Skip to main content

COMMUNITY KNOWLEDGE FORUM Independent Hosting Community • Not affiliated with netcup GmbH.

EN DE 中文
NETCUP GUIDE
FORUM · LIVE VOUCHER POOL
Production Engineering Runbooks Verified on Ubuntu 24.04 LTS & Debian 12

Netcup Technical Knowledge Base & Tutorials

Every tutorial includes prerequisites, difficulty rating, estimated completion time, tested commands, command explanations, expected outputs, security notes, and troubleshooting steps for Ubuntu 24.04 LTS and Debian 12 on Netcup KVM servers.

Featured Runbook #1 Ubuntu 24.04 LTS / Debian 12 • Netplan

1. Netcup Native /64 IPv6 Static Routing (fe80::1 Link-Local Gateway & on-link: true)

Netcup allocates a static /32 IPv4 address and a full routed /64 IPv6 subnet (e.g., 2a03:4000:xx:xxxx::/64) to every VPS and Root Server, routed via the hypervisor bridge’s link-local gateway fe80::1. Use the production Netplan configuration below in /etc/netplan/50-cloud-init.yaml: 

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: true
      dhcp6: false
      accept-ra: false
      addresses:
        - "2a03:4000:60:1234::1/64"
        - "2a03:4000:60:1234::2/64"
      routes:
        - to: "::/0"
          via: "fe80::1"
          on-link: true
      nameservers:
        addresses:
          - 46.38.225.230
          - 46.38.252.230
          - 2a03:4000:0:1::e1e6

Verification Command: Set strict permissions with sudo chmod 0600 /etc/netplan/*.yaml, apply safely with sudo netplan try --timeout 60, and verify connectivity via ping6 -c 4 2606:4700:4700::1111. Also ensure ICMPv6 is permitted in your SCP Stateful Firewall for Neighbor Discovery Protocol (NDP). Read Full IPv6 Tutorial →

Featured Runbook #2 Docker Engine + UFW + SCP Firewall

2. Fixing the Docker UFW Firewall Bypass (DOCKER-USER Chain & SCP Stateful Firewall)

Running docker run -p 5432:5432 manipulates the Linux kernel’s iptables nat (PREROUTING) and DOCKER chains before UFW’s INPUT chain—exposing container ports to the public internet even when ufw default deny incoming is active. Combine loopback binding with DOCKER-USER filtering: 

# Defense 1 (Recommended): Bind container ports strictly to 127.0.0.1 in docker-compose.yml
ports:
  - "127.0.0.1:5432:5432"

# Defense 2: Append DOCKER-USER rules to /etc/ufw/after.rules to block direct eth0 -> container traffic
*filter
:ufw-user-forward - [0:0]
:ufw-docker-logging-deny - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j ufw-user-forward
-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12
-A DOCKER-USER -j RETURN
-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
-A ufw-docker-logging-deny -j DROP
COMMIT

Defense 3 (Netcup Hypervisor Advantage): Enable the Netcup SCP Stateful Firewall at the hypervisor NIC level to allow only TCP 22, 80, 443 and UDP 443/51820, dropping any accidentally exposed container port before packets ever reach your VM. Read Full Docker Security Tutorial →

All 15 Production Engineering & Linux Administration Tutorials

Beginner 25 minutes

How to Set Up & Harden Ubuntu 24.04 LTS on a Netcup VPS or Root Server (Production Runbook)

When a fresh Netcup VPS or Root Server finishes installing Ubuntu 24.04 LTS inside the Server Control Panel (SCP), the initial 25 minutes of systems engineering determine whether your server runs reliably for years or suffers from unquiesced snapshot corruption, SSH brute-force floods, and suboptimal TCP throughput. This production runbook walks through verifying KVM paravirtualized drivers, installing the QEMU Guest Agent for live SCP snapshot freeze hooks, creating an unprivileged administrative account, tuning NVMe swap and TCP BBR congestion control for high-bandwidth VirtIO interfaces, and locking down dual-stack network exposure.

Verified on Ubuntu 24.04 Open Tutorial →
Beginner 20 minutes

How to Install Docker Engine on a Netcup VPS or Root Server (And Fix the UFW Firewall Bypass)

Because every Netcup VPS and Root Server runs on full QEMU/KVM hardware virtualization rather than shared-kernel LXC/OpenVZ containers, Docker Engine runs at native speed with zero cgroupv2 or overlay2 restrictions. However, simply running apt install docker.io leaves you with outdated distribution packages, unbounded container JSON logs that will eventually fill your SSD/NVMe disk, and a dangerous security flaw where Docker silently bypasses UFW firewall rules. This guide installs the official upstream Docker CE suite and hardens both daemon logging and network port binding.

