Deployment platform · wiki

Aaron

A single-node deployment platform. This repository is the wiki and source of truth for taking a bare Hostinger VPS all the way to git-push-to-deploy — hardened, private-by-default, and fully reproducible.

github.com/spheriax/aaron

          internet ──▶  Traefik :80/:443  ──▶  example.com  (public site)
                              │
   tailnet ──▶  dokploy.aaron.cloud / SSH   (management, Tailscale-only)
                              │
   git push ──▶  deploy.aaron.cloud/api/deploy  ──▶  Dokploy  ──▶  container live

What's in the repo

Six topic folders, each a README that doubles as a wiki page — read top to bottom to build the platform from zero.

🖥️ Hostinger VPS

Provisioning the machine, first boot, hostname and base packages.

vps/

🛡️ Hardening & firewall

Non-root user, key-only SSH, UFW, Fail2ban, automatic updates — and making SSH tailnet-only.

hardening/

🔗 Tailscale & SSH

Mesh VPN, keyless Tailscale SSH, MagicDNS and ACLs so all management rides the tailnet.

tailscale/

🚀 Dokploy

The deploy platform: install, CI/CD flow, the public-webhook fix, and UI hardening.

dokploy/

🚦 Traefik

Reverse proxy, automatic wildcard TLS via DNS-01, and the tailnet-only middleware. Includes config files.

traefik/

🐙 GitHub integration

GitHub App, per-repo access, and auto-deploy so a push to main ships automatically.

github/

Hostinger VPS Ubuntu UFW · Fail2ban Tailscale SSH Dokploy Traefik Let's Encrypt DNS-01 GitHub auto-deploy

Request access

The repository is private. Fill this in and we'll add you — it opens a pre-filled email, no account needed.

This opens an email to the repo owner. Prefer to ask directly? Email spheriax@gmail.com.