Server recipes that prove their work

nginx web server, started, enabled at boot and verified.

Caddy with automatic HTTPS for a domain.

Apache web server, started, enabled and verified.

HAProxy load balancer, started and verified.

Traefik reverse proxy via Docker, with the dashboard and automatic TLS.

Web-UI reverse proxy Nginx Proxy Manager via Docker.

Certbot + TLS certificate and automatic renewal.

PHP-FPM (choice of version) for nginx/apache.

Varnish HTTP cache in front of a web backend.

Configures nginx as a reverse proxy to a local service (websocket OK).

Internet Information Services role enabled and started.

The .NET Hosting Bundle to host ASP.NET Core apps behind IIS.

nginx via Homebrew, started as a service.

PostgreSQL (major version of your choice), initialized, started and verified.

MySQL, secured (mysql_secure_installation), started and verified.

MariaDB, started, enabled and verified.

MongoDB Community, started, enabled and verified.

RabbitMQ message broker with the management plugin.

Memcached in-memory cache, bound to localhost.

ClickHouse analytical database, started and verified.

SQLite + tooling (litestream for replication).

InfluxDB time-series database, running on :8086.

TimescaleDB extension on an existing PostgreSQL.

Neo4j Community graph database.

Scheduled PostgreSQL dump, compressed and with limited retention.

Hardens PostgreSQL: listen address, pg_hba, SSL. Destructive: alters access.

CockroachDB single-node (dev/single), running as a service.

Reliable PostgreSQL backups with pgBackRest.

PostgreSQL via winget, service started.

Microsoft SQL Server (Developer) via winget, service started.

PostgreSQL via Homebrew, service started.

Redis via Homebrew, service started.

Redis, with an optional password, started and verified.

NATS messaging server (JetStream optional).

Mosquitto MQTT broker for IoT.

Kafka in KRaft mode (no ZooKeeper) via Docker.

Prometheus system metrics exporter, as a service.

Netdata real-time monitoring, on :19999.

Prometheus (metrics collection), as a service on :9090.

Grafana (dashboards), as a service on :3000.

Loki log aggregation via Docker, on :3100.

Grafana + Prometheus + node_exporter via Docker Compose.

cAdvisor container metrics via Docker.

Glances real-time system monitoring (web mode).

Prometheus Alertmanager alert routing via Docker.

Vector observability pipeline (logs/metrics).

Grafana Alloy log shipping agent to Loki (successor to Promtail, EOL).

Disables root and password login, keeps keys. Destructive: verify your key access first.

fail2ban with the SSH jail, active and verified.

UFW: deny incoming by default, allow SSH + chosen ports. Destructive: keeps SSH open.

Enables automatic security updates (unattended-upgrades).

CrowdSec collaborative IPS + firewall bouncer.

ClamAV antivirus with an up-to-date signature database.

Installs Lynis and runs a hardening audit (read-only).

Baseline nftables firewall. Destructive: applies network rules.

auditd kernel audit log, enabled.

TOTP on SSH via Google Authenticator PAM. Destructive: touches SSH auth.

Searches for plaintext secrets in a folder (read-only, report).

Replaces a user's authorized keys. Destructive: SSH access.

Opens an inbound port in the Windows firewall. Destructive: network.

Node.js (LTS version of your choice) via fnm, for the user.

The Go language (version of your choice), in the PATH.

The Bun JS runtime, in the PATH.

Python (version of your choice) via pyenv, for the user.

The Rust toolchain via rustup.

The Deno runtime, installed for the user.

Temurin JDK (OpenJDK), LTS version of your choice.

Git installed and verified.

PHP CLI (version of your choice) + common extensions.

Ruby via rbenv, version of your choice, for the user.

The .NET SDK (LTS version of your choice).

Elixir and Erlang/OTP.

build-essential + common compilers and tools.

mise (formerly rtx) to manage runtime versions + direnv.

Chocolatey package manager (PowerShell bootstrap).

Node.js LTS via winget.

Python 3 via winget.

Git for Windows via winget.

Homebrew package manager (bootstrap).

Node.js via Homebrew.

Python 3 via Homebrew.

Git via Homebrew.

Xcode command line tools (git, clang, make…).

Docker Engine + Compose, service active, hello-world verified.

Docker Compose v2 plugin, verified.

Podman (rootless containers), verified.

Portainer Docker management web UI.

Single-node k3s cluster. Destructive: configures networking and a container runtime.

Automatic updates for Docker containers.

Private Docker image registry via Docker.

Scheduled prune of unused Docker images/volumes.

Dockge Docker Compose stack manager.

Nomad orchestrator in single-node mode (server+client). Destructive: networking.

Docker Desktop via winget. Destructive: enables WSL2/Hyper-V, reboot likely.

Enables the Hyper-V role. Destructive: virtualization, reboot required.

Docker Desktop via Homebrew Cask.