Verified on Ubuntu 24.04 Open Tutorial →
Beginner 25 minutes

How to Deploy High-Performance WordPress on Netcup (Plesk Webhosting vs Docker + Redis Stack)

Netcup gives you two distinct architectural paths for hosting WordPress, and choosing the right one upfront prevents painful migrations later. Path A uses Netcup Managed Webhosting (Webhosting 2000 or 4000), providing managed Plesk Obsidian, inclusive .de domains, managed Postfix/Dovecot mail, and zero Linux kernel maintenance. Path B uses a Netcup KVM server (such as the 8 GB ECC RAM VPS 1000 G12.5 or the 4-core dedicated AMD EPYC RS 1000 G12.5) to run an isolated Docker Compose stack with PHP 8.3 OPcache, MariaDB 11 tuned InnoDB buffer pools, and persistent in-memory Redis Object Caching for sub-50ms Time to First Byte (TTFB). Below are the complete production runbooks for both architectures.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 20 minutes

How to Configure Nginx as a High-Performance HTTP/2 & HTTP/3 Reverse Proxy on Netcup

Placing a tuned Nginx edge reverse proxy in front of your Docker containers, Node.js/Go APIs, or Python Gunicorn workers on a Netcup server lets you terminate TLS 1.3 and HTTP/3 (QUIC) in one place, pool upstream keepalive connections, enforce per-IP rate limiting against credential stuffing, and serve static assets directly from Linux kernel page cache (sendfile on). This guide provides a complete production Nginx configuration tailored for multi-core AMD EPYC Netcup nodes.

Verified on Ubuntu 24.04 Open Tutorial →
Beginner 20 minutes

How to Set Up Cloudflare on Netcup (Full Strict SSL, Real Visitor IPs & Origin Firewall Lock)

Placing Cloudflare’s Anycast CDN and Web Application Firewall (WAF) in front of your Netcup VPS or Root Server caches static assets at 300+ global edge PoPs and shields your origin IP. However, three mistakes plague 80% of Cloudflare deployments: using "Flexible" SSL (which sends unencrypted HTTP across the internet to Nuremberg/Vienna), logging Cloudflare edge IPs instead of real visitor IPs in Nginx/Fail2ban, and leaving ports 80/443 open to non-Cloudflare IPs so attackers can bypass your WAF entirely. This runbook fixes all three.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 20 minutes

How to Configure Routed IPv6 (/64), Gateway fe80::1, rDNS & Docker IPv6 on Netcup

Every Netcup VPS and Root Server—across the entire Generation 11.5s and Generation 12.5 lineup—includes a dedicated static IPv4 (/32) address and a routed IPv6 /64 subnet (2a03:4000:... in Europe) containing 1.84 × 10¹⁹ addresses. However, Netcup’s IPv6 network architecture uses a fixed link-local default gateway (fe80::1) and requires Router Advertisements (accept-ra: false) to be disabled when configuring static IPv6 addresses. Misconfiguring this single detail causes intermittent IPv6 route drops every few minutes. Here is the exact configuration for Ubuntu 24.04 Netplan, Debian 12, Reverse DNS (PTR), and Docker IPv6.

Verified on Ubuntu 24.04 Open Tutorial →
Beginner 15 minutes

How to Set Up Ed25519 SSH Keys, Multiplexing & OpenSSH Hardening on Netcup

Every public IPv4 address on the internet is probed by automated SSH password-guessing botnets within 90 seconds of coming online. Replacing password authentication with modern Ed25519 elliptic-curve keys (ssh-ed25519)—or hardware-backed FIDO2/YubiKey keys (ssh-ed25519-sk)—reduces the probability of brute-force compromise to zero. This guide covers high-KDF key generation, client connection multiplexing (ControlMaster), modern OpenSSH cipher/KEX hardening, and Ubuntu 24.04’s new ssh.socket architecture.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 25 minutes

How to Secure a Linux VPS or Root Server on Netcup (5-Layer Defense-in-Depth Blueprint)

Relying on a single security control (such as UFW alone) leaves a production server brittle: a single docker run -p command can bypass UFW, and a single unpatched OpenSSL library in memory remains vulnerable even after apt upgrade unless the daemon is restarted. This guide implements a 5-layer defense-in-depth architecture specifically engineered for Netcup KVM servers across the Generation 11.5s and Generation 12.5 lineup.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 35 minutes

How to Install Docker Compose v2 & Architect Hardened Multi-Container Stacks on Netcup

The legacy Python-based docker-compose v1 binary is end-of-life, unmaintained, and incompatible with modern BuildKit and Compose Specification features. On Netcup KVM VPS and Root Server instances, production container orchestration relies on the Go-based Docker Compose v2 CLI plugin (docker compose). This systems engineering runbook covers verified binary installation, multi-tier network segmentation (internal: true backend bridges), deterministic startup ordering via service_healthy probes, cgroupv2 memory and CPU enforcement tailored for 8 GB Netcup nodes, file-based Docker secrets, and systemd unit wrappers.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 40 minutes

How to Deploy a Zero-Downtime Production Website with Docker, Caddy v2 & GitHub Actions on Netcup

