TECHNICAL REPORT

1. EXECUTIVE SUMMARY

This technical report documents the successful implementation of a production-ready web infrastructure system. Our team has deployed, configured, and secured a complete web server environment demonstrating modern DevOps practices including remote access, web server configuration, API interaction, load balancing, SSL/TLS encryption, firewall management, and system debugging.

2. INTRODUCTION

2.1 Background Scenario

As part of the IT Operations and Infrastructure team for a small company preparing to launch an online platform, our objective was to prepare, secure, test, and validate the infrastructure before application deployment. This assignment focuses on demonstrating how modern web systems are deployed, secured, accessed, monitored, and debugged using real tools, protocols, and configurations.

2.2 Project Objectives

2.3 Technology Stack

3. TASK 1: REMOTE SERVER SIMULATION (SSH)

3.1 Objective

Demonstrate secure remote server access using SSH with both password-based and key-based authentication methods, including file transfer capabilities.

3.2 Implementation Steps

Step 1: OpenSSH Server Installation

Installed OpenSSH server on Ubuntu WSL2 environment.

sudo apt update
sudo apt install openssh-server -y
sudo service ssh start

Figure 1.1: SSH Server Installation

OpenSSH server installation showing package list reading, dependency tree building, and successful installation confirmation. System information displayed after first SSH login with password authentication.

Step 2: Password Authentication

Verified basic SSH connectivity using password authentication.

ssh winebald@localhost
Welcome to Ubuntu 24.04.3 LTS (GNU/Linux 6.6.87.2-microsoft-standard-WSL2 x86_64)

Step 3: SSH Key Generation

Generated ED25519 SSH key pair for enhanced security.

ssh-keygen
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/winebald/.ssh/id_ed25519): /home/winebald/.ssh/id_rsa
Your identification has been saved in /home/winebald/.ssh/id_rsa
Your public key has been saved in /home/winebald/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:cUX24fRz0wRz0pkb5FYeWZugTJ8pTiI winebald@WINEBALD

Figure 1.2: SSH Key Generation

ED25519 SSH key pair generation displaying public/private key creation, fingerprint (SHA256:cUX24fRz0wRz0pkb5FYeWZugTJ8pTiI), and randomart image for visual key verification.

Step 4: Key-Based Authentication Setup

Configured authorized_keys for passwordless authentication.

sudo cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
sudo cat << 'EOF' >> /etc/ssh/ssh_config
Host *
  PasswordAuthentication no
  IdentityFile ~/.ssh/id_rsa
EOF
ssh -i ~/.ssh/id_rsa winebald@localhost
Last login: Tue Jan 20 11:55:21 2026 from 127.0.0.1

Figure 1.4: Key-Based Authentication

Passwordless SSH authentication using private key (-i ~/.ssh/id_rsa). System welcome message shows Ubuntu 24.04.3 LTS with last login timestamp from 127.0.0.1, demonstrating successful key-based access.

Step 5: Secure File Transfer (SCP)

Demonstrated file transfer using SCP protocol.

scp /var/www/html/index.html winebald@localhost:/mnt/c/Users/USER/Downloads
winebald@localhost's password: 
index.html                    100%   20    12.6KB/s   00:00

Figure 1.3: Secure File Transfer

SCP (Secure Copy Protocol) demonstration transferring index.html file from /var/www/html to remote destination. Transfer completed at 12.6KB/s showing 100% completion for 20-byte file.

3.3 Results and Verification

4. TASK 2: WEB SERVER & HTTP PROTOCOL DEMONSTRATION

4.1 Objective

Install and configure Nginx web server to handle HTTP requests, demonstrate various HTTP methods, status codes, and headers without backend development.

4.2 Nginx Configuration

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    server_name _;
    root /var/www/html;
    index index.html;
    
    location / {
        try_files $uri $uri/ =404;
    }
    
    location /api/read {
        limit_except GET {
            deny all;
        }
        return 200 '{"status": "200 OK"}';
    }
    
    location /api/submit {
        limit_except POST {
            deny all;
        }
        return 201 '{"status": "201 Created"}';
    }
    
    location /api/update {
        limit_except PUT {
            deny all;
        }
        return 200 '{"status": "200 OK"}';
    }
    
    location /api/delete {
        limit_except DELETE {
            deny all;
        }
        return 204 '{"status": "204 No Content"}';
    }
    location /redirect {
        return 301 https://github.com/banituze;
    }
}

4.3 HTTP Methods Testing

curl -X GET localhost/api/read
{"status": "200 OK"}

curl -X POST localhost/api/submit
{"status": "201 Created"}

curl -X PUT localhost/api/update
{"status": "200 OK"}

curl -X DELETE localhost/api/delete
{"status": "204 No Content"}

curl -H "Content-Type: application/json" localhost
Hello from Group D!

