Harden a Linux server and prove your backups restore

#Brief

A small team runs its product catalogue (a web app with a PostgreSQL database loaded from Open Food Facts) on one Linux VM, set up by hand years ago. Nobody knows whether the backups work. Make the server safe and prove recovery before something breaks.

#What to build

1. Create a VM (a free-tier cloud instance or a local VM) and deploy the app and database as a systemd service running as its own user

2. Harden it: key-only SSH with root login disabled, a host firewall allowing only 22 and 443, automatic security updates, and file permissions checked for secrets

3. Write a Bash backup script (strict mode, ShellCheck clean) that dumps the database, encrypts the dump, uploads it off the machine and keeps 14 days

4. Schedule it with a systemd timer or cron and alert if it has not succeeded in 26 hours

5. Destroy the VM, build a new one from your notes and scripts, restore the latest backup, and time the whole process

#Deliverables

• Repository with hardening/, backup/, RESTORE.md and the restore drill log

#How it is graded

Reviewers run your hardening checks on a fresh VM and follow RESTORE.md themselves. If they cannot restore the data, the project fails.

#Stretch

Replace the manual rebuild with an Ansible playbook and repeat the drill.