What to do: Open that link in a browser on your Windows machine (or your phone \u2014 doesn’t matter which, it just needs to be a device where you can log in). Tailscale will ask you to sign in \u2014 pick whichever option you like (Google, Microsoft, GitHub, Apple, or email). This creates your free Tailscale account and links this server to it.<\/p>\n\n\n\n
Important: whatever account you choose here is the one you’ll also install Tailscale under on your phone and Windows machine afterward, so all your devices can see each other. Pick one you’ll remember and keep using for this project.<\/p>\n\n\n\n
Once you’ve logged in and see a confirmation page, let me know and I’ll verify the server joined your network.<\/p>\n\n\n\n
\u203b recap: We’re setting up your Nextcloud server securely with Tailscale for remote access. Next: open the login link I sent, sign in with any account, and let me know once you see the confirmation page. (disable recaps in \/config)<\/p>\n\n\n\n
10 tasks (2 done, 1 in progress, 7 open)
\u25fc Install and configure Tailscale for remote admin access
\u25fb Harden SSH daemon config
\u25fb Configure UFW firewall
\u25fb Automate DuckDNS IP updates via systemd timer
\u25fb Install Nginx Proxy Manager as reverse proxy in front of A\u2026<\/p>\n\n\n\n
Next, add a second device.<\/h2>\n\n\n\n
Your device (ubuntu-server<\/strong>) was added to your network!<\/p>\n\n\n\n Tailscale connects multiple devices together, so you\u2019ll need it installed on more than one device. Open the link below on a second device and download Tailscale there too.LinuxWindowsmacOSiPhone & iPadAndroidSynology<\/p>\n\n\n\n Download Tailscale from our website, send yourself an email with a download link, or read our installation guide<\/a>.<\/p>\n\n\n\n Cleanup done \u2014 hello-world container\/image gone, the stray file removed, Portainer container and its data volume both removed. Docker now shows just the Nextcloud AIO stack.<\/p>\n\n\n\n Now let’s set up Tailscale \u2014 this is what lets you (and your phone\/laptop) reach the server securely from anywhere, without ever opening an SSH port on your router to the whole internet.<\/p>\n\n\n\n What it is, in plain terms: Tailscale creates a private network between your devices (like a permanent, automatic VPN) using your own login (Google\/Microsoft\/GitHub\/Apple\/email \u2014 whichever you prefer). Once installed, the server gets a private address that only your logged-in devices can reach. Nobody scanning the internet can even see it exists.<\/p>\n\n\n\n Let’s install it.<\/p>\n\n\n\n Ran 1 shell command<\/p>\n\n\n\n Tailscale is installed. Now I need to start it and get a login link for you to open \u2014 this is the one step that needs your account, so it has to happen in your browser.<\/p>\n\n\n\n Ran 2 shell commands<\/p>\n\n\n\n Here’s your login link:<\/p>\n\n\n\n What to do: Open that link in a browser on your Windows machine (or your phone \u2014 doesn’t matter which, it just needs to be a device where you can log in). Tailscale will ask you to sign in \u2014 pick whichever option you like (Google, Microsoft, GitHub, Apple, or email). This creates your free Tailscale account and links this server to it.<\/p>\n\n\n\n Important: whatever account you choose here is the one you’ll also install Tailscale under on your phone and Windows machine afterward, so all your devices can see each other. Pick one you’ll remember and keep using for this project.<\/p>\n\n\n\n Once you’ve logged in and see a confirmation page, let me know and I’ll verify the server joined your network.<\/p>\n\n\n\n \u273b Baked for 1m 21s \u00b7 1 shell still running<\/p>\n\n\n\n \u203b recap: We’re setting up your Nextcloud server securely with Tailscale for remote access. Next: open the login link I sent, sign in with any account, and let me know once you see the confirmation page. (disable recaps in \/config)<\/p>\n\n\n\n \u25cf Background command “Start Tailscale and generate a login link” completed (exit code 0)<\/p>\n\n\n\n Ran 1 shell command<\/p>\n\n\n\n Tailscale is connected \u2014 the server now has a private Tailscale IP: 100.111.255.36, tied to your account.<\/p>\n\n\n\n Now let’s get your Windows machine on the same private network so you can actually use it.<\/p>\n\n\n\n Step 1 \u2014 Install Tailscale on Windows: Step 2 \u2014 Test it: Let me know once that works \u2014 then we lock down SSH so it’s only reachable this way (no more direct-internet exposure via those 2222\/16000 router forwards).<\/p>\n\n\n\n \u273b Brewed for 19s<\/p>\n\n\n\n \u276f got tailscale installed on my windows 11 pc (this machine i am at now) it is asking me to either open local settings or open admin console or close. which one i need to do?<\/p>\n\n\n\n Neither is required right now \u2014 you can safely click Close. Quick explainer so you’re not left wondering:<\/p>\n\n\n\n Click Close, then look for the Tailscale icon in your Windows system tray (bottom-right, near the clock \u2014 might be hidden under the little up-arrow “show hidden icons”). Click it and confirm it says Connected.<\/p>\n\n\n\n Once you see that, open a terminal (PowerShell\/Windows Terminal \u2014 a new window, separate from wherever you’re chatting with me) and run: Let me know if it logs you in.<\/p>\n\n\n\n after installing Tailscale onmy windows machine, i ran this command in the powershell: <\/p>\n\n\n\n PS C:\\WINDOWS\\system32> ssh ahmad@100.111.255.36 SSH over Tailscale is fully working \u2014 you’re in. That’s the private, secure path locked down.<\/p>\n\n\n\n Read 1 file<\/p>\n\n\n\n Since there’s no SSH key set up yet, and password auth is what’s actually been under attack, we need to set up key-based login before I turn password auth off \u2014 otherwise a mistake could lock you out entirely.<\/p>\n\n\n\n Step 1 \u2014 Generate a key pair on your Windows machine. In the same PowerShell window (the one you’re SSH’d from, or open a fresh one \u2014 doesn’t matter which), run: Step 2 \u2014 Show me the public key (this half is safe to share \u2014 it’s not a secret, unlike the private half): Important: never paste the other file (id_ed25519, no .pub) anywhere \u2014 that one’s the private key and must stay only on your Windows machine.