The system was upgraded to Debian 13 x86_64.

SSH is enabled only. The underlying components are Nginx 1.26.3, PHP 8.4.23, MariaDB 11.8.6, Docker 26.1.5, Compose 2.26.1, and Swap 4 GB.

Apply resource/log limits to SSH, nftables, Fail2ban, PHP-FPM, MariaDB, and Docker.

SSH password login disabled; root user only allowed key-based login; nftables defaults to denying and allowing logins. 22/80/443/1935.

HTTPS Certbot scheduled renewal is now enabled.