- Set UFW input policy to ACCEPT (template defaults to DROP)
- Correct
/etc/resolv.conf nameserver
- Apply UFW rule: allow from
10.10.0.0/16
- If new VLAN: update WireGuard AllowedIPs on both the Gateway VPS and bare metal
- Add the new VM's SSH alias to
/root/.ssh/config on the Gateway
- Install
qemu-guest-agent, confirm agent: enabled=1 in the VM's Proxmox config
- Install node-exporter and Promtail, ship to
10.10.50.104:3100
- Add to Prometheus scrape targets on sn-monitor
- Add to Uptime Kuma monitors
- Add Watchtower (pinned v1.5.3 — see Operational Rules on why not latest)
- Install Tailscale for admin-access redundancy
- Check RAM/disk headroom on the target host first
- Verify image compatibility if targeting an older CPU generation
/opt/stacks/<service>/docker-compose.yml — one service per compose file, never combined- Docker secrets for all credentials
- Caddy block in
/opt/stacks/caddy/Caddyfile
- PowerDNS A record
- Reload Caddy:
docker compose restart caddy
- UFW rule scoped as narrowly as possible
- Verify TLS certificate actually provisioned
- Add to Uptime Kuma
- Prometheus scrape target if the service exposes metrics
- Configure SMTP (
notifications@house-of-trae.com) if the service sends its own notifications
- SSO is default, not optional — native OIDC to the right realm if supported, otherwise the shared wall (
house-of-trae.com domains only). Only skip this for services that genuinely can't support a browser login gate (raw SMTP/IMAP, machine-to-machine APIs).
See Operational Rules for the gotchas that tend to bite on steps 5, 7, and 13 specifically.