DEV Community: Automate It All

From a Bare Debian Box to a Public HTTPS Page, in Eight Command Blocks

Automate It All — Wed, 09 Sep 2026 02:04:35 +0000

Lesson one of twelve, written out below. The video is free on YouTube: https://www.youtube.com/watch?v=Yzty9buG4dc

You need a Debian 12 box you can SSH into as root the first time, and a domain whose A record already points at it. Everything below is what the recording shows, in the order it shows it. SITE is your domain, and ADMIN is the human account you will use from now on.

1. One Apt Call

apt-get update -qq
apt-get install -y -qq --no-install-recommends \
  ca-certificates curl debian-keyring debian-archive-keyring apt-transport-https \
  gnupg sudo openssh-server ufw unattended-upgrades

The Caddy repo needs the keyring and transport packages, so they go in here rather than in step 6.

2. A Human Account With Sudo

adduser --disabled-password --gecos "" "$ADMIN"
usermod -aG sudo "$ADMIN"
install -d -m 700 -o "$ADMIN" -g "$ADMIN" "/home/$ADMIN/.ssh"

From your laptop, ssh-copy-id $ADMIN@$SITE puts your public key in place. Do that before step 3, because step 3 is what closes the root door behind you.

3. Root Login Off, and a Parse Check

cat > /etc/ssh/sshd_config.d/10-hardening.conf <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF
/usr/sbin/sshd -t

sshd -t parses the whole config and exits non-zero on a typo. Run it before you restart sshd, because a config that fails to parse after a restart locks you out of a box whose only other door you just shut.

4. A Firewall With Three Doors

ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable
ufw show added

A container has no netfilter, so the lesson's script checks /proc/sys/net/ipv4/ip_forward for write access and prints the enable line instead of running it. On your VPS it runs.

5. Security Updates Install Themselves

cat > /etc/apt/apt.conf.d/20auto-upgrades <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF
unattended-upgrade --dry-run --debug 2>&1 | grep -m1 "Allowed origins are"

The dry run prints the origins it would pull from. Reading that line is how you learn the security pocket is in the list rather than assuming it.

6. Caddy From Its Own Repo

curl -fsSL https://dl.cloudsmith.io/public/caddy/stable/gpg.key \
  | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -fsSL https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt \
  > /etc/apt/sources.list.d/caddy-stable.list
apt-get update -qq && apt-get install -y -qq caddy

Debian's own caddy package lags the upstream release, and the automatic HTTPS behaviour below is the part that moves.

7. Three Lines of Web Server

install -d -m 755 /var/www/site
echo "<h1>$SITE is live</h1>" > /var/www/site/index.html
cat > /etc/caddy/Caddyfile <<EOF
$SITE {
    root * /var/www/site
    file_server
}
EOF
caddy fmt --overwrite /etc/caddy/Caddyfile
caddy validate --config /etc/caddy/Caddyfile

Caddy reads the site address, asks Let's Encrypt for a certificate, and renews it. There is no certbot step and no cron entry, which is the whole reason this course uses Caddy rather than nginx.

Testing on localhost adds one line, tls internal, so Caddy signs with its own CA rather than failing an ACME challenge for a name nobody can resolve.

8. Read the Page Back

caddy start --config /etc/caddy/Caddyfile
for _ in $(seq 30); do curl -sk "https://$SITE" -o /tmp/page.html && break; sleep 1; done
grep -q "$SITE is live" /tmp/page.html

The loop exists because the first request arrives while Caddy is still finishing its ACME challenge. Thirty one-second tries cover that.

At this point a stranger loads your page over HTTPS, root cannot log in over SSH, ufw allows 22, 80 and 443 only, and security updates install themselves.

Why the Script Is the Test

Every lesson in this course ships that commands.sh alongside the video, and the course's test suite runs each one head to tail in a fresh debian:12-slim container. A command that drifts from what the recording shows fails the run. Twelve of twelve were green on 2026-09-09.

The firewall step branches for the same reason. A script claiming a firewall the container never raised would pass a test and teach the wrong thing.

