Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Take a small long-running app and stand it up on a remote Linux host you reach only over SSH with key-based auth (no password login). Run it as a dedicated non-root service user under a systemd unit (enabled to start at boot, logs via journalctl, restart-on-failure), put it behind a firewall that exposes only the ports you need (ufw/firewalld/nftables), rotate its logs, and add a cron or timer-driven backup. Document how you'd diagnose it not coming back after a reboot. Everything reproducible; secrets never world-readable.
A correct unit file: runs as a non-root user, enabled at boot, Restart= set, logs reachable via journalctl -u.
Key-based auth only (password login disabled); a least-privilege service user; secret/key files are not world-readable.
Firewall exposes only required ports; can verify listeners with ss; understands the exposed surface.
Log rotation + scheduled backup in place; can articulate a systematic boot-failure diagnosis (status, journal, logs).
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# Deploy & harden a systemd-managed service over SSH ## Goal Take a small long-running app and stand it up on a remote Linux host you reach only over SSH with key-based auth (no password login). Run it as a dedicated non-root service user under a systemd unit (enabled to start at boot, logs via journalctl, restart-on-failure), put it behind a firewall that exposes only the ports you need (ufw/firewalld/nftables), rotate its logs, and add a cron or timer-driven backup. Document how you'd diagnose it not coming back after a reboot. Everything reproducible; secrets never world-readable. ## Acceptance criteria - [ ] systemd service: A correct unit file: runs as a non-root user, enabled at boot, Restart= set, logs reachable via journalctl -u. - [ ] SSH & access hardening: Key-based auth only (password login disabled); a least-privilege service user; secret/key files are not world-readable. - [ ] Networking & firewall: Firewall exposes only required ports; can verify listeners with ss; understands the exposed surface. - [ ] Operations & recovery: Log rotation + scheduled backup in place; can articulate a systematic boot-failure diagnosis (status, journal, logs). ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.