How to Build a Self-Hosted Private Cloud on Your VPS with Docker and Kubernetes

#!/usr/bin/env bash
# system-hardening.sh — Run as root on fresh Ubuntu 24.04
set -euo pipefail

# 1. Update and install essentials
apt update && apt upgrade -y
apt install -y curl gnupg2 software-properties-common apt-transport-https ca-certificates lsb-release ufw \
  jq yq git vim htop iotop ncdu tree unzip rsync cron logrotate \
  apparmor apparmor-utils auditd systemd-resolved

# 2. Kernel parameters for Kubernetes and security
cat > /etc/sysctl.d/99-k8s-hardening.conf  /dev/null
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
sudo systemctl restart containerd

# Install k3s without Traefik and local-path (we'll manage them via Helm)
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--disable=traefik --disable=local-path-provisioner --write-kubeconfig-mode=644 --cluster-init" sh -s -

# Verify installation
sudo systemctl status k3s
kubectl get nodes -o wide
kubectl get pods -A

# On first server (bootstrap)
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--disable=traefik --disable=local-path-provisioner --write-kubeconfig-mode=644 --cluster-init --tls-san=yourdomain.com" sh -s -

# Get the token
sudo cat /var/lib/rancher/k3s/server/node-token

# On additional servers (repeat for each)
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--disable=traefik --disable=local-path-provisioner --write-kubeconfig-mode=644 --server=https://:6443 --token= --tls-san=yourdomain.com" sh -s -

# On worker nodes (agent only)
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--server=https://:6443 --token=" sh -s -

mkdir -p ~/.kube
sudo cp /etc/rancher/k3s/k3s.yaml ~/.kube/config
sudo chown $USER:$USER ~/.kube/config
chmod 600 ~/.kube/config

# Test access
kubectl cluster-info
kubectl get nodes
kubectl api-resources | head -20

# Install Helm if not present
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# Add Longhorn repo and install
helm repo add longhorn https://charts.longhorn.io
helm repo update

# Create namespace and backup credentials first
kubectl create namespace longhorn-system

kubectl create secret generic longhorn-backup-credentials \
  --namespace longhorn-system \
  --from-literal=AWS_ACCESS_KEY_ID=your-access-key \
  --from-literal=AWS_SECRET_ACCESS_KEY=your-secret-key \
  --from-literal=AWS_ENDPOINTS=https://s3.your-region.amazonaws.com \
  --dry-run=client -o yaml | kubectl apply -f -

helm upgrade --install longhorn longhorn/longhorn \
  --namespace longhorn-system \
  --create-namespace \
  --version 1.7.2 \
  --set defaultSettings.defaultReplicaCount=1 \
  --set defaultSettings.backupTarget=s3://your-bucket@your-region/longhorn-backups \
  --set defaultSettings.backupTargetCredentialSecret=longhorn-backup-credentials \
  --set defaultSettings.replicaSoftAntiAffinity=false \
  --set defaultSettings.replicaHardAntiAffinity=false \
  --set defaultSettings.backupConcurrentLimit=2 \
  --set defaultSettings.restoreConcurrentLimit=2 \
  --set defaultSettings.cleanupPeriod=24h \
  --set defaultSettings.defaultDataPath=/var/lib/longhorn \
  --set defaultSettings.defaultEngineImage=longhornio/longhorn-engine:v1.7.2 \
  --set defaultSettings.defaultInstanceManagerImage=longhornio/longhorn-instance-manager:v1_20240729 \
  --set defaultSettings.defaultShareManagerImage=longhornio/longhorn-share-manager:v1_20240729 \
  --set defaultSettings.backupstorePollInterval=300 \
  --set persistence.defaultClassReplicaCount=1 \
  --set ingress.enabled=true \
  --set ingress.className=traefik \
  --set ingress.host=longhorn.yourdomain.com \
  --set ingress.tls.enabled=true \
  --set ingress.tls.secretName=longhorn-tls \
  --wait --timeout 15m

cat  pub-cert.pem

# Seal a secret (run locally, commit SealedSecret to Git)
kubectl create secret generic db-credentials \
  --namespace=database \
  --from-literal=username=appuser \
  --from-literal=password=supersecret \
  --dry-run=client -o yaml | \
kubeseal --cert pub-cert.pem --format yaml > sealed-db-credentials.yaml

# infrastructure/security/external-secrets/helmrelease.yaml
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: external-secrets
  namespace: external-secrets
spec:
  interval: 1h
  chart:
    spec:
      chart: external-secrets
      version: "0.10.0"
      sourceRef:
        kind: HelmRepository
        name: external-secrets
        namespace: flux-system
  values:
    installCRDs: true
    serviceMonitor:
      enabled: true

# apps/your-app/secretstore.yaml
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: vault-backend
spec:
  provider:
    vault:
      server: "https://vault.yourdomain.com"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "external-secrets"
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
  namespace: your-app
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-backend
  target:
    name: app-secrets
    creationPolicy: Owner
  data:
  - secretKey: database-url
    remoteRef:
      key: apps/your-app
      property: database_url
  - secretKey: api-key
    remoteRef:
      key: apps/your-app
      property: api_key

# Install Trivy operator (scans images in cluster)
helm repo add aqua https://aquasecurity.github.io/helm-charts/
helm repo update

helm upgrade --install trivy-operator aqua/trivy-operator \
  --namespace trivy-system \
  --create-namespace \
  --version 0.22.0 \
  --set operator.scanJobTimeout=10m \
  --set operator.batchDeleteLimit=10 \
  --set operator.batchDeleteDelay=10s \
  --set trivy.ignoreUnfixed=true \
  --set trivy.severity=CRITICAL,HIGH \
  --wait --timeout 5m

# Or run Trivy in CI/CD pipeline (GitHub Actions example)
# - uses: aquasecurity/trivy-action@master
#   with:
#     scan-type: 'fs'
#     scan-ref: '.'
#     format: 'sarif'
#     output: 'trivy-results.sarif'

# bootstrap/network-policies.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: your-app
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: your-app
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-to-database
  namespace: your-app
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: database
    ports:
    - protocol: TCP
      port: 5432
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-ingress
  namespace: your-app
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: traefik
    ports:
    - protocol: TCP
      port: 8080

# Install Velero with S3 backend
velero install \
  --provider aws \
  --plugins velero/velero-plugin-for-aws:v1.9.0 \
  --bucket velero-backups \
  --secret-file ./credentials-velero \
  --backup-location-config region=your-region,s3ForcePathStyle=true,s3Url=https://s3.your-region.amazonaws.com \
  --snapshot-location-config region=your-region \
  --use-volume-snapshots=false \
  --default-volumes-to-fs-backup \
  --wait

# Create daily backup schedule
velero schedule create daily-backup \
  --schedule "0 3 * * *" \
  --include-namespaces '*' \
  --exclude-namespaces kube-system,flux-system,cert-manager,traefik,monitoring \
  --ttl 720h

# Create weekly backup schedule
velero schedule create weekly-backup \
  --schedule "0 4 * * 0" \
  --include-namespaces '*' \
  --ttl 2160h

# k3s writes SQLite snapshots to /var/lib/rancher/k3s/server/db/snapshots every 5 minutes
# Sync to S3 via rclone (systemd timer)

cat