Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteYes. A VPS can host a production WebSocket server. The most practical design is to run your WebSocket application on a private loopback address such as 127.0.0.1:8080, put NGINX on the public interface, terminate TLS there, and proxy secure wss:// connections to the application. This guide covers the network layout, NGINX upgrade headers, firewalls, systemd supervision, idle timeouts, testing, and scaling decisions you need to make in 2026.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a VPS does—and does not—provide for WebSockets
A virtual private server gives you an internet-reachable Linux machine, a public IP address, administrator access, storage, memory, CPU time, and control over listening services. That is enough to run a WebSocket application continuously, provided the provider allows the required network traffic and your instance has sufficient resources for the workload.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA VPS does not automatically provide a WebSocket runtime, TLS certificate, reverse proxy, process supervisor, DNS record, or firewall policy. You must configure those components. A connection that works on localhost can still fail from the public internet if DNS, security groups, host firewall rules, NGINX upgrade headers, or certificate settings are wrong.
The recommended production architecture
Use a two-layer arrangement rather than exposing the application process directly:
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
- A DNS name such as
ws.example.compoints to the VPS public IP address. - NGINX listens on ports 80 and 443 on the public interface.
- HTTPS on port 443 carries the WebSocket handshake. NGINX terminates TLS and accepts
wss://ws.example.com/.... - NGINX forwards the upgraded connection over plain HTTP to the application at
127.0.0.1:8080. - The application is managed by systemd under a non-root account.
Binding the application to loopback means that only local processes can reach the backend port. Internet clients can reach NGINX, but they cannot bypass its TLS, authentication, origin, logging, and rate-control policies. The reverse proxy also gives you one place to renew certificates and add additional WebSocket locations later.
Choose the deployment shape before installing anything
| Decision | Recommended starting point | When another choice is justified |
|---|---|---|
| TLS termination | NGINX terminates TLS; the application uses HTTP on loopback. | Let the application terminate TLS only when it must own certificates or use protocol-specific TLS features. |
| Public exposure | Expose ports 80/443 and keep the application on loopback. | Expose the application directly only for a deliberate, controlled design with its own TLS and hardening. |
| Process supervision | systemd service with an unprivileged user and Restart=on-failure. |
Use a container supervisor when your organization already operates containers and their health checks. |
| Idle connections | Set an NGINX read timeout longer than expected silence and send periodic ping frames. | Use a shorter timeout only when your protocol deliberately expires inactive clients. |
| Capacity planning | Measure the chosen VPS with your message rate, payloads, TLS usage, and client count. | Move to multiple instances and a load-balancing design when one instance cannot meet the measured target. |
There is no authoritative connection-count number that applies to every VPS. A lightweight service sending occasional messages can behave very differently from one performing encryption, fan-out, compression, database work, or large broadcasts. Treat capacity as a workload measurement, not a provider label.
Prerequisites and information to gather
- A VPS or cloud virtual machine running a supported Linux distribution.
- A public IPv4 address, and IPv6 if you intend to serve it.
- A DNS name whose A or AAAA record can point to the instance.
- Administrative access for the initial installation, followed by a dedicated unprivileged service account.
- Your WebSocket application’s start command, working directory, environment variables, and local listen port.
- Control of both firewall layers: the VPS operating-system firewall and the provider’s network firewall or security group.
- A TLS certificate and private key for the DNS name. NGINX commonly reads a full-chain certificate and its corresponding key from files under
/etc/letsencrypt/live/..., but the exact certificate issuer and paths depend on your setup.
Step-by-step VPS setup
1. Provision the machine and DNS name
Create the instance, record its public IP address, and create an A record (and AAAA record if applicable) for the WebSocket hostname. Wait for DNS to resolve before requesting a certificate. Do not use a private or changing address in a public DNS record.
