SERVOR
Server operationsMonitoringAI copilotRecipesPricingBlogDocsAgent source
Open consoleSign in

Recipe directory

150+ verified server playbooks

Not frozen scripts. Each recipe reads your server first, adapts to what is already there, and proves every step before moving on. Every command is signed by your browser, approved by you, and replayable from the history.

186 recipes17 categoriesRecon → Act → Verify

Every recipe, in order

01Recon

Read-only probes establish what is actually installed, running and listening before anything changes.

02Act

Each command is adapted to the distribution found, classified by risk, signed by your browser and relayed verbatim to the agent.

03Verify

A step only counts as done when its own check passes. The run stops on the first failure, nothing is left half-applied.

Filter by system
Filter by category

186 recipes shown

WEB

Web server

13
  1. nginxnginx web server, started, enabled at boot and verified.caution
  2. CaddyCaddy with automatic HTTPS for a domain.caution
  3. Apache httpdApache web server, started, enabled and verified.caution
  4. HAProxyHAProxy load balancer, started and verified.caution
  5. TraefikTraefik reverse proxy via Docker, with the dashboard and automatic TLS.caution
  6. Nginx Proxy ManagerWeb-UI reverse proxy Nginx Proxy Manager via Docker.caution
  7. Let's Encrypt certificateCertbot + TLS certificate and automatic renewal.caution
  8. PHP-FPMPHP-FPM (choice of version) for nginx/apache.caution
  9. Varnish CacheVarnish HTTP cache in front of a web backend.caution
  10. nginx reverse proxyConfigures nginx as a reverse proxy to a local service (websocket OK).caution
  11. IIS (web server)Internet Information Services role enabled, started and checked over HTTP.caution
  12. ASP.NET Core Hosting (IIS)The .NET Hosting Bundle to host ASP.NET Core apps behind IIS.caution
  13. nginx (macOS)nginx via Homebrew, started at boot (port 8080 by default).caution
DB

Database

19
  1. PostgreSQLPostgreSQL (major version of your choice) from the official PGDG repository, initialized and verified.caution
  2. MySQLMySQL Server, secured, bound to localhost, started and verified.caution
  3. MariaDBMariaDB, secured, bound to localhost, started and verified.caution
  4. MongoDBMongoDB Community 9.0, local, with authentication enabled and verified.caution
  5. RabbitMQRabbitMQ broker (official repository) with management, local and a dedicated admin account.caution
  6. MemcachedMemcached in-memory cache, bound to localhost.safe
  7. ClickHouseClickHouse analytical database (official repository), password-protected and local.caution
  8. SQLiteSQLite command-line client, installed and verified.safe
  9. InfluxDBInfluxDB 2 time-series database, local on :8086, initial setup done.caution
  10. TimescaleDBTimescaleDB extension on an existing PostgreSQL, enabled in the database of your choice.caution
  11. Neo4jNeo4j Community graph database, local, with a generated initial password.caution
  12. Postgres Backup (cron)Scheduled PostgreSQL dump (systemd timer), compressed, verified, with 14-day retention.safe
  13. Postgres HardeningHardens PostgreSQL: scram-sha-256, pg_hba without trust, SSL. Destructive: alters access.destructive
  14. CockroachDBCockroachDB local single-node (dev/small load), running as a systemd service.caution
  15. pgBackRestPostgreSQL backups with pgBackRest: WAL archiving, weekly full, daily differential.caution
  16. PostgreSQL (Windows)PostgreSQL (EDB installer) as a service, with a generated superuser password.caution
  17. SQL ServerMicrosoft SQL Server 2025 (Developer or Express), Windows authentication, local.caution
  18. PostgreSQL (macOS)PostgreSQL via Homebrew, started at boot, listening locally.caution
  19. Redis (macOS)Redis via Homebrew, started at boot, listening locally.caution
CACHE

Cache & queues

04
  1. RedisRedis, with an optional password, started and verified.caution
  2. NATSNATS messaging server (JetStream optional).caution
  3. Mosquitto (MQTT)Mosquitto MQTT broker for IoT.caution
  4. Apache KafkaKafka in KRaft mode (no ZooKeeper) via Docker.caution
OBS

