🚀 HNG DevOps Internship — Stage 0

A production-ready Linux server setup with Nginx, SSL, and hardened security — built from scratch on AWS EC2.

Live Site · API Endpoint · HNG Internship

---

📋 Table of Contents

• Overview
• Requirements
• Architecture
• Step-by-Step Setup
  • Phase 1: AWS EC2 Provisioning
  • Phase 2: Domain Setup with DuckDNS
  • Phase 3: Connect to Server
  • Phase 4: Create hngdevops User
  • Phase 5: SSH Key Setup
  • Phase 6: Harden SSH
  • Phase 7: Configure UFW Firewall
  • Phase 8: Install Nginx
  • Phase 9: Configure Nginx
  • Phase 10: SSL with Certbot
• Endpoints
• Security Checklist
• Verification
• Project Structure
• Author

---

🌍 Overview

This project fulfills the HNG Internship 14 — DevOps Track Stage 0 requirements. It involves provisioning a bare Linux server on AWS EC2, configuring Nginx to serve a static homepage and a JSON API endpoint, securing everything with a valid Let's Encrypt SSL certificate, and hardening the server with UFW firewall rules and SSH security best practices.

No Docker. No Compose. No automation tools — just a bare Linux server and raw configuration.

---

📌 Requirements

Requirement	Implementation
Linux Server	AWS EC2 — Ubuntu 22.04 LTS (t2.micro)
Non-root sudo user	hngdevops with sudo privileges
Passwordless sudo (restricted)	/usr/sbin/sshd and /usr/sbin/ufw only
Disable root SSH login	PermitRootLogin no in sshd_config
Key-based SSH only	PasswordAuthentication no in sshd_config
Firewall	UFW — ports 22, 80, 443 only
Web Server	Nginx
Static Homepage (GET /)	Serves HTML with HNG username visible
JSON API (GET /api)	Returns { message, track, username }
SSL Certificate	Let's Encrypt via Certbot
HTTP → HTTPS Redirect	301 Permanent Redirect

---

🏗️ Architecture

Internet
    │
    ▼
┌─────────────────────────────┐
│        AWS EC2 Instance      │
│       Ubuntu 22.04 LTS       │
│                             │
│  ┌───────────────────────┐  │
│  │        UFW            │  │
│  │  22 ✅ 80 ✅ 443 ✅   │  │
│  │  All others ❌        │  │
│  └──────────┬────────────┘  │
│             │               │
│  ┌──────────▼────────────┐  │
│  │        Nginx           │  │
│  │                       │  │
│  │  :80  → 301 → :443   │  │
│  │  :443 /     → HTML   │  │
│  │  :443 /api  → JSON   │  │
│  └──────────┬────────────┘  │
│             │               │
│  ┌──────────▼────────────┐  │
│  │   Let's Encrypt SSL   │  │
│  │   (Auto-renewing)     │  │
│  └───────────────────────┘  │
└─────────────────────────────┘
         │
         ▼
  DuckDNS Domain
  emmanuel-kabari.duckdns.org

---

🛠️ Step-by-Step Setup

Phase 1: AWS EC2 Provisioning

1. Log in to AWS Console
2. Navigate to EC2 → Instances → Launch Instances
3. Configure the instance:

Name:          hng-devops-stage0
AMI:           Ubuntu Server 22.04 LTS (Free Tier)
Instance Type: t2.micro
Key Pair:      Create new → hng-devops-key (RSA, .pem)

4. Configure Security Group inbound rules:

Type	Protocol	Port	Source
SSH	TCP	22	Anywhere (0.0.0.0/0)
HTTP	TCP	80	Anywhere (0.0.0.0/0)
HTTPS	TCP	443	Anywhere (0.0.0.0/0)

5. Click Launch Instance

6. Allocate an Elastic IP for a permanent public IP:

   • EC2 → Network & Security → Elastic IPs → Allocate
   • Actions → Associate → select your instance
   • Click Associate

---

Phase 2: Domain Setup with DuckDNS

1. Go to duckdns.org and log in
2. Create a subdomain (e.g. hng-yourname)
3. Enter your AWS Elastic IP in the IP field
4. Click Update IP

Verify DNS propagation:

nslookup hng-yourname.duckdns.org
# Should return your Elastic IP

---

Phase 3: Connect to Server

# Fix key permissions
chmod 400 ~/Downloads/hng-devops-key.pem

# SSH into server
ssh -i ~/Downloads/hng-devops-key.pem ubuntu@YOUR_ELASTIC_IP

---

Phase 4: Create hngdevops User

# Create user
sudo adduser hngdevops

# Add to sudo group
sudo usermod -aG sudo hngdevops

# Configure restricted passwordless sudo
sudo visudo -f /etc/sudoers.d/hngdevops

Add exactly this line:

hngdevops ALL=(root) NOPASSWD:/usr/sbin/sshd,/usr/sbin/ufw

Verify syntax:

sudo visudo -c -f /etc/sudoers.d/hngdevops
# Expected: parsed ok

---

Phase 5: SSH Key Setup

On your local machine:

# Generate SSH key pair
ssh-keygen -t ed25519 -C "hngdevops" -f ~/.ssh/hngdevops_key
# Press Enter twice (no passphrase)

# View public key (copy this)
cat ~/.ssh/hngdevops_key.pub

On the server:

# Set up SSH directory for hngdevops
sudo mkdir -p /home/hngdevops/.ssh
sudo chmod 700 /home/hngdevops/.ssh
sudo touch /home/hngdevops/.ssh/authorized_keys
sudo chmod 600 /home/hngdevops/.ssh/authorized_keys
sudo chown -R hngdevops:hngdevops /home/hngdevops/.ssh

# Add your public key
sudo nano /home/hngdevops/.ssh/authorized_keys
# Paste your public key, save with Ctrl+X, Y, Enter

Test the new SSH login:

ssh -i ~/.ssh/hngdevops_key hngdevops@YOUR_ELASTIC_IP
# Expected: hngdevops@ip-xxx-xx-xx-xx:~$

---

Phase 6: Harden SSH

sudo nano /etc/ssh/sshd_config

Set the following values:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no
UsePAM no

Apply changes:

sudo systemctl restart sshd

⚠️ Always test SSH login in a new terminal before closing your current session.

---

Phase 7: Configure UFW Firewall

# Reset UFW
sudo ufw --force reset

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow required ports only
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable firewall
sudo ufw --force enable

# Verify
sudo ufw status verbose

Expected output:

Status: active
22/tcp   ALLOW IN  Anywhere
80/tcp   ALLOW IN  Anywhere
443/tcp  ALLOW IN  Anywhere

---

Phase 8: Install Nginx

sudo apt update && sudo apt upgrade -y
sudo apt install nginx -y
sudo systemctl start nginx
sudo systemctl enable nginx
sudo systemctl status nginx

---

Phase 9: Configure Nginx

Create the static HTML page:

sudo mkdir -p /var/www/hng
sudo nano /var/www/hng/index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>HNG DevOps Stage 0</title>
</head>
<body>
    <h1>Emmanuel Kabari</h1>
    <p>HNG Internship 14 - DevOps Track</p>
    <p>Stage 0 Submission</p>
</body>
</html>

Create the Nginx server block:

sudo nano /etc/nginx/sites-available/hng

server {
    listen 80;
    listen [::]:80;
    server_name your-domain.duckdns.org;

    root /var/www/hng;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    location /api {
        default_type application/json;
        return 200 '{"message":"HNGI14 Stage 0","track":"DevOps","username":"your-hng-username"}';
    }
}

Enable and test:

sudo ln -s /etc/nginx/sites-available/hng /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

---

Phase 10: SSL with Certbot

# Install Certbot
sudo apt install certbot python3-certbot-nginx -y

# Obtain SSL certificate
sudo certbot --nginx -d your-domain.duckdns.org

# Test auto-renewal
sudo certbot renew --dry-run

Certbot automatically:

• Installs the SSL certificate
• Updates Nginx config with SSL settings
• Sets up a 301 redirect from HTTP to HTTPS
• Schedules auto-renewal

---

🔗 Endpoints

GET / — Static Homepage

https://emmanuel-kabari.duckdns.org/

Returns an HTML page with the HNG username visibly displayed.

---

GET /api — JSON API

https://emmanuel-kabari.duckdns.org/api

Response:

{
  "message": "HNGI14 Stage 0",
  "track": "DevOps",
  "username": "Emmanuel Kabari"
}

Headers:

Content-Type: application/json
HTTP Status: 200 OK

---

🔒 Security Checklist

Check	Status
Root SSH login disabled	✅ PermitRootLogin no
Password SSH auth disabled	✅ PasswordAuthentication no
Key-based SSH only	✅ PubkeyAuthentication yes
UFW active	✅ Enabled on startup
Only ports 22, 80, 443 open	✅ All others denied
HTTP → HTTPS 301 redirect	✅ Configured by Certbot
Valid SSL certificate	✅ Let's Encrypt
Auto SSL renewal	✅ Certbot cron job
hngdevops passwordless sudo (restricted)	✅ sshd and ufw only
Non-root deployment user	✅ hngdevops

---

✅ Verification

Run these commands to verify the full setup:

# 1. HTTP redirects to HTTPS with 301
curl -I http://your-domain.duckdns.org

# 2. HTTPS homepage returns 200
curl -I https://your-domain.duckdns.org

# 3. API returns correct JSON
curl https://your-domain.duckdns.org/api

# 4. API Content-Type is application/json
curl -I https://your-domain.duckdns.org/api

# 5. UFW is active
sudo ufw status verbose

# 6. Nginx is running
sudo systemctl status nginx

# 7. Passwordless sudo works
sudo -u hngdevops sudo /usr/sbin/sshd -T | head -5
sudo -u hngdevops sudo /usr/sbin/ufw status

---

📁 Project Structure

/
├── /etc/nginx/
│   └── sites-available/
│       └── hng                  # Nginx server block config
├── /var/www/hng/
│   └── index.html               # Static homepage
├── /etc/letsencrypt/
│   └── live/your-domain/
│       ├── fullchain.pem        # SSL certificate
│       └── privkey.pem          # SSL private key
├── /etc/ssh/
│   └── sshd_config              # Hardened SSH config
├── /etc/sudoers.d/
│   └── hngdevops                # Restricted passwordless sudo
└── /home/hngdevops/
    └── .ssh/
        └── authorized_keys      # SSH public keys

---

👤 Author

Emmanuel Kabari HNG Internship 14 — DevOps Track

---

Built with 💻 on AWS EC2 · Secured with 🔒 Let's Encrypt · Served by ⚡ Nginx