2. Install the runtime and NGINX
Install the language runtime and dependencies required by your application, then install NGINX from your distribution’s supported package source. Keep the application code in a directory readable by its service account but not writable by the NGINX worker unless your design explicitly needs that.
3. Make the backend listen privately
Configure the application to listen on a high local port, for example 127.0.0.1:8080. Do not bind to 0.0.0.0 when NGINX is the intended public entry point. If the application supports separate HTTP and WebSocket paths, reserve a clear path such as /socket and use the same path in the client and proxy configuration.
4. Run it under systemd
Create a dedicated account and a service unit. Adapt the executable, working directory, and environment file to your application:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (4GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- CanaKit Mega Heat Sink - Black Anodized
[Unit]
Description=WebSocket application
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=websocket
Group=websocket
WorkingDirectory=/srv/websocket
EnvironmentFile=/etc/websocket/websocket.env
ExecStart=/usr/local/bin/websocket-app --host 127.0.0.1 --port 8080
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetSave the unit as /etc/systemd/system/websocket.service, then reload units, enable the service at boot, and start it. Check systemctl status websocket and inspect failures with journalctl -u websocket. A restart policy handles process crashes; it does not repair an invalid configuration, exhausted memory, or an application that exits cleanly with an error.
5. Verify locally before adding the proxy
Confirm that the process is listening only on the expected address and port. Test a WebSocket handshake from the VPS itself using a WebSocket-capable client, or use your application’s health endpoint if it provides one. If local connectivity fails, fix the application, runtime, credentials, or bind address before debugging NGINX.
Configure NGINX for the WebSocket upgrade
WebSockets begin as an HTTP request and then switch protocols. NGINX must use HTTP/1.1 to the upstream and explicitly forward the hop-by-hop Upgrade and Connection headers; those headers are not passed through automatically.
Place the map block in NGINX’s http context, then use a server block like this:
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 443 ssl;
server_name ws.example.com;
ssl_certificate /etc/letsencrypt/live/ws.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ws.example.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_read_timeout 3600s;
}
}The Host header preserves the requested hostname for virtual-host routing and origin checks. If your application needs the client address, add the usual forwarding headers and configure the application to trust them only from your NGINX instance.
After editing, validate the configuration before reloading NGINX. A syntax error should prevent a reload; correct it and inspect the NGINX error log rather than stopping the currently working process unnecessarily.
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
Add HTTP handling and TLS
Serve the WebSocket endpoint over wss:// for production browser clients. Browsers enforce mixed-content rules, so a page loaded over HTTPS generally cannot open an insecure ws:// connection. Keep port 80 available for certificate issuance and redirect ordinary HTTP requests to HTTPS once your certificate workflow is working.
Install a certificate whose name matches the WebSocket hostname, configure the full chain and private key in NGINX, and arrange renewal before expiry. Test renewal in the manner supported by your certificate tooling, then reload NGINX after a successful renewal. Never place a private key in the application repository or expose it through a downloadable web path.
Open the right ports in both firewall layers
Allow inbound TCP 80 and 443 at the provider’s network firewall or security group and at the VPS host firewall. Port 80 may be needed for HTTP redirection or certificate validation; port 443 carries client traffic. Allow SSH or another management port only from the administration networks that need it.
Do not open port 8080 publicly when the application is bound to loopback. If you deliberately bind the application to a private network address for a multi-node design, restrict that address to the proxy or load balancer’s security group instead of allowing the entire internet.
A rule in only one firewall layer is insufficient. A provider rule can block traffic before it reaches Linux, while the host firewall can block it after arrival. Confirm both effective rule sets whenever a port appears closed.
Test the complete handshake from outside
- Resolve the hostname from an external network and confirm it returns the intended public address.
- Open the endpoint with a WebSocket client using
wss://ws.example.com/and the path your application expects. - Confirm the TLS certificate name and chain are accepted by the client.
- Check NGINX access and error logs while connecting. A request that never appears usually indicates DNS, provider firewall, host firewall, or routing trouble.
