Server Craft
Server configuration, hardening, tuning, and developer experience for Linux VPS/dedicated servers. Focused on solo developers running AI agent platforms, multi-project hosting, and production workloads on Ubuntu/Debian.
Entry point: /faion-net (routes here for server/infra/config tasks)
How It Works
- User describes server task (setup, harden, tune, configure, deploy)
- Auto-investigate current server state (OS, services, configs)
- Route to appropriate methodology
- Execute with copy-paste ready configs and scripts
Context Discovery
Auto-Investigation
Glob: /etc/os-release # OS detection
Glob: /etc/ssh/sshd_config # SSH config
Glob: /etc/nginx/sites-enabled/* # nginx sites
Glob: /etc/systemd/system/*.service # system services
Glob: ~/.config/systemd/user/*.service # user services
Glob: /etc/fail2ban/jail.d/* # fail2ban jails
Glob: /etc/sysctl.d/* # kernel tuning
Grep: "ListenPort" /etc/wireguard/*.conf # WireGuard
Bash: ufw status numbered # firewall rules
Bash: tmux -V # tmux version
Bash: docker ps --format "table" # running containers
Bash: systemctl --user list-units # user services
Bash: crontab -l # cron jobs
Discovery Questions
- Q1: What do you want to do? Setup new server / Harden existing / Tune performance / Configure service / Deploy app / Automate task
- Q2: What OS/distro? Ubuntu 24.04 / Debian 12 / Other
- Q3: What services run? Web (nginx) / DB (postgres/redis) / Queue (rabbitmq) / Docker / Custom apps
- Q4: Security level? Basic (dev) / Production / High-security
Decision Tree
| User Intent | Methodology |
|-------------|-------------|
| "Harden SSH" / "secure SSH" | ssh-hardening/ |
| "Setup firewall" / "UFW rules" | firewall-management/ |
| "Tune kernel" / "sysctl" / "BBR" | kernel-tuning/ |
| "Setup fail2ban" / "ban IPs" | fail2ban-setup/ |
| "Auto updates" / "unattended upgrades" | unattended-upgrades/ |
| "tmux config" / "tmux plugins" | tmux-power-user/ |
| "Shell tools" / "fzf" / "starship" | shell-productivity/ |
| "Aliases" / "shortcuts" | bash-aliases/ |
| "nginx" / "reverse proxy" / "proxy_pass" | nginx-reverse-proxy/ |
| "SSL" / "TLS" / "HTTPS" / "certbot" | ssl-tls-management/ |
| "VPN" / "WireGuard" | wireguard-vpn/ |
| "systemd service" / "unit file" | systemd-user-services/ |
| "Docker Compose" / "container" | docker-compose-patterns/ |
| "Backup" / "restore" / "disaster" | backup-recovery/ |
| "Monitoring" / "logs" / "journald" | monitoring-logging/ |
| "Agent tuning" / "Claude Code" / "inotify" | agent-dev-tuning/ |
| "Git deploy" / "worktree" | git-server-workflow/ |
| "Cron" / "scheduled task" / "automation" | cron-automation/ |
| "Secrets" / ".env" / "1Password" | secrets-management/ |
| "Swap" / "memory" / "OOM" | swap-memory-management/ |
| "direnv" / "mise" / "asdf" / "versions" | direnv-mise-versions/ |
| "New server" / "bootstrap" / "initial setup" | server-init-bootstrap/ |
| "Multi-domain" / "multi-project" | multi-project-hosting/ |
| "Deploy script" / "sync to runtime" | deploy-scripts/ |
| "Health check" / "auto-heal" / "watchdog" | health-checks-autoheal/ |
| "Dotfiles" / "config management" | dotfiles-management/ |
| "Claude hooks" / "settings.json" | claude-code-hooks/ |
Multi-methodology flows
"Setup production server from scratch":
server-init-bootstrap/(user, SSH keys, basic tools)ssh-hardening/(key-only, port change, ed25519)firewall-management/(UFW rules)fail2ban-setup/(jails)kernel-tuning/(BBR, inotify, security)unattended-upgrades/(auto security patches)swap-memory-management/(swap file)nginx-reverse-proxy/(domains)ssl-tls-management/(HTTPS)systemd-user-services/(app services)deploy-scripts/(deployment flow)monitoring-logging/(health + logs)backup-recovery/(automated backups)
"Optimize server for AI agent development":
agent-dev-tuning/(inotify, swap, OOM, Claude hooks)tmux-power-user/(session management)shell-productivity/(modern CLI tools)bash-aliases/(productivity shortcuts)claude-code-hooks/(settings.json automation)
Quick Reference
| Domain | Methodologies | Focus | |--------|--------------|-------| | Security | 5 | SSH, firewall, fail2ban, kernel hardening, unattended upgrades | | Networking | 4 | nginx, SSL/TLS, WireGuard VPN, multi-project hosting | | Services | 3 | systemd, Docker Compose, health checks | | Automation | 4 | cron, deploy scripts, git workflow, Claude hooks | | Developer UX | 4 | tmux, shell tools, aliases, dotfiles | | Infrastructure | 4 | backup, monitoring, swap/memory, secrets | | Setup | 3 | bootstrap, direnv/mise, agent tuning | | Total | 27 | |
Execution Pattern
For each methodology:
- Audit current state (read existing configs)
- Show diff (what changes, what stays)
- Apply incrementally (one change at a time)
- Verify (test the change works)
- Document (note what was changed and why)
Always backup before modifying system configs:
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.$(date +%Y%m%d)