Public VPS installation

Installation choices · User guide

For an Internet-facing deployment, the Python API must bind to loopback only. Public access must go through an HTTPS reverse proxy. Do not use the home HTTP profile.

1. Prepare the VPS

Provision Ubuntu 24.04 with a sudo-capable non-root user and verified SSH key login. Use domain names you own, such as api.example.org, docs.example.org and example.org (examples only). The official listmyday.com hostnames belong to the hosted ListMyDay service and cannot be used for self-hosting. Point your own DNS A/AAAA records to the VPS. Confirm provider firewall permits SSH, TCP 80 and 443, not TCP 8090.

sudo apt update
sudo apt install -y git ca-certificates
mkdir -p ~/git/listmyday
git clone https://gitlab.com/careboard/listmyday-server.git ~/git/listmyday/listmyday-server
cd ~/git/listmyday/listmyday-server
bash tools/bootstrap/ubuntu-packages.sh
bash tools/bootstrap/clone.sh

2. Install the API

sudo loginctl enable-linger "$(id -un)"
bash install.sh new
bash tools/bootstrap/public-https.sh
curl -fsS http://127.0.0.1:8090/v1/health

3. Configure your domain names

Replace all example values with hostnames and a certificate email you control. Export them in the same shell used to run installation and verification.

export LISTMYDAY_API_DOMAIN=api.example.org
export LISTMYDAY_DOCS_DOMAIN=docs.example.org
export LISTMYDAY_APEX_DOMAIN=example.org
export LISTMYDAY_CERT_EMAIL=admin@example.org

4. Configure firewall, Nginx and certificates

First verify a second SSH session works. The following enables UFW and installs temporary HTTP routing:

bash tools/bootstrap/firewall.sh --apply
bash tools/bootstrap/nginx-http.sh

Copy the app repository's static documentation files into /var/www/listmyday-docs before issuing certificates. After publishing the initial documentation files, issue certificates:

bash tools/bootstrap/nginx-tls.sh
bash tools/deploy/docs.sh

The initial Certbot configuration is not the final hardened Nginx configuration. Before public use, apply the reviewed TLS 1.3, method limits, rate limits, security headers and loopback upstream controls from the repository's Nginx example. Validate before reloading.

5. Verify

sudo nginx -t
sudo systemctl reload nginx
sudo certbot renew --dry-run
bash tools/bootstrap/verify.sh public
bash tools/deploy/status.sh

6. Ongoing maintenance

Run bash tools/deploy/pull.sh and bash tools/deploy/install.sh upgrade for updates; bash tools/deploy/restart.sh for restarts; and bash tools/deploy/docs.sh after updating documentation. Do not enable unrestricted household signup without abuse controls.

Read the complete public VPS runbook and reconstructed deployment history.

Automated installation verification

Install jq if it is not already available. The verifier reports PASS/FAIL and writes a structured JSON diagnostic file in logs/verification/. No household secrets are included. A passing result does not replace firewall, backup-restore, or external exposure checks.

bash tools/bootstrap/verify.sh public

Keep the operator-owned domain variables set when verifying this public deployment. Inspect the generated JSON with jq . REPORT_PATH.