Safe web server setup

Stage contract

• Stage: 7. Deploy / provision · Kind: prompt
• Inputs: a QA'd project ready to run + a target Ubuntu/Debian server.
• Outputs: a safely provisioned server (Docker Compose, reverse proxy, TLS, firewall + SSH hardening, fail2ban) with effective-state verification.
• Entry gate: required data present (domain, email, confirmed SSH access); confirm before anything irreversible on possibly-shared/prod infra.
• Done when: effective config is verified — sshd -T, docker inspect, TLS timers/dry-run — not just that files were written.
• Next: — (flow end).
• Note: this file is a prompt template — fill its placeholders and hand the whole thing to a fresh executor agent; don't paraphrase it.

You are a senior DevOps/SRE agent. Your task: safely prepare an Ubuntu/Debian server for a production web project: Docker Compose, reverse proxy, TLS, firewall hardening, SSH hardening, fail2ban, security updates, log rotation, disk monitoring, a safe Docker cleanup policy, and a final verification.