<\/p>\n\n\n\n Go ahead and run those two commands.<\/p>\n\n\n\n Full Name: Ahmad Elhaddad<\/p>\n\n\n\n Email address: ahmadhaddad958@gmail.com <\/p>\n\n\n\n password: ent-Z1M5<\/p>\n\n\n\n Initial Nextcloud username: admin<\/strong><\/p>\n\n\n\n Initial Nextcloud password: a7dd1672a237101fe5fa68316eb5620d201b97f5719465ca<\/strong><\/p>\n\n\n\n initial passphrase: postage spotlight unsolved staleness disk dexterous riverside passerby<\/p>\n\n\n\n before we start WP. i need you advice about the best fast tools to use for bulk copying from my repository media to this 1.8TB dedicated to Nexcloud (of course not bypassing nextcloud, but with coordination with nextcloud to make sure every media is registerd indexed etc. i tired in the old setting Robocopy, it was great fast but fills the log too quickly and caused hanging the entire setup. i tried rclone, was a bit slower but no problems with the loggin\u2026.but then caused corruption to the entire setup\u2026.the problem, using natively the nextcloud to move the media takes days\u2026.i have more that 700GB worth of media on one drive and about 400+ GB on another drive\u2026.it is going to be christmas before finishing the download \ud83d\ude42<\/p>\n\n\n\n \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 1 new message \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500<\/p>\n\n\n\n Good instinct to ask before diving in \u2014 the tool matters less here than the workflow, and I think I can explain why rclone likely corrupted things so we avoid repeating it.<\/p>\n\n\n\n Why the past attempts went wrong, most likely:<\/p>\n\n\n\n The correct pattern for exactly this (bulk import, not upload):<\/p>\n\n\n\n This sidesteps both failure modes entirely \u2014 nothing running concurrently to get confused, and no fragile network-share logging.<\/p>\n\n\n\n One thing that changes my answer: are those two source drives (700GB \/ 400GB+) things you can physically plug into this Ubuntu server directly (USB or SATA), even temporarily? If so, we skip the network entirely and do a local disk-to-disk copy, which will be both the fastest and the most reliable option \u2014 no Windows\/SMB\/Tailscale transfer layer involved at all.<\/p>\n\n\n\n One thing that changes my answer: are those two source drives (700GB \/ 400GB+) things you can physically plug into this Ubuntu server directly (USB or SATA), even temporarily? If so, we skip the network entirely and do a local disk-to-disk copy, which will be both the fastest and the most reliable option \u2014 no Windows\/SMB\/Tailscale transfer layer involved at all.<\/p>\n\n\n\n Got it \u2014 network transfer it is. Given they’re staying reliable and low-effort matters more than shaving off the last bit of raw speed, here’s what I’d actually recommend, and why it avoids repeating both past failures:<\/p>\n\n\n\n Recommended: rsync via WSL on your Windows machine, over the SSH connection we already built.<\/p>\n\n\n\n Why this specific combination:<\/p>\n\n\n\n The setup on your end:<\/p>\n\n\n\n If you’d rather skip WSL entirely, the fallback is a GUI tool like WinSCP using the same SSH key \u2014 simpler to click through, somewhat less robust for a 1TB+ resumable transfer, but zero setup beyond installing it.<\/p>\n\n\n\n Which way do you want to go \u2014 WSL+rsync (a bit more setup, most reliable), or WinSCP (quick to start, simpler)?<\/p>\n\n\n\n Good context \u2014 since these will stay as ongoing (mostly-read-only) backups, that also means this won’t be a strict one-time job; you’ll likely want to sync new additions occasionally too. That’s another point in rsync’s favor \u2014 reruns only transfer what’s new\/changed, not the whole library again.<\/p>\n\n\n\n So, back to the fork: do you already have WSL installed on Windows, or would you rather go the simpler WinSCP route (quicker to start, no reboot needed, a bit less robust for resuming a huge interrupted transfer)?<\/p>\n\n\n\n So, back to the fork: do you already have WSL installed on Windows, or would you rather go the simpler WinSCP route (quicker to start, no reboot needed, a bit less robust for resuming a huge interrupted transfer)? I do, but i used it once for a small project and then never touched it. so what do yo suggest?<\/p>\n\n\n\n Good \u2014 no reboot needed then. Let’s use WSL. Since it also fits how you’ll use this going forward (occasional syncs of new files, not just once), it’s worth the extra setup.<\/p>\n\n\n\n Step 1 \u2014 Open WSL. Search “WSL” in your Start menu (or open a PowerShell\/Terminal window and type wsl, Enter). You should land on a prompt that looks different from PowerShell \u2014 something like ahmad@YOURPC:~$.<\/p>\n\n\n\n Step 2 \u2014 Install rsync inside it: Step 3 \u2014 Generate a fresh SSH key, specifically inside WSL (not reusing the Windows one \u2014 WSL’s filesystem permissions on Windows-mounted drives are too loose for SSH’s liking, so a separate key avoids a whole class of annoying errors): Step 4 \u2014 Show me the public key: Fixed \u2014 ahmad is now in the www-data group, and the target directory allows group writes (with new subfolders automatically inheriting the right group going forward, so this won’t need repeating). Since it’s a fresh permission set, try the same command again from WSL:<\/p>\n\n\n\n rsync -a –info=progress2 –partial -e ssh “\/mnt\/e\/Family & Friends\/Ajam-000-Wafiq+Fatma” ahmad@100.111.255.36:\/mnt\/nextcloud_data\/admin\/files\/<\/p>\n\n\n\n \u273b Cooked for 29s<\/p>\n\n\n\n \u276f ahmad@my7400:\/mnt\/c\/WINDOWS\/system32$ rsync -a –info=progress2 –partial -e ssh “\/mnt\/e\/Family & Friends\/Ajam-000-Wafiq+Fatma” ahmad@100.111.255.36:\/mnt\/nextcloud_data\/admin\/files\/ Transferred cleanly \u2014 523MB in 48 seconds (~10MB\/s, reasonable over WiFi\/LAN through SSH encryption). Let’s verify what actually landed and get it registered in Nextcloud.