This page explains what to do when things go wrong, how to perform routine maintenance, and what procedures you should follow to stay DSPT compliant. Written for non-technical people.
Keep this one-page reference handy:
🔴 SITE IS DOWN
→ ssh root@10.0.0.1
→ docker restart gp_booking_nginx
→ Check: https://gp.veripath.co.uk
🔴 CAN'T SSH IN
→ VPS password: [your Fasthosts root password]
→ Or use SSH key: ssh -i ~/.ssh/id_veripath root@10.0.0.1
→ Still stuck? Log in to Fasthosts control panel → VPS Console
🔴 BACKUP FAILED
→ Check: cat /var/log/backup-dump.log
→ Check: BORG_PASSPHRASE=backup_key_veripath_2026 borg list /var/backups/clinic_vault
→ Run manually: bash /opt/scripts/primary-backup.sh
→ Need help? See "Backup Failures" below
🔴 CROWDSEC ALARM
→ See what happened: fail2ban-client status
→ Check details: fail2ban-client status sshd
You need TWO things:
Step 1: Connect WireGuard
Open your WireGuard client and connect to the veripath-vpn config.
Step 2: SSH with your key
ssh -i ~/.ssh/id_veripath root@10.0.0.1
If you don't have the SSH key file, it was saved as /tmp/id_ed25519 during setup. Save it to ~/.ssh/id_veripath on your computer.
The backup VPS still uses a password:
ssh root@77.68.112.126
# Password: wUUO1RXhkCoFfdyn
ssh root@10.0.0.1
docker restart <container-name>
Common container names: gp_booking_nginx, wikijs, keycloak, forgejo, fail2ban
ssh root@10.0.0.1
docker logs <container-name> --tail 50
Check if the server is running:
ping 88.208.212.211
If no response, log into Fasthosts control panel and restart the VPS.
Check if Docker containers are running:
ssh root@10.0.0.1 "docker ps"
If gp_booking_nginx is missing, restart it:
ssh root@10.0.0.1 "docker start gp_booking_nginx"
Check Nginx error logs:
ssh root@10.0.0.1 "docker logs gp_booking_nginx --tail 50"
ssh root@10.0.0.1 "fail2ban-client status"
ssh root@10.0.0.1 "last -10"
ssh root@77.68.112.126
BORG_PASSPHRASE=backup_key_veripath_2026 borg list /var/backups/clinic_vault
Check the dump log on the primary VPS:
ssh root@10.0.0.1 "cat /var/log/backup-dump.log | tail -10"
Check the pull log on the backup VPS:
ssh root@77.68.112.126 "cat /var/log/backup-pull.log | tail -10"
Try running the backup manually:
# On primary VPS
ssh root@10.0.0.1 "bash /opt/scripts/primary-backup.sh"
# On backup VPS
ssh root@77.68.112.126 "bash /opt/scripts/backup-pull.sh"
Check if the backup VPS can reach the primary:
ssh root@77.68.112.126 "ssh -o StrictHostKeyChecking=no -i /root/.ssh/id_ed25519 root@88.208.212.211 'echo working'"
If this fails, the SSH key between the VPSs may have been changed.
Check disk space on both servers:
ssh root@10.0.0.1 "df -h /"
ssh root@77.68.112.126 "df -h /"
ssh root@10.0.0.1
systemctl status fail2ban
systemctl restart fail2ban
systemctl status fail2ban-firewall-bouncer
systemctl restart fail2ban-firewall-bouncer
ssh root@10.0.0.1
ufw --force enable
ufw status verbose
In the event you need to recover data:
SSH into the backup VPS:
ssh root@77.68.112.126
List available backups:
BORG_PASSPHRASE=backup_key_veripath_2026 borg list /var/backups/clinic_vault
Extract the most recent backup to a temporary location:
mkdir -p /tmp/restore
BORG_PASSPHRASE=backup_key_veripath_2026 borg extract /var/backups/clinic_vault::backup-20260523-030001 --destination /tmp/restore
Find the SQL dump files:
ls /tmp/restore/*.sql
Copy the relevant dump file to the primary VPS:
scp /tmp/restore/gp_booking_pg_*.sql root@88.208.212.211:/tmp/
Restore the database on the primary VPS:
ssh root@10.0.0.1 "cat /tmp/gp_booking_pg_*.sql | docker exec -i 3ff9c011e629_gp_booking_postgres psql -U postgres"
The DSPT is submitted annually. Before each submission, run through this checklist:
systemctl status fail2ban)ufw status)systemctl status unattended-upgrades)docker ps | grep watchtower)grep PasswordAuthentication /etc/ssh/sshd_config)To give someone else access:
Generate an SSH key for them:
ssh-keygen -t ed25519 -f ~/new_admin_key
Add their public key to the server:
ssh root@10.0.0.1 "echo 'ssh-ed25519 AAA... their-key-here' >> ~/.ssh/authorized_keys"
Give them a WireGuard client config:
Copy the existing client config, change the IP to 10.0.0.4, and generate new keys for them.
Tell them the procedure:
ssh -i ~/new_admin_key root@10.0.0.1SSH into the server:
ssh root@10.0.0.1
Edit the Nginx config:
nano /var/www/html/gp_booking_app/nginx/nginx.conf
Add a new server block (copy an existing one and change the server_name and backend URL)
Get an SSL certificate:
certbot certonly --webroot -w /var/www/letsencrypt -d new.veripath.co.uk
Reload Nginx:
docker exec gp_booking_nginx nginx -s reload
| Item | Value |
|---|---|
| Primary VPS IP | 88.208.212.211 |
| Backup VPS IP | 77.68.112.126 |
| WireGuard network | 10.0.0.0/24 |
| WireGuard port | UDP 51820 |
| Borg passphrase | backup_key_veripath_2026 |
| DB password (gp_booking) | sticky84 |
| Backup VPS root password | wUUO1RXhkCoFfdyn |
| Fasthosts dashboard | https://www.fasthosts.co.uk |
| Problem | Who |
|---|---|
| Server won't boot | Fasthosts support |
| Security question | Your director (BSI auditor) |
| Need a change to this setup | Ask the AI assistant to update it |