Self-hosted portfolio on a Linux VPS

Rather than publishing my portfolio on a turnkey hosting service, I chose to administer it myself: it is the job I am training for, so I might as well show it. The site you are reading runs on an Ubuntu VPS I manage end to end, from DNS to backups.

Infrastructure

• An Ubuntu Server VPS shared with two other applications; the portfolio was added without changing anything already running on it.
• Application and database in Docker containers on an isolated network: no database is reachable from outside.
• NGINX as a reverse proxy, with Let's Encrypt certificates renewed automatically.
• Domain names and DNS zone managed at OVH: main domain, www, an analytics subdomain and a second domain redirecting to the first.

Security

• SSH by key only on a non-standard port, root login disabled, UFW firewall and fail2ban.
• A dedicated system user for the portfolio, with no administrative rights: it grants no access to the other applications on the server.
• Strict HTTP headers and a content security policy: A+ rating on both securityheaders.com and Mozilla Observatory.
• Two-factor authentication on the site's admin area.

Day-to-day operations

• Encrypted backup every night (database and files), automatically pulled to my own machine, with a restore that has actually been tested.
• External monitoring of availability and certificate expiry.
• Automated deployment: merging into the main branch builds the image, publishes it and puts it live, with a health check and automatic rollback on failure.
• Self-hosted, cookie-free analytics, GDPR compliant.

The site itself

Built with Next.js and TypeScript, bilingual French-English, with an admin interface that lets me edit every piece of content without touching the code.