<\/p>\n\n\n\n Ran 1 shell command<\/p>\n\n\n\n Small miss on my end \u2014 that needs sudo since regular users can’t reassign file ownership. Let me redo that and move on to registering it with Nextcloud.<\/p>\n\n\n\n Ran 1 shell command<\/p>\n\n\n\n One structural thing to fix first: since your source top-level folder is Family & Friends, everything should probably nest under a matching folder in Nextcloud too \u2014 otherwise this test folder ends up sitting loose at the top level while everything else lands one level deeper. Let me fix that now before we scale up, and confirm Nextcloud’s database follows correctly.<\/p>\n\n\n\n Ran 1 shell command<\/p>\n\n\n\n Same issue as before \u2014 my own shell session predates the group change, so it doesn’t see it either. Let me just use sudo directly:<\/p>\n\n\n\n Ran 1 shell command<\/p>\n\n\n\n Confirmed \u2014 database now correctly shows it nested under Family & Friends, with the old path cleanly removed. That pipeline (rsync \u2192 permissions \u2192 scan) is proven end to end. Go check https:\/\/ahaddad.duckdns.org in a browser if you want to see Family & Friends\/Ajam-000-Wafiq+Fatma show up for real.<\/p>\n\n\n\n Now, the actual scale reality: at the ~10MB\/s we just measured, 700GB works out to roughly 18-20 hours of continuous transfer (likely more once it hits the huge folders full of tiny phone-dump photos \u2014 lots of small files are slower per-GB than a few large ones). That’s the honest number, not something a different tool would meaningfully change \u2014 it’s governed by your network\/disk speed, not rsync vs. rclone vs. robocopy.<\/p>\n\n\n\n Good news on the coordination side: we don’t need to lock Nextcloud in maintenance mode for that whole stretch. Nextcloud’s own background jobs only act on files it already knows about \u2014 it won’t go poking at content sitting unscanned on disk. We just need to keep doing what we did here: copy first, then scan afterward, never scan mid-copy. So Nextcloud stays fully usable for you the entire time this runs in the background.<\/p>\n\n\n\n Two practical things before you kick off the real one:<\/p>\n\n\n\n Kick it off whenever you’re ready \u2014 it’ll run for many hours, so this is a “start it before bed” kind of job. Let me know once it’s running (or if it errors early), and I’ll check in on progress from the server side periodically.<\/p>\n\n\n\n \u273b Saut\u00e9ed for 2m 7s<\/p>\n\n\n\n \u276f yes family & friends shows us very beautifully\u2026<\/p>\n\n\n\n Great to hear. Whenever you’re ready, go ahead and kick off the full transfer \u2014 just double check Windows sleep is disabled first, then run:<\/p>\n\n\n\n rsync -a –info=progress2 –partial -e ssh “\/mnt\/e\/Family & Friends\/” “ahmad@100.111.255.36:\/mnt\/nextcloud_data\/admin\/files\/Family & Friends\/”<\/p>\n\n\n\n It’ll sit there showing a rolling progress line for many hours \u2014 that’s normal, not stuck. Once it’s going, let me know and I’ll periodically check progress from the server side without you needing to babysit it. When it’s fully done (or if you want to stop and resume later), just tell me and I’ll run the chown + occ files:scan pass to register everything with Nextcloud.<\/p>\n\n\n\n \u273b Worked for 6s<\/p>\n\n\n\n \u276f then for tomorrow from work, i need to setup claude also in the powershell like to day. can you write something so that i paste it to you to start tomorrow installing the Tailscale and whatever needed to ssh the ubuntu server?<\/p>\n\n\n\n Here’s a self-contained prompt you can paste into a fresh Claude Code session tomorrow (whether that’s on the work PC or anywhere else). I’ve written it so a Claude instance with zero memory of this conversation can pick up correctly:<\/p>\n\n\n\n I have a home Ubuntu server (“ubuntu-server”, Ubuntu 26.04 LTS) running Nextcloud AIO behind Nginx Proxy Manager, publicly reachable at https:\/\/ahaddad.duckdns.org. Remote administration is done exclusively via Tailscale \u2014 no SSH is exposed to the internet, and SSH password authentication is disabled server-side (key-only). The server’s Tailscale IP is 100.111.255.36, SSH user is ahmad.<\/p>\n\n\n\n I’m now on a different Windows machine and need to set up remote access matching my other devices. Please help me:<\/p>\n\n\n\n Note: this machine won’t have direct access to the server’s filesystem to authorize the new key itself \u2014 I’ll need to take the public key you show me and get it added to \/home\/ahmad\/.ssh\/authorized_keys on the server through a device\/session that already has access.<\/p>\n\n\n\n One important note on that last step: since a brand-new session can’t add its own key to the server, you’ll need to bring that public key back to a place that can \u2014 either paste it into this conversation if you’re able to reopen it from work, or into any other device\/session that already has working SSH access to the server (this Windows PC or the WSL environment both qualify, since they can sudo and directly edit that file).<\/p>\n\n\n\n Separately, I’m saving a memory of this project’s architecture now so that even without you pasting anything, any future Claude Code session I run will already have the key facts (Tailscale-only access, no exposed SSH, NPM reverse proxy setup, external-drive datadir, etc.) \u2014 that should make picking this up later, from any machine, considerably smoother.<\/p>\n\n\n\n Recalled 1 memory, wrote 2 memories<\/p>\n\n\n\n Memory saved \u2014 that project summary will now surface automatically in future Claude Code sessions on this machine, even without you pasting anything.<\/p>\n\n\n\n To recap where things stand: the paste-able prompt above is ready for tomorrow, and once you kick off that big rsync for the rest of Family & Friends tonight (with Windows sleep disabled), it can run unattended for the many hours it’ll take. Good stopping point for today \u2014 WordPress planning (task #10) is still waiting whenever you want to pick it up next.