Deploying a production web application on a Netcup VPS or Root Server requires more than exposing port 80 on a single container. A resilient architecture terminates TLS 1.3 and HTTP/3 (QUIC) at an edge reverse proxy, isolates PostgreSQL and Redis on an air-gapped internal network, tunes Linux kernel UDP buffers for high-speed QUIC delivery, and performs zero-downtime rolling updates when new commits land on main. This end-to-end engineering tutorial builds that complete stack using Docker Compose v2, Caddy v2, PostgreSQL 16, Redis 7, and an automated GitHub Actions SSH deployment pipeline.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 35 minutes

How to Build a Dual-Stack (IPv4 + IPv6) WireGuard VPN Server with Unbound DNS on Netcup

Because every Netcup VPS and Root Server uses hardware-assisted KVM virtualization with a native kernel, up to 2.5 Gbit/s network interfaces, a routed /64 IPv6 subnet, and generous fair-use traffic across Nuremberg, Vienna, Amsterdam, Manassas, and Singapore, even a 1 GB RAM entry-level KVM instance easily handles hundreds of megabits of encrypted tunnel traffic. This systems engineering guide builds a hardened, dual-stack (IPv4 + IPv6) WireGuard VPN gateway complete with MTU 1420 encapsulation tuning, TCP MSS clamping to prevent Path MTU blackholes, a local recursive Unbound DNS resolver for zero-leak privacy, and an automated peer provisioning script using post-quantum-resistant PresharedKey secrets.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 35 minutes

How to Monitor Netcup Server Resources: CPU Steal (%st), NVMe Latency & Prometheus + Grafana

When a database query slows down or an API endpoint spikes from 15 ms to 600 ms on a virtualized server, guessing is not an engineering strategy. On Netcup KVM hosts, true observability requires distinguishing between guest CPU saturation (%usr/%sys) and hypervisor noisy-neighbor contention (%st CPU steal time), measuring NVMe block queue depth (aqu-sz) and read/write await latency (r_await/w_await), inspecting Linux kernel Pressure Stall Information (/proc/pressure/*), and visualizing historical trends. This guide covers both low-level CLI diagnostics and deploying a secure, loopback-bound Prometheus + Node Exporter + cAdvisor + Grafana telemetry stack.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 40 minutes

How to Engineer Automated 3-2-1 Backups on Netcup: SCP Snapshots, Atomic DB Dumps & Encrypted Restic

Hardware RAID10 NVMe arrays inside Netcup’s Nuremberg, Vienna, and Amsterdam data centers protect your server against physical SSD wear-out, but they offer zero protection against accidental DROP TABLE, rogue migration scripts, rm -rf, or credential compromise. Furthermore, Netcup’s built-in Server Control Panel (SCP) snapshots use Copy-on-Write (CoW) allocations on the same underlying storage pool—meaning they consume your VM’s free disk space and are not an off-site disaster recovery backup. This runbook implements a battle-tested 3-2-1 backup architecture combining qemu-guest-agent-consistent SCP snapshots for pre-upgrade rollbacks with automated, atomic database dumps and AES-256 encrypted daily off-site Restic backups orchestrated via systemd timers.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 30 minutes

How to Install & Harden a Self-Hosted Control Panel on Netcup: Coolify v4, CloudPanel v2 & HestiaCP

Commercial control panel licenses like cPanel and Plesk now cost more per month than a high-memory KVM server itself. In 2026, three mature, open-source/free control panels dominate Netcup deployments, each engineered for a distinct workload: Coolify v4 (a Docker-based self-hosted Heroku/Vercel/DigitalOcean App Platform replacement), CloudPanel v2 (an ultra-lightweight native Nginx + multi-PHP-FPM + MySQL/Redis stack for WordPress, Laravel, and Node.js), and HestiaCP (a classic multi-tenant web, DNS, and full Exim4/Dovecot mail hosting panel). This guide compares their exact memory footprints, walks through audited installation, locks down raw administrative ports (8000, 8443, 8083) behind the Netcup SCP Firewall, and configures automated backups.

Verified on Ubuntu 24.04 Open Tutorial →
Intermediate 30 minutes

How to Troubleshoot Netcup VPS & Root Server Networking: AS197540 MTR, IPv6 fe80::1, MTU & VNC Recovery

When a production Netcup VPS or Root Server stops responding to SSH after a kernel upgrade, drops IPv6 connections after 15 minutes of uptime, or exhibits intermittent latency to a specific ISP, random reboots only obscure the root cause. Netcup’s KVM network architecture (AS197540) uses specific routing conventions—most notably a /32 or /22 IPv4 gateway and a deterministic link-local fe80::1 IPv6 default gateway—alongside two independent firewall layers (the hypervisor-level SCP Stateful Firewall and your guest OS ufw/nftables). This diagnostic runbook provides a structured Layer-2 through Layer-7 methodology to isolate and resolve every major Netcup networking failure.

Verified on Ubuntu 24.04 Open Tutorial →