From 05001b9c89d696bb85775363f69f399abc532889 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Waldson=20Patr=C3=ADcio?= Date: Thu, 23 Jul 2026 13:21:24 -0300 Subject: [PATCH] [001] Document droplet groundwork: swap, firewall, DNS --- README.md | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/README.md b/README.md index 5cd300b..3896d78 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,78 @@ Bring the proxy up (or recreate it after a compose change) from that directory: docker compose up -d ``` +## Droplet groundwork + +Baseline host configuration for the droplet (`wloud`, 174.138.36.232, +2 GB RAM, 2 vCPUs, 58 GB disk). Everything below was set up once and only +needs revisiting when the host changes. + +### Swap + +The droplet has 2 GB RAM and no swap by default; a 2 GB swapfile prevents +Out Of Memory (OOM) kills during on-droplet builds and daemon memory spikes. +It is created once with (requires sudo): + +```sh +sudo fallocate -l 2G /swapfile +sudo chmod 600 /swapfile +sudo mkswap /swapfile +sudo swapon /swapfile +echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab +echo 'vm.swappiness=10' | sudo tee /etc/sysctl.d/99-swappiness.conf +sudo sysctl -p /etc/sysctl.d/99-swappiness.conf +``` + +The fstab entry makes it survive reboots; swappiness 10 keeps the kernel from +swapping eagerly. Verify with `free -m` (~2048 total swap) and, after a +reboot, `swapon --show`. + +### Firewall + +`ufw` is installed and active on the host. Probing from outside the droplet +(2026-07-23) showed no filtering in the path for the service ports: 2222/tcp +and 22000/tcp answered "connection refused" while nothing listened, which +means packets reach the host, so neither ufw nor a DigitalOcean cloud +firewall blocks them. Ports in use: + +| Port | Proto | Service | +|-----------|---------|--------------------------------| +| 22 | tcp | host sshd | +| 80, 443 | tcp | Caddy (all HTTP/HTTPS traffic) | +| 2222 | tcp | Forgejo git-over-SSH | +| 22000 | tcp+udp | Syncthing sync protocol | + +If ufw rules are ever tightened, keep the four rows above allowed. To +re-verify reachability from any machine outside the droplet: + +```sh +nc -vz 174.138.36.232 2222 +nc -vz 174.138.36.232 22000 +nc -vzu 174.138.36.232 22000 +``` + +"Connection refused" means the port is reachable but nothing listens yet; +only a timeout indicates a filter. + +### DNS + +All records live on the DigitalOcean nameservers (ns1-3.digitalocean.com) +and point at the droplet: + +| Record | Type | Value | Serves | +|--------------------|------|-----------------|----------------------| +| waldson.com.br | A | 174.138.36.232 | personal site | +| www.waldson.com.br | A | 174.138.36.232 | redirect to apex | +| git.waldson.com.br | A | 174.138.36.232 | Forgejo | +| sync.waldson.com.br| A | 174.138.36.232 | Syncthing GUI | + +personaledson.com.br and nazareonline.com.br also resolve here for the +existing stacks. Check resolution with: + +```sh +dig +short waldson.com.br www.waldson.com.br git.waldson.com.br sync.waldson.com.br +``` + ## Notes - `letsencrypt/acme.json` is leftover state from an earlier Traefik-based proxy