<\/p>\n\n\n\n <\/p>\n\n\n\n Runbook \u00b7 ahaddad home server<\/p>\n\n\n\n A reproducible build order for the box currently running Nextcloud and a small family of WordPress sites \u2014 Tailscale-only administration, one reverse proxy, one external drive for data. Skips the dead ends; keeps only what’s actually running.Contents<\/p>\n\n\n\n ubuntu-server \u00b7 100.111.255.36InternetRouterforwards 80\/443 only80 \/ 443Nginx Proxy Mgr:80 \/ :443, TLS terminationforwardedNextcloud Apache127.0.0.1:1100WordPress sitesrouted by pathby domainby pathTailscale deviceslaptop \u00b7 phone \u00b7 WSL \u00b7 \u2026SSH :22 \u00b7 NPM admin :81 \u00b7 AIO :8080\/8443bound to the Tailscale IP onlyencrypted, direct \u2014 never touches the routerpublic pathtailnet-only pathTwo independent paths into the box. Public HTTP\/HTTPS is the only thing the router forwards, and Nginx Proxy Manager is the only thing that ever receives it \u2014 it alone decides whether a request goes to Nextcloud or a WordPress site. Every administrative surface (SSH, NPM’s own admin UI, the AIO admin panel) is bound to the Tailscale interface specifically, so it’s reachable only from devices already on the tailnet, from anywhere in the world, without ever being exposed to the router.<\/p>\n\n\n\n 01<\/p>\n\n\n\n Everything else assumes key-only SSH and a private admin channel exist before any service goes on the box.<\/p>\n\n\n\n Standard install (this box runs 26.04 LTS). Use the installer’s LVM-free\/plain ext4 layout on the boot disk, create the primary user during setup, and skip any bundled snap extras you don’t need.<\/p>\n\n\n\n Add your public key to Note the Tailscale IP it’s assigned ( Why<\/p>\n\n\n\n The LAN-subnet SSH rule is a deliberate fallback for the day Tailscale itself is unreachable (router reboot mid-update, etc.) \u2014 not a general-purpose hole. It’s scoped to the local subnet, not the internet.<\/p>\n\n\n\n Ports 80\/443 get opened in Phase 4, once there’s a reverse proxy actually listening on them.<\/p>\n\n\n\n 02<\/p>\n\n\n\n Application data lives on the external drive; the boot NVMe only ever holds the OS and Docker.<\/p>\n\n\n\n Find its UUID with The Nextcloud container’s process runs as Gotcha<\/p>\n\n\n\n Group membership is read at login. A shell session opened before<\/em> this command won’t see the new group \u2014 reconnect rather than trying to refresh it in place.<\/p>\n\n\n\n 03<\/p>\n\n\n\n One container manages the rest of the Nextcloud stack for you \u2014 it just needs to know where the data lives and which ports are safe to expose.<\/p>\n\n\n\n This is the one container Nextcloud AIO needs directly \u2014 it manages every other Nextcloud container itself via the Docker socket. The two choices that matter: From any device on the tailnet, open Same private-admin pattern as everything else \u2014 bound to the Tailscale IP only, never public:<\/p>\n\n\n\n Gotcha<\/p>\n\n\n\n Portainer locks its own setup screen 5 minutes<\/strong> after first start if no admin account has been created yet (“the instance timed out for security purposes”) \u2014 if that happens, Recent Portainer versions also require a one-time setup token<\/strong> pasted into the initial admin-creation screen, printed only in the container’s startup logs:<\/p>\n\n\n\n Grab it and create the admin account promptly \u2014 both the token and the 5-minute window are freshly (re)issued on every restart.<\/p>\n\n\n\n 04<\/p>\n\n\n\n One entry point for the whole internet-facing surface: Nginx Proxy Manager terminates TLS and decides where every request actually goes.<\/p>\n\n\n\n On the same Docker network as the Nextcloud containers, so it can reach them by container name:<\/p>\n\n\n\n Its own admin UI (port A free DuckDNS hostname, kept current by a systemd timer rather than cron (survives reboots cleanly, logs to journald):<\/p>\n\n\n\n One DuckDNS account can hold several hostnames under the same token \u2014 register one now per service you plan to expose (e.g. one for Nextcloud, one as a hub for everything else).<\/p>\n\n\n\n Forward 80 and 443 only<\/strong>, to the server’s LAN IP. Nothing else \u2014 SSH stays off the router entirely, reachable only via Tailscale (and the LAN fallback from Phase 1).<\/p>\n\n\n\n In NPM’s admin UI: Proxy Hosts \u2192 Add Proxy Host<\/strong> \u2014 domain name, forward to the Nextcloud Apache container on port The full, final rule set looks like this:<\/p>\n\n\n\n 05<\/p>\n\n\n\n The same two-step pattern for every new laptop, phone, or WSL environment that needs to administer the box.<\/p>\n\n\n\n Note<\/p>\n\n\n\n A brand-new device can never authorize itself \u2014 step 3 always requires bootstrapping from an existing trusted session. There is no password fallback to fall back on once this is set up, by design.<\/p>\n\n\n\n 06<\/p>\n\n\n\n The repeatable recipe for getting a large personal archive onto the Nextcloud data drive without going through the (much slower) WebDAV\/web upload path.<\/p>\n\n\n\n Nextcloud’s own files are owned by Run from whichever machine actually holds the source files, over SSH to the server:<\/p>\n\n\n\n Why these flags<\/p>\n\n\n\n A non-root SSH user can’t It’s safe to re-run the exact same command if a transfer is interrupted \u2014 already-copied files are skipped on the size\/mtime check, so only the gap gets retried.<\/p>\n\n\n\n Gotcha<\/p>\n\n\n\n Unicode normalization.<\/strong> Some sources (old phone exports especially) produce filenames using decomposed Unicode (NFD) \u2014 accented\/diacritic characters stored as separate combining marks. Nextcloud’s scanner silently refuses to register these (“incompatible encoding”). Fix in bulk with a short walk that renames anything not already in NFC form:<\/p>\n\n\n\n Filename length.<\/strong> ext4 caps individual filenames at 255 bytes<\/em>, not characters \u2014 a long title in a multi-byte script (Arabic, CJK, etc.) can exceed that well before it looks long. Rename to something shorter before copying; there’s no way around the filesystem limit.<\/p>\n\n\n\n Nextcloud never watches the filesystem for out-of-band changes \u2014 anything copied in directly is invisible until this scan runs. The scan report’s 07<\/p>\n\n\n\n A whole family of independent WordPress installs, each with its own database, reachable at their own path under one domain and one certificate \u2014 a landing page with cards, not a folder of subdomains.