Sets the server timezone.

Cockpit web administration console, on :9090.

Zsh with Oh My Zsh for the current user.

NTP synchronization via chrony.

Creates a user with SSH key and sudo access. Destructive: system account.

Configures logrotate for an application log folder.

Purges apt caches, old logs and orphaned packages (report first).

Updates all packages. Destructive: may require a reboot.

Sets the hostname and updates /etc/hosts.

Configures the system locale.

Installs a custom MOTD banner.

Adjusts network/file limits. Destructive: kernel parameters.

Enables the OpenSSH server built into Windows. Destructive: remote access.

Enables RDP and the firewall rule. Destructive: opens remote access.

Installs pending Windows updates. Destructive: reboot likely.

Promotes the server to a domain controller (new forest). VERY destructive.

Tailscale mesh VPN (requires an auth key to connect).

WireGuard VPN: generates keys, configures an interface. Destructive: touches the network.

Pi-hole (DNS + ad blocking). Destructive: changes the DNS resolver.

AdGuard Home filtering DNS. Destructive: may take over port 53.

OpenVPN server via the road-warrior script. Destructive: network.

Unbound recursive DNS resolver, on localhost.

iperf3, mtr, speedtest and network diagnostic tools.

frp client to expose a local service via a remote frp server.

Headscale self-hosted Tailscale control plane.

Configurable Java Minecraft server (version, type, players, RAM), as a systemd service.

Dedicated Valheim game server via Docker.

Dedicated Factorio game server via Docker.

Mumble (murmur) voice server, started and verified.

Dedicated Minecraft Bedrock server via Docker.

Dedicated Terraria (TShock) game server via Docker.

Dedicated Palworld game server via Docker.

Dedicated Counter-Strike 2 server via Docker (SteamCMD).

Dedicated ARK: Survival server via Docker.

Vaultwarden password manager (Bitwarden-compatible) via Docker.

Lightweight Git forge Gitea via Docker.

Self-hosted uptime monitoring Uptime Kuma via Docker.

Nextcloud (self-hosted file cloud) via Docker.

Jellyfin media server via Docker, on :8096.

n8n workflow automation via Docker.

Self-hosted photo gallery Immich via Docker Compose.

Plex media server via Docker.

Home Assistant Container home automation via Docker.

Paperless-ngx document management via Docker Compose.

Modern wiki Wiki.js via Docker.

Metabase BI tool via Docker.

Privacy-friendly analytics Umami via Docker Compose.

Homepage services dashboard via Docker.

FreshRSS RSS aggregator via Docker.

Syncthing P2P file synchronization.

Self-hosted PaaS Coolify (Heroku/Vercel-style app deployment).

Postfix as an outbound relay (satellite) via a smarthost. Destructive: reconfigures mail delivery.

Dovecot IMAP/POP3 server.

Rspamd anti-spam filter + Redis.

Listmonk newsletter management via Docker Compose.

Creates a persistent swap file of the chosen size. Destructive: modifies /etc/fstab.

restic + a scheduled backup of a folder to a target (encrypted).

S3-compatible object storage MinIO via Docker.

Samba file server (SMB). Destructive: creates a share and a user.

BorgBackup + a scheduled encrypted backup of a folder.

rclone to sync to the cloud (S3, B2, Drive...).

NFS share. Destructive: exposes a folder on the network.

Formats and mounts a disk persistently. Destructive: potential ERASE.

Installs ZFS and creates a pool. Destructive: ERASES the disks.

Creates a Windows SMB share. Destructive: exposes a folder on the network.

Self-hosted GitHub Actions runner, registered as a service.

GitLab Runner registered with the Docker/shell executor.

Lightweight Woodpecker CI (server) via Docker.

Ansible installed as a control node.

Daemonize a command into a managed systemd service.

Add a scheduled task via a systemd timer.

Registers a Windows scheduled task.

Daemonizes a command via a macOS LaunchDaemon. Destructive: system service.

Self-hosted GitHub Actions runner for Apple builds.

Ollama to run local LLMs (optional model pull).

JupyterLab via Docker, with an access token.

Open WebUI, a web interface for LLMs (Ollama) via Docker.

NVIDIA drivers and CUDA toolkit. Destructive: kernel modules, reboot likely.

ComfyUI for image generation via Docker (GPU recommended).

vLLM to serve an LLM through an OpenAI-compatible API. GPU required.

Local LLMs with Ollama via Homebrew (Metal-accelerated).

Deploys a (provided) Docker Compose stack and exposes it. Describe your needs in the instructions.

WordPress via Docker (app + MariaDB), ready to configure.

Ghost blogging platform via Docker.

Odoo Community ERP via Docker (app + Postgres).

Discourse forum (official install). Destructive: takes 80/443.

Mattermost team messaging via Docker Compose.

Directus headless CMS via Docker.

Installs a Homebrew package (formula) of your choice.