This page explains the security setup on your Fasthosts VPS (88.208.212.211) that satisfies the NHS Data Security and Protection Toolkit (DSPT) Category 3 requirements for firewalls, patching, and backups.
Think of your VPS as a flat with multiple rooms. Previously, the front door was unlocked and every room had its own door to the street. Now we've locked the front door, installed a security camera, set up regular maintenance, and made sure your valuables are copied to a safe in a separate building.
What it is: A private, encrypted tunnel that only you and authorised people can use to access the server for admin tasks.
Why DSPT cares: Standard 1 (Access Control) and Standard 4 (Privileged Access) require that admin access is strictly controlled. Without WireGuard, your SSH port is exposed to the entire internet where anyone can try to break in. With WireGuard, SSH is only reachable if you're connected to the private tunnel first.
In plain English: Instead of leaving your office keys under the mat where anyone can find them, you now need to go through a private security door first, and only people with the right keycard can get through.
Evidence for DSPT: Screenshot of wg show running on the server, plus the VPN subnet (10.0.0.0/24) shown in the firewall rules.
What it is: Instead of typing a password to log in, you now use a cryptographic key file (like a digital fingerprint).
Why DSPT cares: Standard 4 requires Multi-Factor Authentication (MFA) for privileged access. While this isn't full MFA (we can add Authentik later), key-based authentication is significantly stronger than passwords because keys can't be guessed or brute-forced.
In plain English: Passwords can be stolen, guessed, or leaked. Your SSH key is like a unique, uncopiable ID card. Even if someone gets your password, they still can't log in without the key file.
Evidence for DSPT: Screenshot of /etc/ssh/sshd_config showing PasswordAuthentication no and PubkeyAuthentication yes.
What it is: An open-source intrusion prevention system (GPL-licensed) that watches your server logs 24/7. When it spots suspicious behaviour (someone trying to break in via SSH, scanning your website for vulnerabilities), it automatically blocks their IP address using the UFW firewall.
What it monitors:
/wp-admin, /admin, .env files). Repeated 404s from the same IP trigger a block.Why DSPT cares: Standard 9 (IT Protection) requires "boundary protection" — stopping attacks before they reach your application. Fail2ban is the industry-standard open-source tool for this.
In plain English: Imagine a security guard who watches the CCTV feed. When they see someone suspicious trying door handles or looking for unlocked windows, they radio the gate to lock them out before they even reach your front door.
Why Fail2ban and not CrowdSec: Fail2ban is 100% open-source (GPL license) with no proprietary components, no "free tier" limits, and no upsell dashboards. It's been the standard Linux intrusion prevention tool for over 15 years.
Evidence for DSPT:
fail2ban-client status showing active jailsfail2ban-client status sshd showing banned IPsWhat it is: Your Nginx web server (the gp_booking_nginx Docker container) is configured to write logs to the host filesystem. Fail2ban monitors these logs for suspicious web requests.
Why DSPT cares: Standard 9 requires protection against web application attacks.
In plain English: Before any mail reaches your flat, our security guard checks if it's a genuine letter or a bomb. Suspicious packages get stopped at the gate.
What it is: Two automated systems that keep your software up-to-date with security patches:
Why DSPT cares: Standard 9 requires proof that "high risk security patches are applied within 14 days." Manual patching is unreliable — automated patching guarantees compliance.
In plain English: Imagine your flat has a smart system that automatically fixes any broken locks or windows as soon as the manufacturer releases a fix. You don't need to remember to do it yourself.
Evidence for DSPT:
/etc/apt/apt.conf.d/20auto-upgrades showing Unattended-Upgrade "1"docker ps showing Watchtower runningWhat it is: Every night, your main VPS takes a snapshot of all databases (gp_booking, DefectDojo, Forgejo, host PostgreSQL). A second VPS (your backup server at 77.68.112.126) then pulls these snapshots across the internet, encrypts them, and stores them in a BorgBackup archive.
Why it's "pull" architecture: The backup VPS reaches out to grab the data — the main VPS cannot push or delete backups. This means even if a hacker takes full control of your main server, they cannot touch your backups.
Why DSPT cares: Standard 7 (Continuity Planning) requires "off-site, encrypted backups" that are "isolated from the live environment." Standard 9 requires data to be "encrypted at rest."
In plain English: Every night, your important files are automatically photocopied and the copy is locked in a fireproof safe in a completely different building. The original office (your main VPS) doesn't have a key to that safe — only the backup office does. So even if burglars trash your main office, the copies are safe.
Evidence for DSPT:
borg list /var/backups/clinic_vault showing archives with dates/var/log/backup-dump.log showing successful database dumpsWhat it is: A Docker container (Apache 2.0 licensed) that automatically checks for updates to all your running containers and restarts them with the new version.
Why DSPT cares: Same as unattended-upgrades — ensures containerised software is patched within the 14-day window.
INTERNET
│
┌────┴────┐
│ :443 │
│ HTTPS │
└────┬────┘
│
╔══════════╧══════════╗
║ Fail2ban watches ║
║ Nginx + SSH logs ║
║ and bans attackers ║
╚══════════╤══════════╝
│
┌──────────┴──────────┐
│ gp_booking_nginx │
│ (Nginx reverse │
│ proxy) │
└──────────┬──────────┘
│
┌───────────────┼───────────────┐
│ │ │
┌────┴────┐ ┌────┴────┐ ┌────┴────┐
│ Django │ │ Wiki.js │ │ Forgejo │
│ App │ │ │ │ (Git) │
└─────────┘ └─────────┘ └─────────┘
ADMIN ACCESS (WireGuard VPN required):
┌──────────┐ ┌──────────┐
│ Your │────▶│ VPS │
│ Computer │ │ 10.0.0.1 │
│ 10.0.0.2 │ │ SSH:22 │
└──────────┘ └──────────┘
BACKUPS (Nightly):
┌────────────┐ ┌──────────────┐
│ Primary │ rsync │ Backup VPS │
│ VPS │◄─────────│ 77.68.112.126│
│ (dump DBs) │ (pull) │ Borg archive │
└────────────┘ └──────────────┘
| Standard | Requirement | What We Did |
|---|---|---|
| Standard 1 | Access Control | WireGuard VPN + SSH key-only; UFW blocks all except port 443 |
| Standard 3 | Staff Training | (documentation you create separately) |
| Standard 4 | Privileged Access | MFA-ready (Authentik can be added); admin ports locked to VPN |
| Standard 6 | Incident Response | Fail2ban auto-blocks attackers; logging enabled |
| Standard 7 | Continuity Planning | BorgBackup to isolated second VPS; encrypted, off-site |
| Standard 9 | IT Protection | UFW firewall + Fail2ban IPS + Nginx security monitoring + auto-patching |
| Standard 10 | Accountable Suppliers | (you'll need Fasthosts' ISO 27001 cert + DPA) |