<\/p>\n\n\n\n Two things make a normal WordPress container work correctly under Generate the two passwords into Every site is one Custom Location<\/strong> on the single existing proxy host \u2014 not a new proxy host each time. Gotcha<\/p>\n\n\n\n Nginx resolves upstream hostnames at save time<\/em>, not lazily \u2014 if the target container isn’t already up and running on the shared network, saving fails with a bare “Internal error” and no useful detail in the UI. Always If a save ever does stick in that broken state, it’s fixable directly \u2014 NPM stores each proxy host’s custom locations as a JSON column, and the on-disk nginx config is just a generated file:<\/p>\n\n\n\n No database, no Apache alias trick \u2014 just a bind-mounted folder behind nginx:<\/p>\n\n\n\n If it’s built by a static-site generator, set its base\/public-path build option to Plain static HTML, one card per site, no build step \u2014 edit and the change is live on next request:<\/p>\n\n\n\n 08<\/p>\n\n\n\n The same picture as the top, expanded to show every layer that’s actually running \u2014 Docker as its own boundary, Portainer managing it, DuckDNS as a real component rather than a footnote. Then the same map again with the exact configuration behind each box.<\/p>\n\n\n\n ubuntu-serverDocker EngineInternetRouterforwards 80\/443 only80\/443DuckDNSahaddad \u00b7 ahaddad-wpresolves toNginx Proxy Mgr:80 \/ :443 public\ud83d\udd12 :81 adminforwardedPortainermanages this layer\ud83d\udd12 :9443docker.sockNextcloud AIO10 containersexternal-drive datadir\ud83d\udd12 :8080 \/ :8443Apache 127.0.0.1:1100by domainWordPresslanding + 2 siteseach own MariaDBno public admin portby pathSSH :22 \u2014 OS-level, not containerized\ud83d\udd12 tailscale + LAN fallback onlyTailscale deviceslaptop \u00b7 phone \u00b7 WSL \u00b7 \u2026direct to every \ud83d\udd12 portpublic pathcontrol \/ DNStailnet-onlyEverything left of the “ubuntu-server” boundary is off-box. DuckDNS isn’t in the traffic path itself \u2014 a systemd timer on the server pushes its current public IP to DuckDNS every 5 minutes, and that’s what browsers resolve against before ever reaching the router. Inside the server, everything except SSH runs as a Docker container, and Portainer (also a container) manages that entire layer through the Docker socket rather than through any of the app-level routing.<\/p>\n\n\n\n Same map, with the exact address, port, and access method behind each piece.<\/p>\n\n\n\n DuckDNSHostsahaddad.duckdns.org, ahaddad-wp.duckdns.orgResolves to178.153.184.130 (dynamic)Kept current byduckdns.timer, every 5 minScript~\/duckdns\/duck.sh<\/p>\n\n\n\n RouterWAN178.153.184.130 (dynamic)Forwards80\/tcp, 443\/tcp \u2192 192.168.100.13Everything elsenot forwarded<\/p>\n\n\n\n SSH\ud83d\udd12 restrictedPort22\/tcpAuthkey-only (PasswordAuthentication no)Allowed fromtailscale0 (anywhere) + 192.168.100.0\/24Config\/etc\/ssh\/sshd_config.d\/10-hardening.conf<\/p>\n\n\n\n npm\ud83d\udd12 :81Imagejc21\/nginx-proxy-manager:latestNetworknextcloud-aio \u00b7 172.18.0.12Public0.0.0.0:80, 0.0.0.0:443Admin100.111.255.36:81Host 1ahaddad.duckdns.org \u2192 nextcloud-aio-apache:1100Host 2ahaddad-wp.duckdns.org \u2192 landing:80, + \/my\/mylogbook, \/my\/mylearning<\/p>\n\n\n\n portainer\ud83d\udd12 :9443Imageportainer\/portainer-ce:latestNetworkportainer_default \u00b7 172.21.0.2Admin100.111.255.36:9443Mounts\/var\/run\/docker.sock (rw) \u2014 manages every container on the host<\/p>\n\n\n\n mastercontainer\ud83d\udd12 :8080\/:8443IP172.18.0.2Admin100.111.255.36:8080, :8443Roleowns docker.sock (ro), manages the other 9 AIO containers<\/p>\n\n\n\n apacheIP172.18.0.11Reached by NPMvia docker network, port 1100Host mapping127.0.0.1:1100 (local debug only)<\/p>\n\n\n\n nextcloud (app)IP172.18.0.10Port9000, internal only<\/p>\n\n\n\n database (postgres)IP172.18.0.7Port5432, internal only<\/p>\n\n\n\n redisIP172.18.0.8Port6379, internal only<\/p>\n\n\n\n talkIP172.18.0.4Public0.0.0.0:3478 tcp+udp (TURN\/STUN)<\/p>\n\n\n\n imaginary \u00b7 notify-push \u00b7 whiteboard \u00b7 euroofficeIPs172.18.0.9, .5, .6, .3Portsinternal only, no host mapping<\/p>\n\n\n\n data directoryHost path\/mnt\/nextcloud_dataDeviceexternal drive, ext4, fstab + nofail<\/p>\n\n\n\n wp-landingImagenginx:alpineIP172.18.0.14 (nextcloud-aio)Serves\/ and \/my static cards pages<\/p>\n\n\n\n wordpress-mylogbook (+ db)IP172.18.0.13 (nextcloud-aio) + own “internal” netDBwordpress-mylogbook-db, mariadb:11, internal-only netPath\/my\/mylogbook<\/p>\n\n\n\n wordpress-mylearning (+ db)IP172.18.0.15 (nextcloud-aio) + own “internal” netDBwordpress-mylearning-db, mariadb:11, internal-only netPath\/my\/mylearning<\/p>\n\n\n\n A<\/p>\n\n\n\n Where things live, for whoever’s grepping this at 2am.<\/p>\n\n\n\n Written from the box’s actual running configuration, not from memory of how it was set up \u2014 every command here was cross-checked against what’s live. Placeholders like <slug> and <tailscale-ip> stand in for values specific to your own build.<\/p>\n\n\n\n
Go to https:\/\/tailscale.com\/download\/windows, download and run the installer, then sign in \u2014 use the exact same account you just used for the server (so both devices land on the same private network).<\/p>\n\n\n\n
Once Tailscale shows “Connected” on Windows, open a new terminal window and try:
ssh ahmad@100.111.255.36
This should log you in exactly like your normal SSH does now, but over the private Tailscale network instead of your LAN\/router.<\/p>\n\n\n\n\n
ssh ahmad@100.111.255.36<\/p>\n\n\n\n
<\/p>\n\n\n\n
The authenticity of host ‘100.111.255.36 (100.111.255.36)’ can’t be established.
ED25519 key fingerprint is SHA256:WdlP1s8Qd+ulZURsIhu3CJSeQ5gaB3s6AitTln2v4qg.
This host key is known by the following other names\/addresses:
C:\\Users\\ahmad\/.ssh\/known_hosts:2: 192.168.100.13
Are you sure you want to continue connecting (yes\/no\/[fingerprint])? yes
Warning: Permanently added ‘100.111.255.36’ (ED25519) to the list of known hosts.
