Services:Best Practices - Revision history

Josh: Updated documentation from markdown files

2026-05-16T14:04:34Z

Updated documentation from markdown files

← Older revision		Revision as of 14:04, 16 May 2026
Line 1:		Line 1:
	~~This document outlines best~~ practices when adding ~~new services~~ to the reverse proxy ~~system~~.		Best practices when adding hostnames to the Caddy reverse proxy.

	== General ~~Best Practices~~ ==		== General ==

	~~=== '''Always test configuration'''~~ before ~~reloading nginx ===~~		* Validate the Caddyfile before reload: <code>caddy validate --config /etc/caddy/Caddyfile</code>
	~~== '''Use descriptive subdomain names''' that indicate the service ==~~
	~~== '''Document your services''' in [Current Services](current~~-~~services.md) ==~~
	~~== '''Backup configurations''' before making changes ==~~
	~~== '''Monitor logs''' after adding new services ==~~
	~~== '''Use HTTPS''' for all public~~-~~facing services ==~~
	~~== '''Test thoroughly''' before marking service as complete ==~~

	~~== Checklist ==~~		* Use clear subdomain names and document them in [[Services:Current Services]]

	~~Use this checklist when adding a new service:~~		* Back up <code>/etc/caddy/Caddyfile</code> before changes

	* ~~[ ] DNS A record created and propagated~~		* Check <code>journalctl -u caddy</code> after adding a site

	* ~~[ ] Service running on Synology NAS~~		* Use HTTPS for all public services (Caddy handles certificates automatically)

	* ~~[ ] Service accessible from VPN network~~		* Test VPS backends with <code>curl</code> on <code>127.0.0.1</code> before testing the public URL

	* [ ] Nginx configuration file created		== Checklist ==

	* [ ] ~~Site enabled (symlink created)~~		* [ ] DNS A record points to <code>87.106.61.62</code>

	* [ ] ~~Nginx configuration tested~~ (<code>~~nginx -t~~</code>)		* [ ] Backend running and reachable from VPS (<code>127.0.0.1</code> or <code>10.8.0.2</code> via VPN)

	* [ ] ~~Nginx reloaded~~		* [ ] Site block added to <code>/etc/caddy/Caddyfile</code>

	* [ ] ~~HTTP access verified~~		* [ ] <code>caddy validate</code> succeeds

	* [ ] ~~SSL certificate obtained~~		* [ ] <code>systemctl reload caddy</code> completed

	* [ ] ~~HTTPS access verified~~		* [ ] <code>curl -I https://newservice.jb-vpn.uk</code> succeeds

	* [ ] Browser ~~testing completed~~		* [ ] Browser test with valid certificate

	* [ ] ~~Service documented in~~ [Current Services]~~(current-services.md)~~		* [ ] Entry added to [[Services:Current Services]]

	== Security ~~Considerations~~ ==		== Security ==

	* ~~Always use HTTPS for public~~-~~facing~~ services		* Prefer VPN-backed NAS services over exposing the NAS to the internet

	* ~~Keep SSL certificates up to date~~ (~~automatic renewal via Certbot~~)		* Restrict sensitive admin UIs where possible (e.g. phpMyAdmin basic auth in Caddyfile)

	* ~~Use strong authentication for services that require it~~		* Keep OpenVPN and VPS packages updated

	* Monitor access logs for unusual activity		== Related documentation ==

	~~== Related Documentation ==~~		* [Step By Step Step-by-Step Process]

	* [~~Step-by-Step Process~~]~~(step-by-step.md) - Setup process~~		* [Prerequisites Prerequisites]

	* [[Documentation:Index\|Troubleshooting]] - Common issues

	[[Category:Documentation]]		[[Category:Documentation]]
	[[Category:Documentation/Services]]		[[Category:Documentation/Services]]
	[[Category:Documentation/Services/Adding Services]]		[[Category:Documentation/Services/Adding Services]]

Josh: Content added - troubleshooting guide: Best Practices for Adding Services (11 sections)

2026-01-01T13:44:41Z

Content added - troubleshooting guide: Best Practices for Adding Services (11 sections)

← Older revision		Revision as of 13:44, 1 January 2026
Line 1:		Line 1:
	~~= Best Practices for Adding Services =~~

	This document outlines best practices when adding new services to the reverse proxy system.		This document outlines best practices when adding new services to the reverse proxy system.

