Who it is for
A small company running its site or app on a VPS or EC2 instance set up by hand years ago: password SSH, no firewall, months of missing patches, no tested backups, and nobody who could rebuild it.
The problem
- Password SSH and open ports are scanned by bots within minutes of a server going online.
- Missing patches and no backups turn one bad day into a lost business.
- If the server dies, nobody knows how it was built.
What I do
- A snapshot first, then a read-only Lynis audit: the 'before' score with every finding explained.
- Ansible roles for key-only SSH (validated before reload, so you can't be locked out), a default-deny firewall, fail2ban and nightly security patches.
- HTTPS with security headers, the app in a systemd sandbox, backups with a tested restore, and monitoring.
- An 'after' audit, a nightly drift check, and releases with a health gate and automatic rollback.
- Optional add-on: email and domain security from public DNS only - one SPF record, DKIM for every sender, DMARC moved from monitoring to reject over a few weeks so no real mail is lost, and CAA.
How it works
- 1Snapshot first
- 2Lynis audit: before score
- 3Ansible hardening (idempotent)
- 4HTTPS, backups, monitoring
- 5Lynis audit: after score
- 6Nightly drift check
Day by day
- Day 1Snapshot (by you), key-only access for me, the 'before' audit; we agree what may change.
- Day 2Hardening on a staging copy first, then the live server; HTTPS, backups and a restore test.
- Day 3The 'after' audit, the report, and handover of the Ansible code into your repository.
Evidence from the demo
The evidence below comes from my own demo project with synthetic data. It shows exactly what you receive; it is not a story about a client.
- In ServerForge's container lab, the Lynis score goes from 60 to 80 after one Ansible run (real servers score differently; the report shows both runs).
- CI runs every role twice and fails if the second run changes anything.
- Releases go out one server at a time behind a health gate with automatic rollback; a nightly check-mode run catches hand edits.
Demo project: ServerForge
What you keep
- Before/after audit report
- Ansible code in your repository
- Backups with a tested restore
- A rebuild runbook
Not included
- Application changes
- Managing the server month to month (care plan available)
Questions
Do you need access to my production systems?
No passwords, ever. Audits use a read-only role you create and can delete at any time; changes arrive as a pull request you review and merge yourself.
How long does a project take?
2 to 10 working days depending on the package. You get the timeline and the fixed price before we start.
What if you find nothing worth fixing?
Then you hear that early, with the evidence. For the AWS Bill Doctor on accounts above $1,000 a month: if I don't find at least my fee in yearly savings, you don't pay.
What happens to my data?
Reports stay between us. When the project ends I delete your data and confirm it in writing.
How do I pay?
Upwork, international bank transfer, or UPI / bank transfer in India. Direct clients pay 50% upfront and 50% on delivery.