Connection closed by 100.111.255.36 port 22
PS C:\\WINDOWS\\system32><\/p>\n\n\n\n![\"\"](\"https:\/\/ahaddad-wp.duckdns.org\/my\/mylogbook\/wp-content\/uploads\/2026\/08\/image-1024x550.png\")
<\/figure>\n\n\n\n
ssh-keygen -t ed25519 -C “ahmad-windows-pc”
It’ll ask two things:<\/p>\n\n\n\n\n
type $env:USERPROFILE.ssh\\id_ed25519.pub
Paste the full line it prints back here (it’ll start with ssh-ed25519 AAAA\u2026).<\/p>\n\n\n\n
\n\n\n\nNginx Account:<\/h2>\n\n\n\n
\n\n\n\n
\n\n\n\nBest tools to use for copying media files in bulk byt fast and safe<\/h2>\n\n\n\n
\n
\n
\n
\n
sudo apt update && sudo apt install -y rsync
(It’ll ask for the password of whatever Linux user you set up when you first used WSL \u2014 not your Windows password.)<\/p>\n\n\n\n
ssh-keygen -t ed25519 -C “ahmad-wsl”
Enter for the default location, Enter twice for no passphrase (same as before).<\/p>\n\n\n\n
cat ~\/.ssh\/id_ed25519.pub
Paste that line back here and I’ll authorize it on the server \u2014 then we’ll test the connection and go find your media drives from inside WSL.<\/p>\n\n\n\n
523,627,223 100% 10.33MB\/s 0:00:48 (xfr#79, to-chk=0\/81)
ahmad@my7400:\/mnt\/c\/WINDOWS\/system32$<\/p>\n\n\n\n\n
rsync -a –info=progress2 –partial -e ssh “\/mnt\/e\/Family & Friends\/” “ahmad@100.111.255.36:\/mnt\/nextcloud_data\/admin\/files\/Family & Friends\/”<\/li>\n<\/ol>\n\n\n\n
\n\n\n\n\n
\n\n\n\nThe Complete md setup-guide<\/h2>\n\n\n\n
From bare metal to three hosted services<\/h1>\n\n\n\n
\n
Base OS & access<\/h2>\n\n\n\n
Install Ubuntu Server<\/h3>\n\n\n\n
Lock SSH to key-only<\/h3>\n\n\n\n
~\/.ssh\/authorized_keys<\/code> during first login (cloud-init images often force password auth on until you turn it off), then override it explicitly:<\/p>\n\n\n\n# \/etc\/ssh\/sshd_config.d\/10-hardening.conf\nPasswordAuthentication no<\/code><\/pre>\n\n\n\nsudo systemctl reload sshd<\/code> after confirming key-based login works in a second<\/em> terminal \u2014 don’t close the first one until the second one succeeds.<\/p>\n\n\n\nInstall Tailscale on the server<\/h3>\n\n\n\n
curl -fsSL https:\/\/tailscale.com\/install.sh | sh\nsudo tailscale up<\/code><\/pre>\n\n\n\n100.x.x.x<\/code>) \u2014 every later step that binds an admin port does so against this address specifically, never 0.0.0.0<\/code>.<\/p>\n\n\n\nFirewall baseline<\/h3>\n\n\n\n
sudo ufw default deny incoming\nsudo ufw default allow outgoing\nsudo ufw allow in on tailscale0 comment 'Trust all Tailscale traffic'\nsudo ufw allow 41641\/udp comment 'Tailscale direct connections'\nsudo ufw allow from 192.168.100.0\/24 to any port 22 comment 'LAN SSH fallback'\nsudo ufw enable<\/code><\/pre>\n\n\n\nStorage<\/h2>\n\n\n\n
Mount the external drive<\/h3>\n\n\n\n
sudo blkid<\/code>, then add a stable fstab<\/code> entry:<\/p>\n\n\n\n# \/etc\/fstab\nUUID=<drive-uuid> \/mnt\/nextcloud_data ext4 defaults,noatime,nofail 0 2<\/code><\/pre>\n\n\n\nnofail<\/code> matters \u2014 without it, a missing external drive at boot can hang the whole system waiting on the mount.<\/p>\n\n\n\nsudo mkdir -p \/mnt\/nextcloud_data\nsudo mount -a<\/code><\/pre>\n\n\n\nGroup convention for shared write access<\/h3>\n\n\n\n
www-data<\/code> inside the container, which maps to a real www-data<\/code> user\/group on the host. Add your own user to that group up front, so you can write into Nextcloud-owned directories over SSH later without a permissions fight:<\/p>\n\n\n\nsudo usermod -aG www-data $USER\n# log out and back in (or open a fresh SSH session) for it to take effect<\/code><\/pre>\n\n\n\nDocker & Nextcloud AIO<\/h2>\n\n\n\n
Install Docker Engine<\/h3>\n\n\n\n
curl -fsSL https:\/\/get.docker.com | sh\nsudo usermod -aG docker $USER\n# reconnect for the group to apply<\/code><\/pre>\n\n\n\nRun the AIO mastercontainer<\/h3>\n\n\n\n
NEXTCLOUD_DATADIR<\/code> points at the external drive, and the web-admin ports (8080<\/code>\/8443<\/code>) bind to the Tailscale IP only, never the public interface.<\/p>\n\n\n\nsudo docker run \\\n --sig-proxy=false \\\n --name nextcloud-aio-mastercontainer \\\n --restart always \\\n --publish <tailscale-ip>:8080:8080 \\\n --publish <tailscale-ip>:8443:8443 \\\n --env APACHE_PORT=1100 \\\n --env NEXTCLOUD_DATADIR=\/mnt\/nextcloud_data \\\n --volume nextcloud_aio_mastercontainer:\/mnt\/docker-aio-config \\\n --volume \/var\/run\/docker.sock:\/var\/run\/docker.sock:ro \\\n nextcloud\/all-in-one:latest<\/code><\/pre>\n\n\n\nAPACHE_PORT=1100<\/code> matters: it moves the internal Apache container off port 80, freeing that port for the reverse proxy set up in the next phase \u2014 Apache stays bound to 127.0.0.1<\/code> only and is never reached directly.<\/p>\n\n\n\nComplete setup over Tailscale<\/h3>\n\n\n\n
https:\/\/<tailscale-ip>:8443<\/code> and follow AIO’s own wizard (it issues itself a self-signed cert for this step \u2014 that warning is expected). It will pull and start the rest of the stack: the Nextcloud app container, Postgres, Redis, image processing, Talk, etc.<\/p>\n\n\n\nInstall Portainer (Docker management UI)<\/h3>\n\n\n\n
