Setting up a small Debian box
Roughly once every two years I rent a small machine, spend an evening putting it into a state I'm happy with, and then forget exactly what I did. These are the parts I always have to look up again.
Before anything else
Change the SSH port if you like, but understand that it buys you less than people claim — what actually matters is turning off password authentication entirely and making sure you've tested your key before you close the old session.
# in a second terminal, while the first one is still open
ssh -p 22 you@host true && echo "key works"The number of evenings I've lost to locking myself out is not small.
Updates and unattended upgrades
I enable unattended security upgrades and leave the rest manual. Full unattended upgrades on a machine you care about tends to surprise you at the wrong moment.
Time and locale
Set the timezone deliberately. A surprising number of confusing logs come down to a server quietly sitting in UTC while I read it in local time.
timedatectl set-timezone Asia/Hong_Kong
timedatectl statusKernel and network parameters
Modern Debian kernels are fine out of the box. I do set a couple of things that help on links with any amount of packet loss, but I've stopped copying in long tuning blocks from blog posts — most of what circulates is either redundant now or actively harmful on a small machine.
Backups
The thing I'd actually regret losing is configuration, not data. So I keep the handful of directories that hold state in a git repo, and push it somewhere else. Tarballs are fine too; the point is that it leaves the machine.
What I no longer bother with
- Swap tuning for tiny VPSes — just add a small swapfile and move on
- Custom firewall scripts when the provider's panel already does it
- Compiling things from source to get a marginally newer version