Figure 2.1: HTTP Methods Testing

cURL commands demonstrating all HTTP methods (GET, POST, PUT, DELETE) with their respective status codes and JSON responses. Custom header example shows Content-Type: application/json with server response 'Hello from Group D!'

4.4 HTTP Status Codes Implemented

5. TASK 3: API INTERACTION

5.1 Objective

Demonstrate complete CRUD operations using the OpenAI API with proper authentication, error handling, and response validation using Postman.

5.2 API Configuration

5.3 CRUD Operations Execution

Figure 3.1: Postman API Testing - Complete CRUD Workflow

Postman Runner interface showing successful execution of OpenAI CRUD collection. Results display all four operations (Create, Read, Update, Delete Conversation) with PASS status. Test assertions verified including "Status code is 200", "Saved conversation_id to environment", "Conversation deleted successfully", and "conversation_id removed from environment". Performance metrics show response times ranging from 635ms to 1271ms with 100% test success rate. Environment variables properly managed for conversation ID persistence across requests.

5.4 Performance Metrics

6. TASK 4: LOAD BALANCING SIMULATION

6.1 Objective

Implement HAProxy load balancer to distribute traffic between multiple backend servers, demonstrating round-robin algorithm and failover capabilities.

6.2 HAProxy Configuration

frontend lb-frontend
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }
    bind *:443 ssl crt /etc/letsencrypt/live/web.banituze.tech/banituze.pem
    default_backend lb-backend

backend lb-backend
    balance roundrobin
    server web01 3.86.59.154:80 check
    server web02 54.227.118.239:80 check

Figure 4.1: HAProxy Load Balancer Configuration

HAProxy configuration showing combined PEM certificate creation, frontend/backend setup with SSL termination, round-robin load balancing between two servers (3.86.59.154:80 and 54.227.118.239:80), and service restart/reload commands.

6.3 Load Balancing Strategy

6.4 Backend Server Pool

6.5 Failover Testing

for i in {1..10}; do curl web.banituze.tech; done

Result: Traffic distributed evenly between both servers
- Request 1, 3, 5, 7, 9: web01 (3.86.59.154)
- Request 2, 4, 6, 8, 10: web02 (54.227.118.239)

Verification: Round-robin distribution confirmed
Failover: Automatic rerouting when one server is down

6.6 SSL/TLS Integration

Load balancer configured with SSL termination, handling HTTPS traffic and redirecting HTTP to HTTPS automatically.

7. TASK 5: SECURITY - SSL/TLS (HTTPS SETUP)

7.1 Objective

Implement SSL/TLS encryption using Let's Encrypt certificates to secure web traffic and establish HTTPS connectivity.

7.2 Certificate Acquisition Process

Step 1: Certbot Installation

sudo apt install certbot -y

Step 2: DNS Challenge Configuration

sudo certbot certonly --manual --preferred-challenges dns -d web.banituze.tech

Please deploy a DNS TXT record under the name:
_acme-challenge.web.banituze.tech

with the following value:
cQxFzUFbk9ArUiLMRS0hZqgH6QhuQfnLUvPtnwm7mBg

Figure 5.1: SSL Certificate DNS Challenge

Certbot manual DNS challenge for web.banituze.tech domain showing TXT record requirement (_acme-challenge.web.banituze.tech) with validation value. Successfully received certificate saved at /etc/letsencrypt/live/web.banituze.tech/ with expiration date 2026-04-20.

Step 3: DNS Verification

DNS TXT record deployed and verified through Admin Toolbox.

Verification successful - Certificate issued

Step 4: Certificate Installation

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/web.banituze.tech/fullchain.pem
Key is saved at: /etc/letsencrypt/live/web.banituze.tech/privkey.pem
This certificate expires on 2026-04-20.

Step 5: Combined PEM Creation

sudo bash -c "cat /etc/letsencrypt/live/web.banituze.tech/fullchain.pem /etc/letsencrypt/live/web.banituze.tech/privkey.pem > /etc/letsencrypt/live/web.banituze.tech/banituze.pem"

Step 6: Service Configuration

sudo service haproxy restart
sudo service haproxy reload

7.3 Certificate Details

7.4 Security Benefits

8. TASK 6: SECURITY - FIREWALL RULES SIMULATION

8.1 Objective

Configure UFW (Uncomplicated Firewall) to control network access, implementing security policies for SSH, HTTP, and HTTPS services.

