Complete procedures with a way back.

Build a routed full-tunnel OpenVPN service with Easy-RSA, an owned nftables policy, a tested encrypted client profile, and rehearsed certificate revocation.

Create a minimal routed WireGuard VPN with protected keys, explicit peers, constrained forwarding, and peer removal.

Introduce per-user keys, validate a drop-in, test a second session, and only then disable password and root login.

Create a default-deny host firewall with loopback, established traffic, controlled SSH, service ports, logging, validation, and rollback.

Proxy an HTTP application through Nginx, preserve client metadata, obtain a certificate, and test renewal.

Install from Docker's signed repository, limit daemon exposure, bound logs, and document privilege boundaries.

Create a consistent logical backup, restore it into isolation, verify representative data, and retain evidence.

Produce a custom-format pg_dump, restore into isolation, compare invariants, and retain recovery evidence.

Use a dedicated SSH identity, dry-run transfers, build hard-linked snapshots, enforce retention, and test restore.

Install Node Exporter as a locked-down service, restrict metrics, add Prometheus, and verify Grafana.

Use local jail overrides, verify filters against real logs, test bans safely, and retain an unban path.

Use a dedicated identity, explicit paths, bounded restarts, sandboxing, logs, and a verified rollback.

Build a single-control-plane Kubernetes cluster with containerd, an explicit Pod network, a joined worker, verification, and a complete reset path.

Create a named administrator, prove key-based recovery access, patch the host, restrict SSH, enable a host firewall, and verify time and exposed services.

Package a small web service with a non-root image, healthchecks, an internal data network, persistent storage, reproducible configuration, backup, update, and rollback.

Install MySQL, remove unsafe defaults, create a least-privilege application database, optionally allow restricted TLS network access, and prove backup readiness.

Install PostgreSQL, create a least-privilege role and database, optionally enable restricted TLS network access, validate authentication order, and prove recovery readiness.