Establish trusted access
Verify the server and SSH fingerprint through the available trusted channel. Connect with an SSH key, create an administrative user and protect account recovery details. Keep one working session open while testing new authentication settings.
Apply the baseline
Install supported security updates, set the correct time synchronisation and enable a firewall that permits only required services. Configure both IPv4 and IPv6. Remove unused services instead of leaving them listening without a purpose.
Deploy in a repeatable way
Store configuration templates and deployment instructions in local version control without secrets. Use a service manager or container runtime so the application starts predictably after a reboot. Put credentials in a protected configuration store outside the public directory.
Test the failure path
Reboot once, check the service, restore a sample backup and confirm alerts reach you. Record the recovery steps. A deployment is more useful when a second person or a future version of you can rebuild it.