Firewall

Build a default-drop nftables firewall on Debian 13: named sets, SSH rate limits, ICMPv6, a timed rollback against lockout, and Docker pitfalls.

Set up a locked-down WireGuard VPN on Debian 13: wg-quick, PresharedKey, default-drop nftables NAT, split tunnel, leak tests and handshake troubleshooting.

Set up fail2ban on Debian 13 with nftables: the Debian defaults, systemd journal backend, sshd and recidive jails, incremental bans and how to verify bans.

Web server security baseline for Debian 13: unattended-upgrades, key-only SSH, certbot TLS with HSTS, nftables and Fail2ban, with checks for each step.