-
Completing DevSecOps on THM
Introduction Part 2 of my Security Engineer write-up closed with a promise: the DevSecOps path was next on the list. Consider it ticked. Seventeen rooms across five modules, all spent on the place where my two worlds meet: shipping software without shipping vulnerabilities alongside it. I am a platform engineer: these days my job is…
-
Auditing my VPS for signs of compromise
Introduction I retired an old WordPress site last week. It had been running on my Virtual Private Server (VPS) for a while, and I was never fully confident it had been locked down properly (it was a temporary site to test some stuff for someone). So before I forgot about it entirely, I wanted an…
-
Separation of concerns of VPS and Docker apps
Introduction I’ve been working on a clean, reusable setup for running my own apps on a Virtual Private Server (VPS), specifically on Hetzner Cloud. The result is three open source repositories that take you all the way from bare metal to running Nginx, WordPress, and Nextcloud behind a proper reverse proxy, with automatic SSL certificates…
-
Automated secured Hetzner VPS
Introduction A few weeks ago we setup a cool VPS with WordPress, Traefik, etc. in an automated way. The only downside was that is could not be managed with the same code (only setup once), as explained in the post. Today we’re setting up a complete, automated WordPress hosting solution using OpenTofu, cloud-init and Ansible;…
-
Oneshot secured Hetzner VPS
Introduction A complete, automated WordPress hosting solution using OpenTofu, Docker, and Traefik. Deploy a secure, fast WordPress site to Hetzner Cloud in minutes with TLS, caching, and security hardening out of the box. Find the code here. Update: I’ve split the code into 3 repos, making it more scalable for future deployments. Deploy them in…