© Made by Adam Bellanger
← ProjectsPersonal

Self-managed production server built from scratch: reverse proxy, monitoring, automation and a dozen services running in Docker.

Stack

Data
  • PostgreSQL
Infra
  • Ubuntu 24.04
  • Docker
  • Nginx Proxy Manager
  • Prometheus
  • Grafana
  • Uptime Kuma
  • n8n
  • WireGuard
  • Fail2Ban

Context

A Hetzner CPX32 VPS (4 AMD vCPUs, 8 GB RAM, 160 GB SSD, Ubuntu 24.04) hosting all my projects under adambellanger.pro: dashboards, automations, APIs and web apps, each on its own HTTPS subdomain.

Role

Solo system and network administration: installation, hardening, DNS and certificates, service deployment, monitoring and maintenance. The whole setup is documented in a dedicated repository.

Architecture

  1. Internet

    Wildcard DNS *.adambellanger.pro

  2. Nginx Proxy Manager

    :80 / :443, Let's Encrypt SSL

  3. Applications

    Portfolio, OpenWhisper, PolyTrack…

    Monitoring

    Grafana, Uptime Kuma, Portainer

    Automation

    n8n, Ntfy

  4. PostgreSQL

    Application data

    Prometheus

    Metrics for Grafana

    Watchtower

    Container updates

Ubuntu 24.04 on a Hetzner CPX32. Admin access via SSH keys and WireGuard, protected by Fail2Ban.

Challenges

Running a dozen services behind a single entry point (Nginx Proxy Manager, wildcard DNS, SSL per subdomain) while exposing only what is strictly necessary. Several real incidents, all documented: an out-of-memory crash on first boot that forced a full rebuild from the Hetzner console (fixed by adding swap); a VNC console with a QWERTZ keyboard layout that made some commands impossible to type; a VPN rerouting all traffic and killing the SSH session (port 22 whitelisting, OpenVPN --route-nopull, proxychains and Cloudflare Warp all tested); a port 80/443 conflict between the system Nginx and Nginx Proxy Manager.

Outcome

A stable platform underpinning all my projects: Prometheus/Grafana monitoring, uptime tracked by Uptime Kuma, Ntfy notifications, automatic container updates with Watchtower, and Node services managed by PM2.

Highlights

  • Grafana, Prometheus, Uptime Kuma, n8n, Portainer, IT-Tools, Ntfy, PostgreSQL
  • Reverse proxy + per-subdomain SSL with Nginx Proxy Manager
  • Hardened access: SSH keys, WireGuard, Fail2Ban
  • Scripted, documented setup that can be reproduced
Next projectFloatSniper →