3 
4# credentials একবার সেটআপ করুন
5aws configure
6# AWS Access Key ID: YOUR_ACCESS_KEY
7# AWS Secret Access Key: YOUR_SECRET_KEY
8# Default region name: ap-southeast-1
9# Default output format: json

1#!/usr/bin/env bash
2set -euo pipefail
3BUCKET="your-bucket-name"
4HOST=$(hostname)
5aws s3 sync /backups "s3://$BUCKET/backups/$HOST/" --storage-class STANDARD_IA
6# S3 Lifecycle Rule দিয়ে ৩০ দিনের পুরনো ব্যাকআপ স্বয়ংক্রিয় মুছুন

1# rclone ইনস্টল
2curl https://rclone.org/install.sh | sudo bash
3 
4# interactive config (provider বেছে credentials দিন)
5rclone config

1#!/usr/bin/env bash
2set -euo pipefail
3# "remote" = rclone config-এ দেওয়া নাম
4rclone sync /backups remote:your-bucket/backups/$(hostname)/

1mongorestore --uri="$MONGO_URI" --archive=/backups/mongo-YYYY-MM-DD.gz --gzip

1docker cp ./mongo-YYYY-MM-DD.gz stack-mongo-1:/tmp/dump.gz
2docker exec stack-mongo-1 mongorestore --archive=/tmp/dump.gz --gzip

1pm2 status
2pm2 logs api --lines 200
3sudo nginx -t && sudo systemctl reload nginx

1docker compose ps
2docker compose logs -f --tail=200 api