Observability

11
  1. node_exporterPrometheus system metrics exporter, as a systemd service.caution
  2. NetdataNetdata real-time monitoring (stable channel), local dashboard on :19999.caution
  3. PrometheusPrometheus (metrics collection), as a local systemd service on :9090.caution
  4. GrafanaGrafana OSS (official repo), local on :3000, admin with a random password.caution
  5. Grafana LokiLoki 3.7 log aggregation via Docker, local on :3100.caution
  6. Grafana + Prometheus stackGrafana + Prometheus + node_exporter via Docker Compose, datasource preconfigured, all local.caution
  7. cAdvisorcAdvisor container metrics via Docker, local only.caution
  8. GlancesGlances real-time system monitoring, local web UI on :61208.caution
  9. AlertmanagerPrometheus Alertmanager alert routing via Docker, local on :9093.caution
  10. VectorVector observability pipeline (logs/metrics), official repo, service running.caution
  11. Grafana AlloyGrafana Alloy agent shipping the systemd journal to Loki (successor to Promtail, EOL).caution
SEC

Security

13
  1. Harden SSHTurns off password login and root password login, keeps keys. Destructive: verify your key access first.destructive
  2. fail2banfail2ban with the SSH jail on the right port, active and verified.caution
  3. UFW firewallUFW: denies incoming by default, allows the real SSH port + chosen ports, with a safety net. Destructive: keeps SSH open.destructive
  4. Automatic security updatesEnables automatic security updates: unattended-upgrades (Debian/Ubuntu) or dnf-automatic (RHEL/Fedora).caution
  5. CrowdSecCrowdSec collaborative IPS, SSH collections and firewall bouncer.caution
  6. ClamAVClamAV antivirus with signatures kept up to date, optional daemon.caution
  7. Lynis auditInstalls Lynis, runs a hardening audit and summarizes the score, warnings and suggestions.safe
  8. nftables firewallBaseline nftables firewall in a dedicated table, SSH guaranteed, with a safety net. Destructive: applies network rules.destructive
  9. auditdauditd kernel audit log, enabled with baseline rules (accounts, sudo, SSH).caution
  10. SSH 2FA (TOTP)SSH key + TOTP code (Google Authenticator PAM). Destructive: touches SSH auth.destructive
  11. Secret scanSearches a folder for plaintext secrets with gitleaks (read-only, redacted report).safe
  12. SSH key rotationAdds a new authorized key, has it tested, then removes the old ones if asked. Destructive: SSH access.destructive
  13. Firewall rule (Windows)Opens an inbound port in the Windows firewall. Destructive: network.destructive
DEV

Dev tools

23
  1. Node.jsNode.js (LTS version of your choice) installed system-wide from the NodeSource repo.caution
  2. GoThe Go language (version of your choice) from go.dev, in /usr/local/go and on the PATH.caution
  3. BunThe Bun JS runtime, installed system-wide in /usr/local/bin.caution
  4. PythonPython (version of your choice) via pyenv, for the user, without touching the system Python.caution
  5. RustThe stable Rust toolchain via rustup, for the user.caution
  6. DenoThe Deno runtime, installed system-wide in /usr/local/bin.caution
  7. Java (Temurin)Temurin JDK (Adoptium OpenJDK), LTS version of your choice, from the official repo.caution
  8. GitGit installed from the distro packages and verified.safe
  9. PHP CLIPHP CLI (version of your choice) + common extensions, multi-distro.caution
  10. Ruby (rbenv)Ruby via rbenv + ruby-build, version of your choice, for the user.caution
  11. .NET SDKThe .NET SDK (version of your choice) from the distro or Microsoft repos.caution
  12. Elixir + ErlangElixir and Erlang/OTP from the distro packages.safe
  13. Build toolchaingcc/g++, make, autotools, pkg-config and git, multi-distro.safe
  14. mise (version management)mise (formerly rtx) to manage runtime versions and per-project environment variables.caution
  15. ChocolateyChocolatey package manager, installed machine-wide.caution
  16. Node.js (Windows)Node.js LTS machine-wide (winget, else choco or the official MSI).safe
  17. Python (Windows)Python 3 for all users, added to the machine PATH.safe
  18. Git (Windows)Git for Windows, machine-wide.safe
  19. HomebrewHomebrew package manager via the official signed .pkg.caution
  20. Node.js (macOS)Node.js (major version of your choice) via Homebrew.safe
  21. Python (macOS)Python 3 (version of your choice) via Homebrew.safe
  22. Git (macOS)Recent Git via Homebrew.safe
  23. Xcode Command Line ToolsXcode command line tools (git, clang, make…), without any GUI.caution
CTR

