World map

 

BM

World L4: Remote Kitchens

Capstone mission 7: A server from scratch

You will learn: to set up a real server yourself: a user, a key, a firewall, nginx, a script and a timer.

Checked with Linux (Debian 13) on 1 Nov 2026

The problem

Mission 7: open a new branch kitchen, from an empty machine. First, plan the build. Put the jobs in a safe order.

First job at the top. Put these in order. Use the arrows, or drag.

  • Firewall: allow SSH and web, then switch it on
  • Update the packages
  • nginx with your own page
  • Add your own user with sudo
  • A systemd timer for the script
  • Test from your laptop
  • Log in with an SSH key
  • A backup script in strict mode

Watch

Real servers, real risks. Good rule or not?

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Use a throwaway VM or playground, never a work server.

Watch

Your backup script. Which line makes it stop at the first problem?

#!/bin/bash
set -euo pipefail
src="$HOME/kedai/menu"
dest="$HOME/backups"
mkdir -p "$dest"
cp -r "$src" "$dest/menu-$(date +%F)"
echo "backup done"

Watch

The timer starts a service. Save this as /etc/systemd/system/kedai-backup.service, with your own user. Tap the line that runs the script.

Tap the line that runs the script.

0 of 1 found

Try it

Now build it for real. Your ticks are saved. Replace aina and SERVER-IP with your own.

Real mission

  2. sudo apt update && sudo apt upgrade -y
  3. sudo adduser aina && sudo usermod -aG sudo aina
  4. ssh-copy-id aina@SERVER-IP
  5. sudo apt install -y ufw nginx
  6. sudo ufw allow OpenSSH && sudo ufw allow 'Nginx HTTP'
  7. sudo ufw enable && sudo ufw status
  8. echo '<h1>Kedai Kancil, branch 2</h1>' | sudo tee /var/www/html/index.html
  9. mkdir -p ~/kedai/menu && echo 'nasi lemak 5' > ~/kedai/menu/today.txt
  10. chmod +x ~/backup.sh && ~/backup.sh
  11. sudo systemctl daemon-reload && sudo systemctl enable --now kedai-backup.timer
  12. systemctl list-timers kedai-backup.timer

0 of 14 steps done · Your ticks are saved.

Check

GitHub can see your files. Type your username and press Check now.

Check it on GitHub

Your username is sent only to api.github.com.

  • Your server-from-scratch repo is publicNot checked yet
  • It has backup.shNot checked yet
  • It has kedai-backup.serviceNot checked yet
  • It has kedai-backup.timerNot checked yet

Check

The rest only you can see. Tick what is true.

Self-check

0 of 6 steps done · Your ticks are saved.

You did it!

You can now set up a small, safe Linux server from an empty machine.

Go deeper (optional)

Where the story breaks: a real branch kitchen has staff who smell smoke. A server notices nothing unless you add checks. The Monitoring & Observability course adds the smoke alarms. Later, harden SSH: turn off password logins, but only after your key login works.