Secure Omada VPS Deployment

I am ready to launch a fresh Ubuntu-based VPS that will host the TP-Link Omada Cloud SDN Controller, and I want the environment to be production-ready from day one. Your task is to install the latest Omada software, tune the underlying Ubuntu system, and lock everything down with an intermediate security posture: firewall rules, automated updates, and a proven intrusion-prevention layer (e.g., Fail2Ban or similar).

Once the controller is up, I will also need a concise document that shows:
• every step you took during installation and hardening,
• all credentials or certificates generated,
• and a clear, vendor-agnostic backup strategy (where to store the archives, how often to run them, and the exact commands or scripts).

Feel free to recommend S3, rsync to another VPS, or any other secure off-site target, but back your choice with reasoning.

When you reply, please outline:
1. your step-by-step approach,
2. an estimated timeline from VPS login to hand-over,
3. examples of previous Omada or comparable controller deployments you have completed.

I will provide fresh root credentials on approval, and I am happy to schedule a quick call if you need to confirm any version or port requirements before starting.