ssh root@10.0.0.1 "
echo '=== DSPT STATUS ==='
date
echo '--- Uptime ---'
uptime -p
echo '--- Disk ---'
df -h / | tail -1
echo '--- Memory ---'
free -h | grep Mem
echo '--- Docker ---'
docker ps --format '{{.Names}} {{.Status}}' | grep -E 'watchtower|nginx|wiki|keycloak|forgejo'
echo '--- Fail2ban ---'
fail2ban-client status 2>&1
echo '--- Firewall ---'
ufw status | head -1
echo '--- Backups ---'
tail -1 /var/log/backup-dump.log
"
| Task | Command |
|---|---|
| SSH in | ssh -i ~/.ssh/id_veripath root@10.0.0.1 |
| Connect WireGuard | Import wg0-client.conf into WireGuard client |
| Restart Nginx | docker restart gp_booking_nginx |
| See blocked IPs (SSH) | fail2ban-client status sshd |
| See blocked IPs (Nginx) | fail2ban-client status nginx-botsearch |
| Check all Fail2ban jails | fail2ban-client status |
| View Fail2ban log | tail -20 /var/log/fail2ban.log |
| Check backups | tail -5 /var/log/backup-dump.log |
| Check firewall | ufw status verbose |
| SSH to backup VPS | ssh root@77.68.112.126 (password: wUUO1RXhkCoFfdyn) |
| List Borg archives | BORG_PASSPHRASE=backup_key_veripath_2026 borg list /var/backups/clinic_vault |
| View Docker containers | docker ps |
| Port | Protocol | Purpose | Public? |
|---|---|---|---|
| 22 | TCP | SSH (admin) | ❌ (WireGuard only) |
| 80 | TCP | HTTP redirect to HTTPS | ✅ |
| 443 | TCP | HTTPS (all web apps) | ✅ |
| 51820 | UDP | WireGuard VPN | ✅ |
All other ports (2222, 3000, 5433, 8000-8005, 8080, 8443) are blocked from the internet.
You ──► WireGuard ──► SSH ──► Server
Internet ──► :443 ──► Nginx ──► Apps (Django, Wiki.js, etc.)
Fail2ban watches Nginx + SSH logs ──► blocks bad IPs via UFW
Nightly backup ──► Borg ──► Backup VPS (encrypted)
Auto patching ──► unattended-upgrades + Watchtower
What did we do? We locked down your server like a secure office building:
What does this mean for you? Your server is now DSPT-compliant for firewalls, patching, and backups. You don't need to do anything special day-to-day — just check the monitoring guide once a week to make sure everything is running.
| Component | License |
|---|---|
| WireGuard | GPL v2 |
| OpenSSH | BSD |
| UFW / iptables | GPL v2 |
| Fail2ban | GPL v2 |
| unattended-upgrades | GPL v2 |
| Watchtower | Apache 2.0 |
| BorgBackup | BSD 3-Clause |
| Docker | Apache 2.0 |
| Nginx | BSD 2-Clause |
100% open-source. No proprietary software, no "free tiers", no upsells.
| Task | Command/URL |
|---|---|
| Open dashboard | http://10.0.0.1:19999 (requires WireGuard) |
| Check netdata is running | docker ps --filter name=netdata |