# ~\/docker\/portainer\/docker-compose.yml\nservices:\n portainer:\n image: portainer\/portainer-ce:latest\n container_name: portainer\n restart: always\n ports:\n - \"<tailscale-ip>:9443:9443\"\n volumes:\n - \/var\/run\/docker.sock:\/var\/run\/docker.sock\n - .\/data:\/data<\/code><\/pre>\n\n\n\ncd ~\/docker\/portainer && docker compose up -d<\/code><\/pre>\n\n\n\ndocker restart portainer<\/code> resets the timer.<\/p>\n\n\n\ndocker logs portainer 2>&1 | grep setup_token<\/code><\/pre>\n\n\n\nReverse proxy & public access<\/h2>\n\n\n\n
Run Nginx Proxy Manager<\/h3>\n\n\n\n
# ~\/docker\/npm\/docker-compose.yml\nservices:\n npm:\n image: 'jc21\/nginx-proxy-manager:latest'\n container_name: npm\n restart: always\n ports:\n - '80:80'\n - '443:443'\n - '<tailscale-ip>:81:81'\n volumes:\n - .\/data:\/data\n - .\/letsencrypt:\/etc\/letsencrypt\n networks:\n - nextcloud-aio\n\nnetworks:\n nextcloud-aio:\n external: true<\/code><\/pre>\n\n\n\ncd ~\/docker\/npm && docker compose up -d<\/code><\/pre>\n\n\n\n81<\/code>) is bound to the Tailscale IP the same way AIO’s is \u2014 the reverse proxy that fronts the public internet is itself only administrable privately.<\/p>\n\n\n\nDynamic DNS<\/h3>\n\n\n\n
# ~\/duckdns\/duck.sh\necho url=\"https:\/\/www.duckdns.org\/update?domains=<yourname>&token=<your-token>&ip=\" \\\n | curl -o ~\/duckdns\/duck.log -K -<\/code><\/pre>\n\n\n\n# \/etc\/systemd\/system\/duckdns.service\n[Unit]\nDescription=Update DuckDNS IP address\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=oneshot\nUser=<you>\nExecStart=\/home\/<you>\/duckdns\/duck.sh\n\n# \/etc\/systemd\/system\/duckdns.timer\n[Unit]\nDescription=Run DuckDNS update every 5 minutes\n\n[Timer]\nOnBootSec=1min\nOnUnitActiveSec=5min\nPersistent=true\n\n[Install]\nWantedBy=timers.target<\/code><\/pre>\n\n\n\nchmod 700 ~\/duckdns\/duck.sh\nsudo systemctl enable --now duckdns.timer<\/code><\/pre>\n\n\n\nRouter port forward<\/h3>\n\n\n\n
Proxy host + certificate<\/h3>\n\n\n\n
1100<\/code>, then on the SSL tab request a new Let’s Encrypt certificate and force SSL. NPM handles renewal automatically from there.<\/p>\n\n\n\nOpen the firewall for real traffic<\/h3>\n\n\n\n
sudo ufw allow 80\/tcp\nsudo ufw allow 443\/tcp<\/code><\/pre>\n\n\n\nRule<\/th> Purpose<\/th><\/tr> tailscale0<\/code> \u2192 allow all<\/td>Every private admin surface<\/td><\/tr> 41641\/udp<\/code> \u2192 allow<\/td>Tailscale direct (NAT-traversed) connections<\/td><\/tr> 22\/tcp<\/code> from LAN subnet \u2192 allow<\/td>SSH fallback if Tailscale is down<\/td><\/tr> 80\/tcp<\/code>, 443\/tcp<\/code> \u2192 allow<\/td>Public HTTP\/HTTPS, handled entirely by NPM<\/td><\/tr> everything else \u2192 deny<\/td> Default posture<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Adding client devices<\/h2>\n\n\n\n
\n
ssh-keygen -t ed25519 -C \"device-name\"<\/code>) \u2014 never reuse one key across devices.<\/li>\n\n\n\n~\/.ssh\/authorized_keys<\/code>.<\/li>\n<\/ol>\n\n\n\nBulk media import<\/h2>\n\n\n\n
Open up write access first<\/h3>\n\n\n\n
www-data<\/code> with the setgid bit set, so new files created underneath inherit the right group \u2014 but pre-existing top-level folders may not have group-write set. Fix the destination folder before copying into it:<\/p>\n\n\n\nsudo chmod g+w \"\/mnt\/nextcloud_data\/admin\/files\/<target folder>\"<\/code><\/pre>\n\n\n\nCopy in with rsync, not the web UI<\/h3>\n\n\n\n
rsync -a --no-owner --no-group --no-perms --omit-dir-times \\\n --partial --info=progress2 \\\n --exclude 'Thumbs.db' --exclude 'desktop.ini' \\\n --exclude 'System Volume Information' --exclude '$RECYCLE.BIN' \\\n -e ssh \\\n \"\/path\/to\/source\/\" \\\n \"user@<tailscale-ip>:\/mnt\/nextcloud_data\/admin\/files\/<target folder>\/\"<\/code><\/pre>\n\n\n\nchown<\/code>\/chgrp<\/code>\/set arbitrary timestamps on files it doesn’t own \u2014 and some destination folders are pre-existing and owned by www-data<\/code>, not the connecting user. Skipping ownership\/permission\/dir-time preservation avoids a wall of harmless-but-noisy errors on every such folder; ownership gets fixed in bulk afterward instead.<\/p>\n\n\n\nTwo filesystem limits worth knowing before they surprise you<\/h3>\n\n\n\n
python3 -c \"\nimport os, unicodedata\nfor dirpath, dirnames, filenames in os.walk('<path>', topdown=False):\n for name in filenames + dirnames:\n nfc = unicodedata.normalize('NFC', name)\n if nfc != name:\n os.rename(os.path.join(dirpath, name), os.path.join(dirpath, nfc))\n\"<\/code><\/pre>\n\n\n\nFix ownership, then register with Nextcloud<\/h3>\n\n\n\n
sudo chown -R www-data:www-data \"\/mnt\/nextcloud_data\/admin\/files\/<target folder>\"\ndocker exec --user www-data nextcloud-aio-nextcloud php occ files:scan \\\n --path=\"admin\/files\/<target folder>\"<\/code><\/pre>\n\n\n\nErrors<\/code> column should read 0<\/code>; anything else is almost always one of the two gotchas above.<\/p>\n\n\n\nWordPress hosting<\/h2>\n\n\n\n
