Complete procedures with a way back.

Build a routed full-tunnel OpenVPN service with Easy-RSA, an owned nftables policy, a tested encrypted client profile, and rehearsed certificate revocation.

Create a minimal routed WireGuard VPN with protected keys, explicit peers, constrained forwarding, and peer removal.

Install from Docker's signed repository, limit daemon exposure, bound logs, and document privilege boundaries.

Build a single-control-plane Kubernetes cluster with containerd, an explicit Pod network, a joined worker, verification, and a complete reset path.

Create a named administrator, prove key-based recovery access, patch the host, restrict SSH, enable a host firewall, and verify time and exposed services.

Install MySQL, remove unsafe defaults, create a least-privilege application database, optionally allow restricted TLS network access, and prove backup readiness.

Install PostgreSQL, create a least-privilege role and database, optionally enable restricted TLS network access, validate authentication order, and prove recovery readiness.