Containers

13
  1. Docker EngineDocker Engine + Compose from the official repository, service active, hello-world verified.caution
  2. Docker ComposeDocker Compose plugin (docker compose), installed and verified.safe
  3. PodmanPodman (daemonless containers, rootless capable), verified.caution
  4. PortainerPortainer CE (LTS) Docker management web UI, admin preconfigured.caution
  5. k3s (lightweight Kubernetes)Single-node k3s cluster. Destructive: configures networking and a container runtime.destructive
  6. WatchtowerAutomatic, scheduled updates for Docker containers.caution
  7. Private Docker registryPrivate Docker image registry (registry:3) with authentication, TLS with a domain.caution
  8. Docker cleanup (cron)Weekly scheduled prune (systemd timer) of unused Docker images and containers.caution
  9. DockgeDockge Docker Compose stack manager, local only.caution
  10. HashiCorp NomadNomad orchestrator in single-node mode (server + client), local API.caution
  11. Docker Desktop (Windows)Docker Desktop on Windows 10/11 (WSL 2 backend). Destructive: enables WSL/VM Platform, reboot required.destructive
  12. Hyper-VEnables the Hyper-V role. Destructive: virtualization, reboot required.destructive
  13. Docker (macOS)Docker Desktop installed from the command line using the official DMG.caution
SYS

System

16
  1. TimezoneSets the server timezone.safe
  2. CockpitCockpit web administration console, local-only (SSH tunnel) by default, on :9090.caution
  3. Zsh + Oh My ZshZsh with Oh My Zsh for the current user.caution
  4. Synchronized clock (chrony)NTP synchronization via chrony.caution
  5. User + sudoCreates a user with SSH key and sudo access. Destructive: system account.destructive
  6. Log rotationConfigures logrotate for an application log folder.safe
  7. Disk cleanupPurges package caches, old logs and orphaned packages (report first).destructive
  8. System updateUpdates all packages while keeping configs. Destructive: may require a reboot.destructive
  9. HostnameSets the hostname and updates /etc/hosts.caution
  10. LocaleConfigures the system locale.safe
  11. Login banner (MOTD)Installs a custom MOTD banner.safe
  12. sysctl tuningAdjusts network/file limits. Destructive: kernel parameters.destructive
  13. OpenSSH ServerEnables the OpenSSH server built into Windows. Destructive: opens remote access.destructive
  14. Remote Desktop (RDP)Enables RDP with NLA and its firewall rule. Destructive: opens remote access.destructive
  15. Windows UpdateInstalls pending Windows updates. Destructive: reboot likely.destructive
  16. Active Directory (domain controller)Promotes the server to a domain controller (new forest). VERY destructive.destructive
NET

Networking

09
  1. TailscaleTailscale mesh VPN: auth key or login link, without touching the server DNS.caution
  2. WireGuardWireGuard VPN server + a first client, without touching routing. Destructive: network interface.destructive
  3. Pi-holePi-hole v6 (DNS + ad blocking) in a container, on the chosen IP. Destructive when listening on 0.0.0.0 (port 53).destructive
  4. AdGuard HomeAdGuard Home filtering DNS, local UI. Destructive: may free port 53.destructive
  5. OpenVPNOpenVPN server via the road-warrior script (angristan), first client created. Destructive: network.destructive
  6. DNS resolver (Unbound)Unbound validating (DNSSEC) recursive DNS resolver, on localhost.caution
  7. Network toolsiperf3, mtr, traceroute, dig and tcpdump for network diagnostics.safe
  8. frp tunnelfrp client (systemd service) to expose a local service via a remote frp server.caution
  9. HeadscaleHeadscale self-hosted Tailscale control plane, behind a TLS reverse proxy.caution
GAME