The shape of it<\/h3>\n\n\n\n
ahaddad-wp.duckdns.org\/<\/code> is a static cards page (its own tiny nginx:alpine<\/code> container, no database). \/my<\/code> is another static cards page, one level down. \/my\/mylogbook<\/code> and \/my\/mylearning<\/code> are full, independent WordPress installs \u2014 separate containers, separate MariaDB instances, sharing nothing but the domain and the reverse proxy in front of them. New sites, static or WordPress, slot into the same pattern at any depth.<\/p>\n\n\n\nA WordPress install that knows it lives in a subpath<\/h3>\n\n\n\n
\/my\/<slug><\/code> instead of a domain root: telling WordPress its real URL, and telling Apache to serve that path from its normal document root via an alias.<\/p>\n\n\n\n# apache-subpath.conf\nAlias \/my\/<slug> \/var\/www\/html\n<Directory \/var\/www\/html>\n AllowOverride All\n Require all granted\n<\/Directory><\/code><\/pre>\n\n\n\n# docker-compose.yml\nservices:\n wordpress:\n image: wordpress:latest\n container_name: wordpress-<slug>\n restart: always\n environment:\n WORDPRESS_DB_HOST: wordpress-<slug>-db\n WORDPRESS_DB_NAME: wordpress\n WORDPRESS_DB_USER: wordpress\n WORDPRESS_DB_PASSWORD: ${WORDPRESS_DB_PASSWORD}\n WORDPRESS_CONFIG_EXTRA: |\n define('WP_HOME','https:\/\/ahaddad-wp.duckdns.org\/my\/<slug>');\n define('WP_SITEURL','https:\/\/ahaddad-wp.duckdns.org\/my\/<slug>');\n volumes:\n - .\/wp-content:\/var\/www\/html\/wp-content\n - .\/apache-subpath.conf:\/etc\/apache2\/conf-enabled\/subpath.conf:ro\n networks: [internal, nextcloud-aio]\n depends_on: [db]\n\n db:\n image: mariadb:11\n container_name: wordpress-<slug>-db\n restart: always\n environment:\n MYSQL_DATABASE: wordpress\n MYSQL_USER: wordpress\n MYSQL_PASSWORD: ${WORDPRESS_DB_PASSWORD}\n MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}\n volumes: [.\/db-data:\/var\/lib\/mysql]\n networks: [internal]\n\nnetworks:\n internal:\n nextcloud-aio:\n external: true<\/code><\/pre>\n\n\n\n.env<\/code> before starting it \u2014 never hard-code them into the compose file itself:<\/p>\n\n\n\nopenssl rand -base64 24 | tr -d '\/+=' | head -c 32 # run twice, once per secret<\/code><\/pre>\n\n\n\nRoute it in NPM<\/h3>\n\n\n\n
Proxy Hosts \u2192 ahaddad-wp.duckdns.org \u2192 Edit \u2192 Custom Locations \u2192 Add location<\/code>: path \/my\/<slug><\/code>, forward to wordpress-<slug><\/code> on port 80<\/code>.<\/p>\n\n\n\ndocker compose up -d<\/code> the new site first, confirm it’s reachable (docker exec npm curl -s -o \/dev\/null -w '%{http_code}' http:\/\/wordpress-<slug>:80\/my\/<slug>\/<\/code>), then<\/em> add the NPM location.<\/p>\n\n\n\nsudo sqlite3 ~\/docker\/npm\/data\/database.sqlite \\\n \"SELECT locations FROM proxy_host WHERE id=<id>;\"\n# edit the JSON, then write it back:\nsudo sqlite3 ~\/docker\/npm\/data\/database.sqlite \\\n \"UPDATE proxy_host SET locations='<corrected json>' WHERE id=<id>;\"\ndocker exec npm nginx -t # must say \"test is successful\"\ndocker exec npm nginx -s reload<\/code><\/pre>\n\n\n\nStatic sites, the lighter version<\/h3>\n\n\n\n
services:\n site:\n image: nginx:alpine\n container_name: wp-<slug>\n restart: always\n volumes: [.\/html:\/usr\/share\/nginx\/html:ro]\n networks: [nextcloud-aio]\n\nnetworks:\n nextcloud-aio:\n external: true<\/code><\/pre>\n\n\n\n\/my\/<slug><\/code> so its own internal links resolve correctly \u2014 the build-time equivalent of WP_HOME<\/code>.<\/p>\n\n\n\nThe landing pages<\/h3>\n\n\n\n
<a class=\"card\" href=\"\/my\/<slug>\">\n <h2>Display name<\/h2>\n <p>Short description<\/p>\n<\/a><\/code><\/pre>\n\n\n\nFull system map<\/h2>\n\n\n\n
Layout<\/h3>\n\n\n\n
Every box, labeled<\/h3>\n\n\n\n
Edge & DNS \u2014 not containers, OS\/network level<\/h4>\n\n\n\n
Reverse proxy & management<\/h4>\n\n\n\n
Nextcloud AIO stack \u2014 network: nextcloud-aio (172.18.0.0\/16)<\/h4>\n\n\n\n
WordPress stack<\/h4>\n\n\n\n
Appendix<\/h2>\n\n\n\n
Path<\/th> What<\/th><\/tr> \/mnt\/nextcloud_data<\/code><\/td>External drive, all Nextcloud user data<\/td><\/tr> ~\/docker\/npm\/<\/code><\/td>Nginx Proxy Manager compose + data + certs<\/td><\/tr> ~\/docker\/wp-landing\/<\/code><\/td>Static cards pages (root and each sub-hub)<\/td><\/tr> ~\/docker\/wp-<slug>\/<\/code><\/td>One directory per WordPress\/static site, fully independent<\/td><\/tr> ~\/docker\/portainer\/<\/code><\/td>Portainer compose + data \u2014 Docker management UI, Tailscale-only<\/td><\/tr> ~\/docker\/ADDING-A-SITE.md<\/code><\/td>Living step-by-step for the next new site<\/td><\/tr> ~\/duckdns\/duck.sh<\/code><\/td>Dynamic DNS updater, run by duckdns.timer<\/code><\/td><\/tr>\/etc\/ssh\/sshd_config.d\/10-hardening.conf<\/code><\/td>Key-only SSH override<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Quick health check, any time<\/h3>\n\n\n\n
docker ps --format \"table {{.Names}}\\t{{.Status}}\"\nsudo ufw status verbose\ntailscale status\ndocker exec npm nginx -t<\/code><\/pre>\n\n\n\n
\n\n\n\nPortainer<\/h2>\n\n\n\n