Learning DevOps on a Budget VPS: A 30-Day Hands-On Roadmap

DevOps skills are in high demand, but most training resources assume access to cloud infrastructure that can get expensive. A $5/month budget VPS gives you a real Linux server where you can practice provisioning, automation, containerization, monitoring, and CI/CD pipelines — all for less than a streaming subscription. This 30-day roadmap walks you through building a complete DevOps toolkit on a single budget VPS. Start by picking a plan with at least 1 GB RAM from our VPS comparison table.

Skills Covered in This Roadmap

• Linux system administration (SSH, user management, firewalls, systemd)
• Automation with shell scripting and Ansible
• Containerization with Docker and Docker Compose
• Infrastructure monitoring with Prometheus and Grafana
• CI/CD pipelines with GitHub Actions and self-hosted runners
• Reverse proxying and SSL termination with Nginx and Let’s Encrypt

What You Need to Start

• A budget VPS: 1 GB RAM, 1 vCPU, 20 GB SSD minimum
• Ubuntu 24.04 LTS or Debian 12 installed
• A terminal on your local machine (Linux, macOS, or WSL on Windows)
• Basic command-line familiarity (cd, ls, nano, ssh)

Week 1: Linux Foundations and Server Hardening

Day 1: Initial Server Setup

Provision your VPS and SSH in as root. Create a non-root user with sudo: adduser devops && usermod -aG sudo devops. Disable root SSH login by editing /etc/ssh/sshd_config and setting PermitRootLogin no. Restart SSH with sudo systemctl restart ssh and verify you can log in as the new user.

Day 2: SSH Key Authentication

Generate an Ed25519 key pair on your local machine: ssh-keygen -t ed25519. Copy the public key to the server: ssh-copy-id devops@your-server-ip. Disable password authentication in sshd_config: PasswordAuthentication no. Restart SSH. From this point on, only your key can authenticate.

Day 3: UFW Firewall

Enable the Uncomplicated Firewall: sudo ufw enable. Allow SSH: sudo ufw allow 22/tcp. If you plan to serve web traffic later, also allow ports 80 and 443: sudo ufw allow 80/tcp && sudo ufw allow 443/tcp. Verify with sudo ufw status verbose.

Day 4: Fail2ban Intrusion Prevention

Install fail2ban: sudo apt install fail2ban -y. Copy the default config: sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local. Set bantime = 3600 and maxretry = 5. Enable and start the service: sudo systemctl enable fail2ban && sudo systemctl start fail2ban. Check bans with sudo fail2ban-client status sshd.

Day 5: Automatic Security Updates

Run sudo apt update && sudo apt upgrade -y. Install unattended-upgrades: sudo apt install unattended-upgrades -y. Configure it to auto-install security patches: sudo dpkg-reconfigure --priority=low unattended-upgrades. This keeps the server patched without manual intervention.

Days 6–7: Automation Script

Write a shell script called bootstrap.sh that automates the entire Week 1 setup: create the user, copy SSH keys, configure UFW, install fail2ban, and set up unattended upgrades. Test it on a fresh VPS instance. This is your first real automation artifact.

Week 2: Configuration Management with Ansible

Day 8: Install Ansible

Install Ansible on your local machine: sudo apt install ansible -y. Create an inventory file: echo "[vps] your-server-ip" > inventory.ini. Test connectivity: ansible vps -i inventory.ini -m ping -u devops.

Day 9: First Playbook

Write a playbook that installs Nginx. Structure it with a YAML header, host definition, and tasks section. Run it with ansible-playbook -i inventory.ini nginx.yml. Visit your server’s IP in a browser — you should see the Nginx welcome page.

Day 10: Templates and Variables

Create an Nginx virtual host configuration using Ansible’s Jinja2 templating. Define a templates/ directory with a .j2 file that accepts variables for server name and document root. This teaches configuration-as-code, a core DevOps principle.

Day 11: Ansible Roles

Refactor your playbooks into roles. Create roles for common (SSH, firewall, fail2ban), nginx, and monitoring. Use ansible-galaxy init role_name to scaffold each one. Roles are how production DevOps teams organize reusable automation.