Game servers

09
  1. Minecraft Server (Java)Minecraft Java server (Paper, Vanilla, Fabric or Forge) under a dedicated user, as a systemd service, with the right Java.caution
  2. Valheim ServerDedicated Valheim server via Docker, under a dedicated user, world and backups in /opt/valheim.caution
  3. Factorio ServerDedicated Factorio server (stable release) via Docker, non-root, saves in /opt/factorio.caution
  4. Mumble ServerMumble (murmur) voice server from the distro packages, generated SuperUser password, started and verified.caution
  5. Minecraft Bedrock ServerDedicated Minecraft Bedrock server via Docker, under a dedicated user, world in /opt/bedrock.caution
  6. Terraria ServerDedicated Terraria (TShock) server via Docker, worlds in /opt/terraria.caution
  7. Palworld ServerDedicated Palworld server via Docker, under a dedicated user, generated admin password.caution
  8. CS2 ServerDedicated Counter-Strike 2 server via Docker (SteamCMD), non-root, GSLT token and RCON protected.caution
  9. ARK ServerDedicated ARK: Survival Evolved server via Docker, under a dedicated user, generated admin password.caution
HOST

Self-hosted

17
  1. VaultwardenVaultwarden password manager (Bitwarden-compatible) via Docker Compose, over HTTPS when a domain is provided.caution
  2. GiteaLightweight Gitea Git forge via Docker Compose (SQLite), web on localhost, Git SSH on a dedicated port.caution
  3. Uptime KumaUptime Kuma 2 uptime monitoring via Docker Compose, over HTTPS when a domain is provided.caution
  4. NextcloudNextcloud (file cloud) via Docker Compose: PostgreSQL, Redis, cron, admin created automatically.caution
  5. JellyfinJellyfin media server via Docker Compose, media folder mounted read-only, HTTPS when a domain is provided.caution
  6. n8nn8n workflow automation via Docker Compose, over HTTPS with webhooks when a domain is provided.caution
  7. ImmichImmich photo library with the official docker-compose, generated DB password, HTTPS when a domain is provided.caution
  8. Plex Media ServerPlex media server (linuxserver image) via Docker Compose on the host network, claimed with a claim token.caution
  9. Home AssistantHome Assistant Container home automation via Docker Compose (official method: host network, privileged).caution
  10. Paperless-ngxPaperless-ngx document management via Docker Compose (PostgreSQL + Valkey, official compose), admin and secrets generated.caution
  11. Wiki.jsWiki.js 2 modern wiki + PostgreSQL via Docker Compose, generated DB password.caution
  12. MetabaseMetabase BI tool via Docker Compose, persisted H2 application database, HTTPS when a domain is provided.caution
  13. Umami AnalyticsUmami 3 privacy-friendly analytics + PostgreSQL via Docker Compose, generated secrets.caution
  14. Homepage (dashboard)Homepage services dashboard via Docker Compose, configuration in /opt/homepage/config.caution
  15. FreshRSSFreshRSS RSS aggregator via Docker Compose (official image, built-in cron refresh), HTTPS when a domain is provided.caution
  16. SyncthingSyncthing P2P file sync (official repository), systemd service for one user, password-protected GUI on localhost.caution
  17. CoolifyCoolify self-hosted PaaS (Heroku/Vercel-style app deployment) via the official installer.destructive
MAIL

Mail

04
  1. SMTP relay (Postfix)Postfix as an outbound relay (satellite) via an authenticated TLS smarthost. Destructive: reconfigures mail delivery.destructive
  2. Dovecot IMAPDovecot IMAP server, TLS required, IMAPS on :993.caution
  3. RspamdRspamd anti-spam filter + Redis (official repo), wired into Postfix if present.caution
  4. ListmonkListmonk newsletter management + Postgres via Docker Compose, admin with a random password.caution
STOR

