The summary.
SECURE ACCESS BEFORE ANYTHING ELSE
A new server is scanned within minutes of existing.
Keys not passwords, no direct administrative login, individual accounts, firewall allowing only what is needed.
INSTALL ONLY WHAT THE APPLICATION REQUIRES
Every package is exposure and maintenance.
SCRIPT THE SETUP RATHER THAN TYPING COMMANDS
The script is the record, and it can be repeated identically. Test rebuilding from nothing.
NEVER MAKE A MANUAL CHANGE TO SOMETHING DESCRIBED IN CODE
The next application of the configuration reverses it, confusingly. Change the description, then apply it.
NEVER EXPOSE DATABASES OR ADMINISTRATIVE INTERFACES
Anything reachable is found by scanning within hours. Verify from outside, not from the server.
MONITOR CERTIFICATE AND DOMAIN EXPIRY INDEPENDENTLY
Automated renewal fails silently more often than expected, and both cause complete, entirely preventable outages.
BACK UP CONFIGURATION, NOT ONLY DATA
And keep backups somewhere the server cannot reach, so a compromise cannot destroy them.
Measure how long a restore takes and how much data would be lost. Those two figures are your actual recovery position.
WATCH DISK SPACE FIRST
A full disk stops everything, and is entirely predictable.
