DMIT First Deploy Checklist: Two Hours to Production

Why use a checklist

The first hour after your DMIT cloud server is provisioned is the critical window for security hardening and base configuration. Following a checklist step by step helps avoid missing critical items and reduces future maintenance headaches.

This article divides first deployment into four phases: system init, security hardening, service deployment, and monitoring/backup. Each step includes concrete commands and verification methods.

Phase 1: System init (0-15 min)

1.1 First login

Log in with the IP and root password from the DMIT Billing Area:

ssh root@<server_ip>

Change the root password immediately:

passwd root

1.2 Update the system

apt update && apt upgrade -y   # Debian/Ubuntu
yum update -y                   # CentOS/RHEL

If the kernel was updated, reboot: reboot

1.3 Set timezone

timedatectl set-timezone Asia/Shanghai   # or your zone
timedatectl status

1.4 Create a non-root user

adduser deploy
usermod -aG sudo deploy
su - deploy   # test sudo access

Phase 2: Security hardening (15-45 min)

2.1 SSH key authentication

Generate keys locally and upload (see SSH Hardening):

# Run locally
ssh-keygen -t ed25519
ssh-copy-id deploy@<server_ip>

2.2 Disable password login

# /etc/ssh/sshd_config
PasswordAuthentication no
PermitRootLogin no

systemctl restart sshd

Keep your current session open — test key login in a new terminal before closing.

2.3 Configure firewall

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp    # SSH
ufw allow 80/tcp    # HTTP
ufw allow 443/tcp   # HTTPS
ufw enable
ufw status verbose

If you changed the SSH port, use the new port instead of 22.

2.4 Install fail2ban

apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

2.5 IPv6 (if needed)

DMIT assigns a /64 IPv6 prefix by default. See IPv6 Setup Guide.

Phase 3: Service deployment (45-90 min)

3.1 Install web server

apt install nginx -y
systemctl enable nginx
systemctl start nginx

Verify: curl -I http://localhost returns 200.

3.2 Reverse proxy (optional)

server {
    listen 80;
    server_name example.com;
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

3.3 HTTPS

apt install certbot python3-certbot-nginx -y
certbot --nginx -d example.com

3.4 Database (as needed)

# PostgreSQL
apt install postgresql -y
systemctl enable postgresql

# MySQL/MariaDB
apt install mariadb-server -y
mysql_secure_installation

Phase 4: Monitoring & backup (90-120 min)

4.1 Basic monitoring

apt install htop iotop -y

For a full monitoring solution, see Monitoring and Backup.

4.2 Create a DMIT snapshot

Create an initial snapshot in the DMIT control panel as a safe rollback point. Suggested name: initial-setup-YYYYMMDD.

4.3 Automated backup

# /opt/backup.sh
#!/bin/bash
DATE=$(date +%Y%m%d)
tar czf /backup/www-$DATE.tar.gz /var/www/
find /backup -name "*.tar.gz" -mtime +7 -delete

chmod +x /opt/backup.sh
crontab -e
# Add: 0 2 * * * /opt/backup.sh

Verification checklist

Ongoing maintenance

• Weekly: check for updates apt update && apt upgrade
• Monthly: check disk space df -h
• Quarterly: run a recovery drill (see Monitoring and Backup)
• Regularly: audit SSH config and firewall rules
• Watch DMIT announcements for datacenter maintenance and line changes

More guides in the beginner guide. Refund policy in Refund Policy Explained.

Checked 2026-08-18. Details depend on your OS version.