DigitalOcean Droplet & SSL Setup

Connect to the droplet via SSH. Accept the remote host verification prompt when prompted to register the key fingerprint in your local known_hosts.

ssh -p 22 root@<IPv4 Address>

Type yes when asked "The authenticity of host ... can't be established".

Purge stale package lists to avoid 404 mirror errors, then apply all OS updates:

sudo rm -rf /var/lib/apt/lists/*
sudo apt update
sudo apt upgrade -y
sudo apt autoremove -y

To get safety against memory spikes without degrading SSD performance or causing I/O thrashing, configure a conservative swappiness and cache pressure:

1. Create and Secure a 1 GB Swap File

fallocate -l 1G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab

2. Tune Kernel Parameters (/etc/sysctl.conf)

Add or update these values to make swap an emergency buffer rather than active memory:

• vm.swappiness=10: Tells the kernel to avoid swapping unless physical RAM is ~90% full (default is 60).
• vm.vfs_cache_pressure=50: Encourages the kernel to retain directory and inode caches in RAM rather than dropping them aggressively.

sysctl vm.swappiness=10
sysctl vm.vfs_cache_pressure=50

Install the web server and configure proper file ownership:

sudo apt install nginx -y

Edit or create your landing page inside /var/www/html/index.html:

sudo nano /var/www/html/index.html

Set correct web server permissions:

sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 /var/www/html

Ensure an A Record is created in your DNS provider:

• Name: droplet
• Target: <IPv4 Address Here>

Create a dedicated server block config:

sudo nano /etc/nginx/sites-available/droplet.xtik.app

server {
    listen 80;
    listen [::]:80;

    server_name droplet.xtik.app;
    root /var/www/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Enable the site and reload Nginx:

sudo ln -s /etc/nginx/sites-available/droplet.xtik.app /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Allow HTTP/HTTPS traffic through UFW and run Certbot to configure SSL and automatic HTTPS redirection:

sudo ufw allow 'Nginx Full'
sudo ufw reload
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d droplet.xtik.app

Verify that the automated certificate renewal timer works cleanly:

sudo certbot renew --dry-run