Plan a reliable server for a small business

Decide whether you need a server at all

Write down what the server must do: shared files, an accounting application, automation, a domain controller. If everything your team uses is already online, a cloud service may be cheaper and simpler.

A local server makes sense when you need fast access to large files, want your data on your own premises, or run software that must stay on your network.

Size the hardware for today, with room to grow

As a starting point for an office of up to about 15 people running file sharing and a few small services, plan for a 4 to 8 core CPU, 16 to 32 GB of RAM and two SSDs in a mirror (RAID 1). Heavy databases, many virtual machines or local AI need considerably more, so size from your own list.

Choose hardware that can take more RAM and storage later. It is usually cheaper to upgrade than to replace.

RAID protects you from a failed disk. It is not a backup: a deleted file or ransomware is copied to both disks instantly.

Protect power and network

Connect the server to a UPS so a power cut does not corrupt data, and configure it to shut down cleanly when the battery runs low. Give the server a fixed IP address, and keep it away from your guest Wi-Fi.

Install and secure the base system

After installing Ubuntu Server, apply updates, turn on automatic security updates, and allow only the network access you need.

sudo apt update && sudo apt upgrade -y
sudo apt install -y unattended-upgrades smartmontools
sudo dpkg-reconfigure -plow unattended-upgrades

# Allow remote administration, then turn on the firewall
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status

Back up with the 3-2-1 rule

Keep 3 copies of your data, on 2 different types of storage, with 1 copy away from the office. Restic is a free tool that makes encrypted, versioned backups. This example backs up to an external disk mounted at /mnt/backup.

sudo apt install -y restic

# Create the backup repository once. It asks you to set a password.
restic -r /mnt/backup/restic init

# Run a backup, then list what you have
restic -r /mnt/backup/restic backup /srv/data
restic -r /mnt/backup/restic snapshots

Store the restic password somewhere safe outside the server. Without it the backup cannot be read by anyone, including you.

Test a restore, then keep watching the server

A backup you have never restored is only a hope. Restore to a temporary folder and open a few files. Repeat this on a schedule, and check the health of your disks regularly.

restic -r /mnt/backup/restic restore latest --target /tmp/restore-test
ls -R /tmp/restore-test | head

# Check disk health (replace sda with your disk)
sudo smartctl -H /dev/sda