Netcup DevOps & Self-Hosting Deployment Blueprints (Copy-Paste Configs)

# /etc/netplan/50-cloud-init.yaml (Netcup KVM Dual-Stack IPv4 + Routed /64 IPv6)
network:
  version: 2
  ethernets:
    eth0:
      match:
        macaddress: "xx:xx:xx:xx:xx:xx" # Keep your existing MAC address
      dhcp4: true
      dhcp6: false
      accept-ra: false
      addresses:
        - "2a0a:4cc0:0000:0000::1/64"   # Replace with your SCP /64 IPv6 address
        - "2a0a:4cc0:0000:0000::2/64"   # Optional: bind extra IPv6s from your /64
      nameservers:
        addresses:
          - 46.38.225.230               # Netcup Primary DNS
          - 46.38.252.230               # Netcup Secondary DNS
          - 2606:4700:4700::1111        # Cloudflare IPv6 DNS
      routes:
        - to: "::/0"
          via: "fe80::1"                # Netcup Link-Local IPv6 Gateway
          on-link: true

# Apply & test:
# sudo chmod 600 /etc/netplan/50-cloud-init.yaml
# sudo netplan apply
# ip -6 route show && ping6 -c 3 2606:4700:4700::1111

#!/usr/bin/env bash
# Production Hardening + Coolify v4 Setup on Netcup RS 1000 / RS 2000 G12.5
set -euo pipefail

# 1. System updates & UFW firewall rules
apt-get update && apt-get upgrade -y
apt-get install -y curl wget git ufw fail2ban jq
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 443/udp   # HTTP/3 QUIC
ufw allow 8000/tcp  # Initial Coolify dashboard (close after domain setup)
ufw --force enable

# 2. Configure Docker log limits before installing Coolify
mkdir -p /etc/docker
cat <<EOF > /etc/docker/daemon.json
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "20m",
    "max-file": "3"
  }
}
EOF

# 3. Install Coolify v4 (or replace with: curl -sSL https://dokploy.com/install.sh | sh)
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

# /etc/network/interfaces on Proxmox VE 8 Host (Netcup Root Server G12.5)
auto lo
iface lo inet loopback

auto ens3
iface ens3 inet static
    address <YOUR_PUBLIC_IPV4>/22
    gateway <YOUR_IPV4_GATEWAY>

iface ens3 inet6 static
    address 2a0a:4cc0:xxxx:xxxx::1/128
    gateway fe80::1

# Internal Bridge for KVM VMs & LXC Containers (10.10.10.0/24 + Public /64 IPv6)
auto vmbr0
iface vmbr0 inet static
    address 10.10.10.1/24
    bridge-ports none
    bridge-stp off
    bridge-fd 0
    post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o ens3 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o ens3 -j MASQUERADE

iface vmbr0 inet6 static
    address 2a0a:4cc0:xxxx:xxxx::2/64
    post-up   echo 1 > /proc/sys/net/ipv6/conf/all/forwarding

# 1. Verify your Netcup IPv4 & IPv6 Reverse DNS (PTR) matches your HELO hostname
IPV4=$(curl -4 -s https://icanhazip.com)
IPV6=$(curl -6 -s https://icanhazip.com)
echo "IPv4 ($IPV4) PTR -> $(dig +short -x "$IPV4")"
echo "IPv6 ($IPV6) PTR -> $(dig +short -x "$IPV6")"

# 2. Install Mailcow Dockerized on Netcup RS 1000 G12.5 (8GB DDR5 ECC RAM)
umask 0022
cd /opt
git clone https://github.com/mailcow/mailcow-dockerized
cd mailcow-dockerized
./generate_config.sh
# Set MAILCOW_HOSTNAME=mail.yourdomain.com & TZ=UTC
docker compose pull
docker compose up -d

# /etc/sysctl.d/99-netcup-2.5g-bbr.conf
# Optimized for Netcup G12.5 2.5 Gbps NIC & High-BDP International Links
cat << 'EOF' | sudo tee /etc/sysctl.d/99-netcup-2.5g-bbr.conf
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
net.core.rmem_max = 33554432
net.core.wmem_max = 33554432
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.tcp_wmem = 4096 65536 33554432
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_mtu_probing = 1
net.ipv4.tcp_slow_start_after_idle = 0
net.core.netdev_max_backlog = 16384
EOF

sudo sysctl --system
sysctl net.ipv4.tcp_congestion_control net.core.default_qdisc