Storage & backup

11
  1. Swap fileCreates a persistent swap file of the chosen size. Destructive: modifies /etc/fstab.destructive
  2. restic backupsrestic + a scheduled, encrypted backup of a folder to a repository.caution
  3. MinIOS3-compatible MinIO object storage via Docker, local-only. Community project archived: frozen image.caution
  4. Garage (S3 storage)Garage (Deuxfleurs) S3-compatible object storage via Docker, single-node and local-only, with a first bucket and its key. Maintained alternative to MinIO.caution
  5. Samba shareSamba file server (SMB). Destructive: creates a share and a user.destructive
  6. Borg backupsBorgBackup + a scheduled encrypted backup of a folder.caution
  7. rclonerclone to sync to the cloud (S3, B2, Drive...).caution
  8. NFS serverNFS share. Destructive: exposes a folder on the network.destructive
  9. Disk mount (fstab)Formats (if empty) and mounts a disk persistently. Destructive: potential ERASE.destructive
  10. ZFS poolInstalls ZFS and creates a pool. Destructive: ERASES the disks.destructive
  11. SMB file shareCreates a Windows SMB share. Destructive: exposes a folder on the network.destructive
CI

CI/CD

09
  1. GitHub Actions RunnerSelf-hosted GitHub Actions runner under a dedicated user, registered as a systemd service.caution
  2. GitLab RunnerGitLab Runner from the official repo, registered with the Docker or shell executor.caution
  3. Woodpecker CILightweight Woodpecker CI (server + agent) via Docker Compose, behind an HTTPS reverse proxy.caution
  4. Ansible (control node)Ansible installed as a control node from the distro packages.safe
  5. systemd serviceDaemonize a command into a managed systemd service (auto-restart, at boot).caution
  6. Scheduled task (cron)Add a scheduled task via a systemd timer (logged, catches up if missed).caution
  7. Scheduled task (Windows)Registers a daily scheduled task under a service account.caution
  8. launchd Service (macOS)Daemonizes a command via a macOS LaunchDaemon. Destructive: system service.destructive
  9. GitHub Actions Runner (macOS)Self-hosted GitHub Actions runner for Apple builds, under a non-root account.caution
AI

AI / ML

07
  1. OllamaOllama to run local LLMs (NVIDIA GPU if present, CPU otherwise), API on 127.0.0.1, optional model pull.caution
  2. JupyterLabJupyterLab via Docker, on 127.0.0.1 with a generated access token (access through an SSH tunnel).caution
  3. Open WebUIOpen WebUI, a web interface for LLMs (Ollama), via Docker on 127.0.0.1, wired to the local Ollama.caution
  4. NVIDIA drivers + CUDANVIDIA driver, CUDA toolkit and Docker Container Toolkit from the official repositories. Destructive: kernel modules, restart likely.destructive
  5. ComfyUI (Stable Diffusion)ComfyUI for image generation, installed from the official repository as a systemd service (NVIDIA GPU recommended, CPU possible).caution
  6. vLLM inference servervLLM to serve an LLM through an OpenAI-compatible API on 127.0.0.1, protected by a generated key. NVIDIA GPU required.caution
  7. Ollama (macOS)Local LLMs with Ollama via Homebrew (Metal-accelerated), local API.caution
CMS

Web & CMS

07
  1. Deploy a Docker Compose appDeploys a (provided) Docker Compose stack, with an HTTPS reverse proxy if a domain is given. Describe your needs in the instructions.caution
  2. WordPressWordPress via Docker Compose (app + MariaDB, generated secrets), HTTPS if a domain is provided.caution
  3. GhostGhost 6 blogging platform via Docker Compose (Ghost + MySQL), served over HTTPS.caution
  4. OdooOdoo 20 Community ERP via Docker Compose (Odoo + Postgres), generated master password, HTTPS if a domain is provided.caution
  5. DiscourseDiscourse forum (official discourse_docker install, Let’s Encrypt HTTPS). Takes ports 80/443.caution
  6. MattermostMattermost team messaging via Docker Compose (Mattermost + Postgres), HTTPS if a domain is provided.caution
  7. DirectusDirectus headless CMS via Docker Compose (Directus + Postgres), generated secrets and admin, HTTPS if a domain is provided.caution
MISC

Cross-cutting

01
  1. Homebrew PackageInstalls a Homebrew package (formula) of your choice.caution

Go further