Hardened Linux & Docker Baremetal Stack
Production-tested infrastructure automation for Hetzner and baremetal nodes. Sets up kernel hardening, strict default-deny UFW firewall, Fail2ban, Docker CE, Traefik v3 with automated Let's Encrypt TLS termination, and encrypted S3 database backups.
Traefik v3
Reverse Proxy
Zero-Port
Exposed Internals
Auto-SSL
Let's Encrypt TLS
S3 / R2
Automated Backups
Included Modules & Scripts
Clean shell scripts and declarative compose specifications. Zero external dependencies.
| Module File | Target Function | Architecture Specification |
|---|---|---|
| hetzner_hardened_bootstrap.sh | Baremetal Initialization | UFW firewall (22/80/443), Fail2ban jails, Docker CE repo, unattended upgrades |
| docker-compose.traefik.yml | Ingress & Routing | Traefik v3.1 with HTTP-to-HTTPS redirect, Let's Encrypt TLS challenge, Docker socket isolation |
| backup_to_s3.sh | Disaster Recovery | Automated Postgres dump, gzip compression, S3/Cloudflare R2 sync, 3-day local purge |
1-Command Execution Pattern
Bootstraps a fresh server from root console to fully operational proxy in under 90 seconds.
// Terminal Bootstrap Command
chmod +x hetzner_hardened_bootstrap.sh && ./hetzner_hardened_bootstrap.sh && docker compose -f docker-compose.traefik.yml up -d