⚠️ The 13-step checklist below is Stage 0 of the mandatory 6-stage deployment pipeline. Do not treat it as a standalone procedure. The full pipeline including security pentest (Stage 4) must be completed before any service is deployed. See the pipeline section at the bottom of this document.
Mandatory steps to complete on every new server before running /pre-flight-check or any setup script. These steps are performed manually as root, usually via the hosting provider's root password or web console.
Complete all 13 steps in order. Do not skip any step.
Run on every freshly provisioned server before touching the deploy pipeline. Applies to all server roles: TacticalRMM (server1), Business Layer (server2), MCP Dev (server4), and any future servers.
cat ~/.ssh/xzopia_server1.pubxzopiaserver4)Use the root password from the hosting provider control panel, or the provider's web console.
ssh root@<server-ip>
# or use the hosting provider's web console if key auth isn't set up yet
adduser xzopia
Enter a strong password when prompted (it won't be used after key auth is set up, but must be set). Leave all other fields blank.
usermod -aG sudo xzopia
echo 'xzopia ALL=(ALL) NOPASSWD: ALL' | tee /etc/sudoers.d/xzopia
chmod 440 /etc/sudoers.d/xzopia
Verify it works before logging out:
su - xzopia -c "sudo whoami"
# Expected: root
Replace xzopiaserverX with the actual server number/name (e.g. xzopiaserver4).
hostnamectl set-hostname xzopiaserverX
Replace xzopiaserverX with the same value used in Step 5.
echo "127.0.1.1 xzopiaserverX" >> /etc/hosts
Verify:
hostname
# Expected: xzopiaserverX
mkdir -p /home/xzopia/.ssh
This transfers whatever key the hosting provider provisioned for root (or any key you've already added) to the xzopia user.
cp /root/.ssh/authorized_keys /home/xzopia/.ssh/
If root has no authorized_keys yet, manually paste the public key contents instead:
echo "ssh-ed25519 AAAA... simon@xzopia.com" > /home/xzopia/.ssh/authorized_keys
Get your public key locally with: cat ~/.ssh/xzopia_server1.pub
chown -R xzopia:xzopia /home/xzopia/.ssh
chmod 700 /home/xzopia/.ssh
chmod 600 /home/xzopia/.ssh/authorized_keys
From your local machine (before closing the root session):
ssh -i ~/.ssh/xzopia_server1 xzopia@<server-ip>
sudo whoami
# Expected: root
Do not close the root session until this test passes.
apt update && apt upgrade -y
If a kernel update is installed, a reboot will be required. The setup scripts handle this automatically, but running it now surfaces kernel updates early.
# If reboot-required file exists, reboot now:
[ -f /var/run/reboot-required ] && echo "REBOOT REQUIRED" || echo "No reboot needed"
reboot # if required — reconnect after ~60s
This sequence caused server lockouts twice on Server 6 (June 2026) when done in the wrong order. Follow exactly. Do not improvise.
The setup scripts handle UFW and SSH port hardening. If you ever run this manually (e.g., for troubleshooting or a new server role not covered by a script), use the following sequence — or run scripts/setup/safe-ssh-ufw-setup.sh which enforces it automatically.
Step 13 — Set ALL UFW rules (do NOT enable yet):
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp # Keep port 22 until port 2222 is confirmed working
ufw allow 2222/tcp
ufw allow 80/tcp
ufw allow 443/tcp
Step 14 — Configure SSH for port 2222:
mkdir -p /run/sshd
systemctl disable --now ssh.socket 2>/dev/null || true
systemctl enable --now ssh.service
sed -i '/^Port/d' /etc/ssh/sshd_config
echo "Port 2222" >> /etc/ssh/sshd_config
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sshd -t && echo "SSH config OK" # Must print OK — abort if it does not
Step 15 — Enable UFW (now safe — both port 22 and 2222 are open):
ufw --force enable
Step 16 — Restart SSH:
systemctl restart ssh
Step 17 — MANDATORY GATE: Test port 2222 in a NEW terminal before continuing:
# Run this in a separate terminal — do NOT close your current session yet
ssh -i ~/.ssh/xzopia_server1 -p 2222 xzopia@SERVER_IP
sudo whoami
# Expected: root
Do not proceed past this step until the new terminal confirms access on port 2222.
Step 18 — Remove port 22 from UFW only after port 2222 is confirmed:
ufw delete allow 22/tcp
ufw status
Or use the script: bash scripts/setup/safe-ssh-ufw-setup.sh (run as root — enforces this order automatically).
Before proceeding to Stage 1 (/pre-flight-check), confirm all of the following:
xzopia user exists: id xzopiasu - xzopia -c "sudo whoami" → roothostname → xzopiaserverXssh -i ~/.ssh/xzopia_server1 xzopia@<ip> (from local machine)authorized_keys has correct permissions: ls -la /home/xzopia/.ssh/apt list --upgradable 2>/dev/null | grep -v WARNINGsudo ufw status (no port 22, has 2222/80/443)Once all checklist items are confirmed, run Stage 1 of the deploy pipeline:
/pre-flight-check --server <server_id> --ssh-key ~/.ssh/xzopia_server1
See .claude/skills/deploy-pipeline/SKILL.md for the full 6-stage pipeline (Stage 0 → Stage 5).
After completing the 13-step checklist above, the following 6 stages MUST be completed in order before any service or application is deployed on the server. No stage may be skipped. No exceptions.
Stage 0 — New server preparation
This checklist. Must be fully complete before Stage 1.
Stage 1 — Pre-flight check
Run: /pre-flight-check
Must return READY. If not READY, fix all issues and re-run. ABORT if READY cannot be achieved.
Stage 2 — Setup, install and security review
Install and configure required services. After every major change run: /security-review
Address all findings before continuing to the next change.
Stage 3 — Post-install audit
Run: /audit-server
Confirm all baseline services are healthy:
bpf_jit_harden=2, send_redirects=0, ASLR=2, kptr_restrict=2Stage 4 — Penetration test (mandatory before any service deployment)
Run: /security-pentest
This stage runs BEFORE any application, service, or container is deployed.
nmap -sV --open [server-ip]: confirm only expected ports reachable externally.nikto -h http://[server-ip]: baseline web surface scan.Remediate ALL High findings immediately. Re-run Lynis after each fix to confirm resolved. Document Medium findings with planned mitigations and timeline.
Take a Fasthosts snapshot after pentest passes — label: serverX-post-hardening-pre-[service]. This snapshot is the clean baseline. Do not proceed without it.
Stage 5 — Verification before completion
Run: /verification-before-completion
All of the following must pass before any service deployment begins:
Only after Stage 5 passes may service/application deployment begin.
Stage 6 — Post-service sign-off
After service/application deployment is complete, repeat Stage 4 and Stage 5 against the full deployed surface including service-specific ports, web endpoints, and any containers. Specific additions:
Take a final Fasthosts snapshot — label: serverX-post-[service]-deploy. Update PROJECT_STATUS.md with Lynis score, pentest results summary, and session log. Commit and push (wiki sync fires automatically).
Notes on ordering
/backup-server must be run before every significant change throughout all stagesPROJECT_STATUS.md