Yep.
I have friends in the SMB space, one thing they do is a regular backup verification (quarterly). At that frequency, restoring even a few files (especially to a new VM), is very indicative, especially if it’s a large dataset (e.g. Quickbooks).
In Enterprise, we do all sorts of validation, depending on the system. Some is performed as part of Data Center operations, some is by IT (those are separate things), some by Business Unit management and their IT counterparts.
Great summary!
Why Debian or Ubuntu? (I have my own thoughts, but it would be useful to show even high-level reasons why they’re preferred).
Re: Backup - Backblaze has a great writeup on backup approach today. I’m a fan of cloud being part of the mix (I use a combo of local replication and cloud, to mitigate different risks). Getting people to include backup from the start will help them long-term, so great you included it!
Not seeing why you need WordPress.
The safest way I can see to make a secure connection across an untrusted network is to use a VPN of some sort, specifically a mesh network like Wireguard or Tailscale.
Tailscale has the advantage of being almost zero config, plus has the Serve and Funnel features which provide a mechanism to allow specific traffic into your Tailscale network.
Edit: Tailscale Serve is probably what I’d use.
And backup, proper backup.
Very good point about Agile.
As an end-user (that is, the IT staff that will be deploying/managing things), I prefer less-frequent releases. I’d love to see 1 or 2 releases a year for all software (pipe dream, I know). Once you have a handful of packages, you end up with constant change to manage.
I suspect what we end up with is early adopters embracing the frequent releases, and providing feedback/error reporting, while people like me benefit from them while choosing to upgrade less frequently.
There are about 3 apps that I’m a beta tester for, so even I’m part of that early-adopter group.
Documentation has been mentioned already, what I’d add to that is planning.
Start with a list of high-level objectives, as in “Need a way to save notes, ideas, documents, between multiple systems, including mobile devices”.
Then break that down to high-level requirements such as “Implement Joplin, and a sync solution”.
Those high-level requirements then spawn system requirements, such as Joplin needs X disk space, user accounts, etc.
Each of those branches out to technical requirements, which are single-line, single-task descriptions (you can skip this, it’s a nice-to-have):
“Create folder Joplin on server A”
“Set folder permissions XYZ on Joplin folder”
Think of it all as a tree, starting from your objectives. If you document it like this first, you won’t go doing something as you build that you won’t remember why you’re doing it, or make decisions on the fly that conflict with other objectives.