Resources

Self-hosting pre-flight checklist

Run this before you point a domain at a new service. Every item on it is something I have personally skipped and regretted.

• Host has a static IP reservation (DHCP reservation or static config) — not a floating address.
• Every service has a named volume or a bind mount you could rebuild from.
• Backups run on a schedule and the last restore was tested, not assumed.
• Secrets live in .env files outside the git repo, permissions 600.
• One reverse proxy handles TLS; nothing is exposed on a raw port from outside.
• Uptime check is watching at least the reverse proxy, not just the containers.
• Updates are applied on a schedule you can name out loud.
• A note exists somewhere saying what runs where, for the day you are not around.

Docker Compose cheat sheet

The commands I actually type, in the order I usually need them.

# start / stop / rebuild one service
docker compose up -d app
docker compose restart app
docker compose up -d --build app

# what is actually running, and on which ports
docker compose ps
docker compose port app 8080

# why did it die
docker compose logs --tail=100 -f app

# get a shell inside the container (not the host)
docker compose exec app sh

# validate before you restart anything
docker compose config -q

# volumes: what is really on disk
docker volume ls
docker volume inspect app_data

# prune carefully: this list is what it will delete
docker system df
docker image prune -a --filter "until=168h"

3-2-1 backup worksheet

Fill this in for each thing you cannot re-download. If a row has a blank in the "last restore" column, you do not have a backup yet.