Prik Nam Pla

Prik Nam Pla is a comprehensive automation suite designed to deploy and manage a secure, high-performance web server on Google Cloud Platform (GCP), specifically optimized for the Free Tier (e2-micro).

The project automates everything from infrastructure provisioning to host-level security hardening, monitoring, and automated backups.

Features

Infrastructure (GCP)

• Compute Engine: Provisions an e2-micro instance with a static IP.
• Security: Configures VPC firewall rules, including automated blocking of Spamhaus DROP lists.
• Secret Management: Uses GCP Secret Manager for sensitive credentials (DuckDNS tokens, etc.).
• Artifact Registry: Sets up a Docker repository with automated cleanup policies.
• Storage: Creates GCS buckets for automated backups with lifecycle management.
• Monitoring: Configures Uptime Checks, Alert Policies, and Notification Channels.

Host Provisioning

• Optimization: Configures swap space and Nginx for low-memory (1GB RAM) environments.
• Security:
  • Hardens SSH (disables password auth).
  • Configures UFW (Uncomplicated Firewall).
  • Installs Fail2Ban for brute-force protection.
  • Enables Unattended Upgrades for security patches.
• Connectivity:
  • Dynamic DNS via DuckDNS.
  • Automated SSL via Let's Encrypt (Certbot).
• Observability: Installs Google Cloud Ops Agent for centralized logging and metrics.
• Reliability: Automated daily backups to GCS with integrity testing.

Prerequisites

• Google Cloud SDK (gcloud) installed and authenticated.
• A GCP Project with billing enabled (even for free tier).
• Local tools: jq, curl.

Getting Started

1. Configure your environment: Edit lib/config.sh to set your project ID, domain, and email.

   nano lib/config.sh

2. Run the setup: The main orchestrator will handle both GCP infrastructure and host-level provisioning.

   ./gcp/00-setup.sh

Project Structure

• gcp/: Scripts for provisioning GCP infrastructure.
• host/: Scripts executed on the VM for software installation and configuration.
  • 00-setup.sh: Orchestrates host-level tasks like swap creation, Nginx setup, and security hardening.
  • cleanup.sh: Removes temporary setup files from the VM.
• lib/: Shared configuration and common bash functions.

Cleanup

To tear down all resources created by this project:

./gcp/cleanup.sh

License

This project is licensed under the MIT License.