The Other Eleven

Lessons 2 and 3 are free too: Caddy as your web server, then systemd running your own service behind it. Lessons 4 to 12 cover Tailscale as a private network, Tailscale Funnel, Docker Compose, a reverse proxy across three subdomains, an agent as a systemd unit, a Telegram gateway, one bot token per box, restic snapshots restored into an empty directory, and auto-shutdown with monitoring.

The narration is a cloned voice of mine rather than a live read, and the YouTube uploads carry the altered-content disclosure.

Lessons 4 to 12 are 49 EUR as MP4 downloads with a 30-day refund: https://automate-it-all.win/course/

Questions: skills@automate-it-all.win. Author: https://fidel-perez.github.io/portfolio/

I Gave My Agent Ten Ops Skills, and a Docker Test for Each One

Automate It All — Sun, 06 Sep 2026 20:11:18 +0000

Ten skills, ten Docker tests, nine green and one skipped off Ubuntu. That count is the only claim in this article worth checking, and tests/run.sh in the repo prints it.

The Problem With a How-To an Agent Reads

A runbook written for a person leaves gaps a person fills from context. An agent fills the same gaps by guessing, and a guess about ufw --force enable locks you out of the box.

So each procedure here ships as a folder the agent loads whole:

skills/vps-basics/
  SKILL.md          YAML front matter, then numbered steps
  references/
    jail.local      the file step 3 copies

Front matter carries name, description, version, license and platforms. Claude Code reads that layout natively. Any AgentSkills-spec loader reads the same folders, though only Claude Code and my own runner have been tested against these.

The Test Runs the Skill's Own Steps

A skill is a document, and a document rots. The harness closes that gap by executing the document:

docker run --rm --privileged \
  -v "$skill_dir/references:/refs:ro" \
  ubuntu:22.04 bash -c '
    apt-get update -qq && apt-get install -y -qq ufw fail2ban
    ufw default deny incoming
    ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp
    ufw --force enable
    cp /refs/jail.local /etc/fail2ban/jail.local
    service fail2ban start
    ufw status | grep -q "Status: active"
    ufw status | grep -q "22/tcp"
    fail2ban-client status sshd | grep -q "Status for the jail: sshd"
  '

Those commands are the steps of skills/vps-basics/SKILL.md, copied out. Edit the SKILL.md without editing the test and the two disagree; edit the test without editing the SKILL.md and the assertions stop matching. Either way the harness goes red before a reader gets the wrong version.

tests/run.sh walks every tests/<name>.sh, skips a skill whose front matter says host-specific: true, and exits non-zero on the first failure. One skill is host-specific: wan-failover-uplink-guard needs two physical uplinks, and no container gives it those.

What the Ten Cover

Free and MIT, in the public repo:

vps-basics: ufw default-deny plus a fail2ban sshd jail on a fresh box.
backup-restore-drill: every backup step paired with a restore step, so a backup counts only after it has been read back.
service-health-check: process, port and HTTP checked in that order.
systemd-unit-authoring: a script turned into a unit that restarts on crash and starts on boot.

Paid once the checkout opens, which it has yet to do: caddy-reverse-proxy, tailscale-funnel, pi-hardening, telegram-bot-deployment, wan-failover-uplink-guard, wol-wake-and-remote-shutdown.

Why Three Layers in a Health Check

service-health-check runs process, then port, then HTTP, and stops at the first failure. Each layer catches what the layer above misses. A process check alone passes a hung process that still holds its port. A port check alone passes an app that accepts the connection and returns 500 to every request. Only the HTTP check reads what a user would read.

What This Does Not Prove

A container test proves the steps run on a clean Ubuntu 22.04. Running on your box, with your kernel and your existing firewall rules, is a separate claim, and no skill in the pack makes it.

Ten skills is also a small sample for a format claim. The layout may need changing once a third loader reads it.

Repo: https://github.com/automate-it-all/agent-skills-pack
Paid six: https://automate-it-all.win/skills/
Questions: skills@automate-it-all.win
Who builds this: https://fidel-perez.github.io/portfolio/