	== General Best Practices ==		== General Best Practices ==

	= '''Always test configuration''' before reloading nginx =		=== '''Always test configuration''' before reloading nginx ===
	= '''Use descriptive subdomain names''' that indicate the service =		== '''Use descriptive subdomain names''' that indicate the service ==
	= '''Document your services''' in [Current Services](current-services.md) =		== '''Document your services''' in [Current Services](current-services.md) ==
	= '''Backup configurations''' before making changes =		== '''Backup configurations''' before making changes ==
	= '''Monitor logs''' after adding new services =		== '''Monitor logs''' after adding new services ==
	= '''Use HTTPS''' for all public-facing services =		== '''Use HTTPS''' for all public-facing services ==
	= '''Test thoroughly''' before marking service as complete =		== '''Test thoroughly''' before marking service as complete ==

	== Checklist ==		== Checklist ==

Josh: Minor update - troubleshooting guide: Best Practices for Adding Services (4 sections)

2026-01-01T13:28:17Z

Minor update - troubleshooting guide: Best Practices for Adding Services (4 sections)

← Older revision		Revision as of 13:28, 1 January 2026
Line 17:		Line 17:
	Use this checklist when adding a new service:		Use this checklist when adding a new service:

	'' [ ] DNS A record created and propagated		* [ ] DNS A record created and propagated
	'' [ ] Service running on Synology NAS
	'' [ ] Service accessible from VPN network		* [ ] Service running on Synology NAS
	'' [ ] Nginx configuration file created
	'' [ ] Site enabled (symlink created)		* [ ] Service accessible from VPN network
	'' [ ] Nginx configuration tested (<code>nginx -t</code>)
	'' [ ] Nginx reloaded		* [ ] Nginx configuration file created
	'' [ ] HTTP access verified
	'' [ ] SSL certificate obtained		* [ ] Site enabled (symlink created)
	'' [ ] HTTPS access verified
	'' [ ] Browser testing completed		* [ ] Nginx configuration tested (<code>nginx -t</code>)
	'' [ ] Service documented in [Current Services](current-services.md)
			* [ ] Nginx reloaded

			* [ ] HTTP access verified

			* [ ] SSL certificate obtained

			* [ ] HTTPS access verified

			* [ ] Browser testing completed

			* [ ] Service documented in [Current Services](current-services.md)

	== Security Considerations ==		== Security Considerations ==

	'' Always use HTTPS for public-facing services		* Always use HTTPS for public-facing services
	'' Keep SSL certificates up to date (automatic renewal via Certbot)
	'' Use strong authentication for services that require it		* Keep SSL certificates up to date (automatic renewal via Certbot)
	'' Monitor access logs for unusual activity
			* Use strong authentication for services that require it

			* Monitor access logs for unusual activity

	== Related Documentation ==		== Related Documentation ==

	'' [Step-by-Step Process](step-by-step.md) - Setup process		* [Step-by-Step Process](step-by-step.md) - Setup process
	'' [[Documentation:Index\|Troubleshooting]] - Common issues
			* [[Documentation:Index\|Troubleshooting]] - Common issues

	[[Category:Documentation]]		[[Category:Documentation]]
	[[Category:Documentation/Services]]		[[Category:Documentation/Services]]
	[[Category:Documentation/Services/Adding Services]]		[[Category:Documentation/Services/Adding Services]]

Josh: Added troubleshooting guide: Best Practices for Adding Services

2026-01-01T13:15:57Z

Added troubleshooting guide: Best Practices for Adding Services

New page

= Best Practices for Adding Services =

This document outlines best practices when adding new services to the reverse proxy system.

== General Best Practices ==

= '''Always test configuration''' before reloading nginx =
= '''Use descriptive subdomain names''' that indicate the service =
= '''Document your services''' in [Current Services](current-services.md) =
= '''Backup configurations''' before making changes =
= '''Monitor logs''' after adding new services =
= '''Use HTTPS''' for all public-facing services =
= '''Test thoroughly''' before marking service as complete =

== Checklist ==

Use this checklist when adding a new service:

'' [ ] DNS A record created and propagated
'' [ ] Service running on Synology NAS
'' [ ] Service accessible from VPN network
'' [ ] Nginx configuration file created
'' [ ] Site enabled (symlink created)
'' [ ] Nginx configuration tested (<code>nginx -t</code>)
'' [ ] Nginx reloaded
'' [ ] HTTP access verified
'' [ ] SSL certificate obtained
'' [ ] HTTPS access verified
'' [ ] Browser testing completed
'' [ ] Service documented in [Current Services](current-services.md)

== Security Considerations ==

'' Always use HTTPS for public-facing services
'' Keep SSL certificates up to date (automatic renewal via Certbot)
'' Use strong authentication for services that require it
'' Monitor access logs for unusual activity

== Related Documentation ==

'' [Step-by-Step Process](step-by-step.md) - Setup process
'' [[Documentation:Index|Troubleshooting]] - Common issues

[[Category:Documentation]]
[[Category:Documentation/Services]]
[[Category:Documentation/Services/Adding Services]]