This page explains how to check that everything is working properly. You don't need to be a security expert — just follow these checks like you would a weekly checklist.
There are two types of checks:
Open these URLs in your browser:
They should all load without errors. If any are down, check the "What To Do When Things Go Wrong" section on the Operations page.
SSH into the backup VPS (77.68.112.126) and run:
BORG_PASSPHRASE=backup_key_veripath_2026 borg list /var/backups/clinic_vault
You should see an archive from today or yesterday. Example output:
backup-20260523-030001 Sat, 2026-05-23 03:00:01 [...]
If there's no recent archive, check:
ping 88.208.212.211)SSH into the primary VPS and run:
fail2ban-client status sshd
Look for "Banned IP list" — if you see IP addresses listed, someone has been trying to brute-force your server and Fail2ban stopped them.
For all jails:
fail2ban-client status
ssh root@10.0.0.1 "free -h && df -h / && echo '---' && docker stats --no-stream"
This shows:
ssh root@10.0.0.1 "fail2ban-client status && for j in sshd nginx-botsearch nginx-http-auth nginx-bad-request; do echo \"=== \$j ===\"; fail2ban-client status \$j 2>&1 | grep -E 'Total banned|File list'; done"
Expected: all 4 jails should be listed, each showing a log file it's monitoring and the number of banned IPs.
ssh root@10.0.0.1 "ufw status verbose"
Expected: only ports 80, 443, and 51820 should be allowed from outside.
ssh root@10.0.0.1 "tail -20 /var/log/backup-dump.log"
You should see entries like:
[20260523-010000] Starting dump...
host PostgreSQL dumped (288544 bytes)
defectdojo_pg dumped (6045145 bytes)
gp_booking_pg dumped (657723199 bytes)
forgejo_pg dumped (370742 bytes)
[20260523-010000] Complete
ssh root@10.0.0.1 "docker logs watchtower --tail 20 2>&1 | grep -i 'updated\|restarting'"
SSH into the backup VPS:
df -h /
Should have at least 10GB free. If it's getting full, Borg's prune feature will automatically delete old backups (it keeps 30 daily, 12 weekly, 6 monthly).
This is the most important test. Once a month, actually try restoring from a backup to make sure it works:
# On the backup VPS
BORG_PASSPHRASE=backup_key_veripath_2026 borg extract /var/backups/clinic_vault::backup-20260523-030001 --dry-run
If this succeeds, your backups are healthy. You can also extract to a temporary directory to see the actual files.
There is no web dashboard for this setup — every component is 100% open-source with no proprietary services. Here's a one-liner that shows everything:
ssh root@10.0.0.1 "
echo '=== DSPT STATUS ==='
date
echo '--- Server Uptime ---'
uptime -p
echo '--- Disk Space ---'
df -h / | tail -1
echo '--- Memory ---'
free -h | grep Mem
echo '--- Docker Containers ---'
docker ps --format '{{.Names}} {{.Status}}'
echo '--- Fail2ban ---'
fail2ban-client status 2>&1
echo '--- UFW ---'
ufw status | head -1
echo '--- Backups ---'
cat /var/log/backup-dump.log | grep Complete | tail -1
"
You can save this as a script on your computer and run it whenever you want a status check.
Fail2ban logs everything to /var/log/fail2ban.log. You can check it for details:
ssh root@10.0.0.1 "tail -20 /var/log/fail2ban.log"
Your existing DefectDojo installation at https://security.veripath.co.uk can track vulnerability scan results. It's currently unhealthy — you may want to investigate that after the DSPT submission. It's not needed for the core firewall/patching requirements.
| Role | Tasks |
|---|---|
| You (admin) | Daily: check apps are working. Weekly: run the checks above. Monthly: verify backup restoration. |
| The Server | Does everything automatically — patching, backing up, monitoring for attacks, updating containers. |
| Nobody else | No one else needs to do anything unless there's an alert or something breaks. |
| Situation | What It Means | What To Do |
|---|---|---|
| Website is down | Server may be crashed or hacked | Check server status, restart Nginx container |
| No backup archive for 2+ days | Backup pipeline has failed | Check backup logs, check SSH connectivity between VPSs |
| Disk space below 10% | Server is running out of space | Clean up old files, or increase VPS storage |
| Fail2ban not running | Attack monitoring is off | systemctl restart fail2ban |
| UFW shows "inactive" | Firewall is off | ufw --force enable |
| Unknown IP in SSH logs | Someone may be trying to access the server | Check Fail2ban bans with fail2ban-client status sshd |
What it is: A live, real-time dashboard (http://10.0.0.1:19999) that shows everything about your server on one scrolling page with colour-coded charts. Green = healthy, red = problem.
Access it: Connect to WireGuard first, then open http://10.0.0.1:19999 in your browser.
What you'll see:
No login required — but it's only accessible from the WireGuard VPN, so no one else can see it.
It does NOT show: