djangoeurope Compared with a Virtual Server

Your own virtual server

Install and configure the web servers, database servers, mail server and firewall yourself, tune them, and keep them secure and up to date from then on.

sudo apt-get update && sudo apt-get upgrade
sudo apt-get install nginx apache2 postgresql mariadb-server
sudo apt-get install postfix dovecot-imapd bind9 nftables
sudo vim /etc/nginx/nginx.conf
sudo vim /etc/postgresql/*/main/postgresql.conf
sudo vim /etc/mysql/my.cnf
sudo vim /etc/postfix/main.cf
sudo vim /etc/nftables.conf
sudo systemctl enable --now nginx postgresql mariadb postfix
...

9+ lines to type

Your own virtual server

Create the user and answer the prompts for the password and personal details. Then set a disk quota and resource limits, set up SSH access with keys, and make sure only the user can access their home directory.

sudo adduser test2
sudo chmod 700 /home/test2
sudo setquota -u test2 20G 20G 0 0 /home
sudo vim /etc/security/limits.conf
sudo vim /etc/systemd/system/user-1001.slice.d/limits.conf
sudo systemctl daemon-reload
sudo mkdir -m 700 /home/test2/.ssh
sudo vim /home/test2/.ssh/authorized_keys
sudo chown -R test2: /home/test2/.ssh
sudo vim /etc/ssh/sshd_config
sudo systemctl reload ssh
...

11+ lines to type

Your own virtual server

Create a user, set a password, create the database and grant the permissions, for every database you need. Then take care of backups: dump the database regularly, copy the dumps to another location, clean up old ones, and test that you can restore them.

CREATE USER "test2" WITH CONNECTION LIMIT 10;
ALTER USER "test2" WITH PASSWORD '...';
CREATE DATABASE "test2" WITH OWNER="test2";
GRANT ALL ON DATABASE "test2" TO "test2";
sudo crontab -e
0 3 * * * pg_dump -U postgres test2 | gzip > /var/backups/test2-$(date +\%F).sql.gz
0 4 * * * rsync -a /var/backups/ backup@offsite.example.com:backups/
0 5 * * * find /var/backups -name 'test2-*' -mtime +7 -delete

8 lines to type

Your own virtual server

Write an nginx server block with the redirect to HTTPS, the proxy to your application and the paths to your certificates.

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate     /etc/ssl/example.com.pem;
    ssl_certificate_key /etc/ssl/example.com.key;
    location / {
        proxy_pass http://127.0.0.1:8080/;
    }
    ...
}

14+ lines to type

Your own virtual server

Install certbot, request a certificate and hook it into the web server. Then make sure the automatic renewal really runs, and that nginx and the mail servers reload the renewed certificate, or your site breaks when the old one expires.

sudo apt-get install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com
systemctl list-timers certbot.timer
sudo vim /etc/letsencrypt/renewal-hooks/deploy/reload.sh
#!/bin/sh
systemctl reload nginx postfix dovecot
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload.sh
sudo certbot renew --dry-run

8 lines to type

Your own virtual server

Install and configure Postfix, Dovecot, SpamAssassin, ClamAV and a webmail client. Set up DKIM signing and publish SPF, DKIM and DMARC records, or big providers like Gmail and Microsoft reject your mail. And keep your server off the spam blacklists.

sudo apt-get install postfix dovecot-imapd spamassassin clamav roundcube opendkim
sudo opendkim-genkey -s mail -d example.com -D /etc/opendkim/keys/
sudo vim /etc/opendkim.conf
sudo vim /etc/postfix/main.cf
sudo vim /etc/dovecot/dovecot.conf
sudo vim /etc/spamassassin/local.cf
# DNS: example.com TXT "v=spf1 mx -all"
# DNS: mail._domainkey.example.com TXT "v=DKIM1; k=rsa; p=..."
# DNS: _dmarc.example.com TXT "v=DMARC1; p=quarantine"
...

9+ lines to type