Days 12–14: Deploy a Static Site

Create a simple HTML page. Write an Ansible playbook that deploys it to your VPS, configures Nginx to serve it, and provisions a Let’s Encrypt SSL certificate using the geerlingguy.certbot community role. This gives you a fully automated deployment pipeline from scratch.

Week 3: Containers with Docker

Day 15: Install Docker

Install Docker via the official script: curl -fsSL https://get.docker.com | sudo sh. Add your user to the docker group: sudo usermod -aG docker $USER. Log out and back in, then verify with docker run hello-world.

Day 16: Docker Compose

Install Docker Compose: sudo apt install docker-compose-plugin -y. Write a docker-compose.yml that runs WordPress and MySQL in separate containers. This is a common multi-service pattern: one container for the application, one for the database.

Day 17: Writing a Dockerfile

Write a Dockerfile for a simple Python Flask application. Build it: docker build -t flask-app .. Run it and verify the endpoint responds. This teaches containerizing applications from the ground up.

Day 18: Nginx Reverse Proxy

Configure Nginx as a reverse proxy in front of your Docker containers. Use proxy_pass to forward requests to the Flask app. Add SSL with certbot. Your containerized application is now accessible over HTTPS.

Day 19: Resource Limits

Set Docker resource constraints: --memory=256m --cpus=0.5. On a budget VPS with limited RAM, this is critical. Monitor usage with docker stats and reclaim disk space with docker system prune.

Days 20–21: Multi-Service Stack

Deploy a full stack: Nginx (reverse proxy) + Flask (app) + PostgreSQL (database) + Redis (cache). Use Docker Compose with health checks, named volumes for data persistence, and a custom bridge network. This is a production-adjacent architecture running on a $5/month server.

Week 4: Monitoring and CI/CD

Day 22: Prometheus and Node Exporter

Deploy Prometheus and Node Exporter using Docker. Configure Node Exporter to expose system metrics (CPU, RAM, disk, network) and set Prometheus to scrape them every 15 seconds.

Day 23: Grafana Dashboards

Install Grafana and connect it to Prometheus as a data source. Import the Node Exporter Full dashboard (ID 1860) and customize it to highlight the metrics that matter on a budget VPS: memory pressure, disk I/O, and CPU load.

Day 24: Alerting

Configure Alertmanager to send notifications when disk usage exceeds 80% or when the server is unreachable for 5 minutes. Use a free Slack webhook or email channel. This is production-grade monitoring on a cheap VPS.

Day 25: Self-Hosted GitHub Actions Runner

Set up a self-hosted GitHub Actions runner on your VPS. Create a workflow that runs tests on every push. The runner executes on your VPS, so you see how CI/CD functions without paying for hosted runners.

Day 26: Deployment Pipeline

Extend the workflow: on pushes to main, SSH into the VPS, pull the latest Docker image, and restart the container. This is a working CI/CD pipeline — code goes from commit to production in under a minute.

Days 27–28: Centralized Logging

Install Loki and Promtail. Configure Promtail to ship Docker container logs to Loki. View logs alongside metrics in Grafana. You now have centralized logging for your entire stack.

Days 29–30: Capstone Project

Destroy your VPS and reprovision it from scratch. Using only your Ansible playbooks and Docker Compose files, redeploy the entire stack: hardened server, reverse proxy with SSL, containerized app, monitoring, and CI/CD. If the full redeploy takes under 30 minutes, you have built a genuine, transferable DevOps skill set.

What You Accomplished

After 30 days on a $5/month VPS, you have a complete DevOps lab: provisioning, configuration management, containers, monitoring, alerting, logging, and CI/CD. These are the exact skills that companies hire for. The VPS cost you $5; equivalent skills from a bootcamp would cost thousands. Check the latest budget VPS deals on our homepage to start your journey.

Next Steps After the Roadmap

• Add Kubernetes (k3s) on a second VPS to learn cluster orchestration
• Implement Infrastructure as Code with Terraform
• Set up WireGuard VPN on your VPS for secure remote access
• Document your setup in a blog post — it serves as a portfolio piece

The barrier to learning DevOps is access to infrastructure. A $5 budget VPS removes that barrier entirely.