8.2 UFW Installation and Activation

sudo apt update -y
sudo apt install ufw -y
sudo ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

Figure 6.1: UFW Installation

UFW (Uncomplicated Firewall) installation process showing apt update, package installation with dependencies (libip4tc2, libip6tc2, libnetfilter-conntrack3, iptables), and ufw enable command with SSH connection warning prompt.

8.3 Firewall Rules Configuration

sudo ufw allow 22/tcp
Rule added
Rule added (v6)

sudo ufw allow 443/tcp
Rule added
Rule added (v6)

sudo ufw allow 80/tcp
Rule added
Rule added (v6)

Figure 6.2: UFW Rules Configuration

Complete UFW firewall rule implementation showing configuration file creation, package setup, trigger processing, and systemd service enablement. All rules added for ports 22/tcp, 443/tcp, and 80/tcp with IPv4 and IPv6 support.

8.4 Active Firewall Status

8.5 Security Policy

8.6 Testing and Verification

sudo ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
8080/tcp                   DENY IN     Anywhere

8.7 Security Best Practices Implemented

• Principle of least privilege - only necessary ports opened
• SSH access maintained to prevent lockout
• Both HTTP and HTTPS enabled for web service access
• Explicit deny rule demonstrated for port 8080
• IPv6 rules automatically configured alongside IPv4
• Firewall enabled at system startup for persistent protection

9. TASK 7: WEB SERVER DEBUGGING ACTIVITY

9.1 Objective

Identify, diagnose, and resolve common web server issues using systematic troubleshooting techniques.

9.2 Common Issues and Resolutions

sudo ss -tulpn | grep :80
tcp   LISTEN 0      511           0.0.0.0:80        0.0.0.0:*    users:(("nginx",pid=10566,fd=5)

sudo kill 10566
sudo service nginx start

ls -la /var/www/html/
drwx------ 2 root root 4096 Jan 20 12:00 .

sudo chmod -R 755 /var/www/html
sudo chown -R www-data:www-data /var/www/html

sudo ufw status
Status: active
To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw reload

9.3 Debugging Techniques Used

sudo cat /var/log/nginx/access.log

sudo nginx -t

curl -v localhost

sudo service nginx status

10. CONFIGURATION FILES

10.1 Nginx Configuration

Location: /etc/nginx/sites-available/default

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    server_name _;
    root /var/www/html;
    index index.html;
    
    location / {
        try_files $uri $uri/ =404;
    }
    
    location /api/read {
        limit_except GET { deny all; }
        return 200 '{"status": "200 OK"}';
    }
    
    location /api/submit {
        limit_except POST { deny all; }
        return 201 '{"status": "201 Created"}';
    }
    
    location /api/update {
        limit_except PUT { deny all; }
        return 200 '{"status": "200 OK"}';
    }
    
    location /api/delete {
        limit_except DELETE { deny all; }
        return 204 '{"status": "204 No Content"}';
    }
    location /redirect {
        return 301 https://github.com/banituze;
    }
}

10.2 HAProxy Configuration

Location: /etc/haproxy/haproxy.cfg

frontend lb-frontend
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }
    bind *:443 ssl crt /etc/letsencrypt/live/web.banituze.tech/banituze.pem
    default_backend lb-backend

backend lb-backend
    balance roundrobin
    server web01 3.86.59.154:80 check
    server web02 54.227.118.239:80 check

10.3 UFW Rules

sudo ufw status numbered

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 443/tcp                    ALLOW IN    Anywhere
[ 3] 80/tcp                     ALLOW IN    Anywhere

11. KEY LEARNINGS

12. CHALLENGES FACED

13. FUTURE IMPROVEMENTS

14. CONCLUSION

This project successfully demonstrated the implementation of a complete production-ready web infrastructure without backend development. We accomplished all seven required tasks, implementing SSH authentication, web server configuration, API interaction, load balancing, SSL/TLS encryption, firewall security, and systematic debugging.

The infrastructure deployed meets industry standards for security, availability, and performance. Through hands-on implementation, our team gained practical experience with essential DevOps tools and practices including Nginx web server, HAProxy load balancer, Let's Encrypt SSL certificates, UFW firewall, OpenSSH server, and Postman API testing.

The knowledge and skills acquired through this project provide a solid foundation for managing production infrastructure in real-world scenarios. Our team is prepared to demonstrate the live system and explain the technical implementation decisions made throughout the deployment process.