- If NGINX logs a request but the handshake fails, verify
proxy_http_version 1.1, both upgrade headers, the upstream address, and the application’s expected path. - Authenticate with a real test account, send a message in each direction, close the client cleanly, and reconnect. This catches application-level failures that a successful HTTP upgrade does not reveal.
Why an apparently healthy connection disconnects after a minute
NGINX’s proxy_read_timeout is an idle timer, not a maximum WebSocket lifetime. The documented default is 60 seconds when the proxied server sends no data. A connection can therefore remain open indefinitely when traffic continues, yet close after roughly a minute of silence.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Set the timeout above the longest legitimate quiet period, as in proxy_read_timeout 3600s;, and make the application send WebSocket ping frames or another small protocol heartbeat more frequently than that interval. The client should answer pings or send its own heartbeat according to the protocol. Configure any application, load balancer, NAT, or provider-level idle timer as well; the shortest timer still wins.
When a client reports an abnormal close, compare its timestamp with NGINX logs and application logs. A regular interval strongly suggests an idle policy, while immediate closure points more often to certificate, authentication, origin, path, or upgrade-header problems.
Secure the endpoint before exposing it
- Use TLS: publish
wss://rather than sending credentials or messages over an unencrypted public connection. - Enforce origins: accept only the browser origins your application actually uses. An origin policy is not a replacement for authentication, but it prevents many unwanted browser-based cross-site connections.
- Authenticate during the handshake or immediately afterward: validate tokens, session cookies, or another credential before accepting sensitive operations.
- Limit resources: cap message size, subscription counts, queued data, and per-client send rates so one peer cannot exhaust memory or CPU.
- Run without root: the systemd account should have only the files and permissions required by the service.
- Keep the backend private: expose only the proxy ports and narrowly required management access.
- Log useful events: record connection attempts, authentication failures, close reasons, and resource limits without logging secrets or full sensitive payloads.
Plan capacity around measurements, not a universal VPS number
Concurrent connections consume memory even when idle. Active traffic adds CPU work for TLS, parsing, compression, serialization, and application logic. Broadcast workloads also multiply outbound bandwidth and queue pressure. Measure at least:
- simultaneous connected clients;
- messages and bytes per second in each direction;
- typical and maximum payload size;
- CPU, memory, file-descriptor, and network utilization;
- connection and reconnection rates during a failure;
- latency while the service is near its intended limit.
Use a realistic external load test and leave headroom for deployments, monitoring, certificate renewal, and reconnect storms. If one VPS is insufficient, add instances behind a WebSocket-capable load balancer and decide how clients will reach shared state. Long-lived connections make draining and rolling upgrades more consequential than ordinary short HTTP requests; provide a graceful shutdown path that stops new handshakes, informs existing clients, and lets them reconnect.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and fixes
502 or 504 from NGINX
Check that systemd reports the service as running, that it is listening on 127.0.0.1:8080, and that NGINX’s proxy_pass matches the address and port. Read both the service journal and NGINX error log. A crashed process, wrong working directory, missing environment variable, or permissions error must be fixed in the service rather than masked with proxy changes.
The browser reports a failed WebSocket handshake
Confirm the client uses the correct wss:// scheme and hostname, the certificate covers that hostname, and the URL path matches the NGINX location and application route. Then verify HTTP/1.1 and the Upgrade and Connection directives. A normal HTTP response from a route that was meant to upgrade usually means the request reached the wrong location or the backend did not recognize the handshake.
Best Value
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 32GB EVO+ Micro SD Card pre-loaded with 64-bit Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit 45W PD Power Supply for the Raspberry Pi 5
- Display Cable - 6 foot (Supports up to 4K 60p)
Works on the VPS but not from the internet
Check DNS, the provider security group, the host firewall, and whether NGINX is listening on the public interface. A loopback-only backend is expected; clients should connect to NGINX, not to port 8080.
Recommended Free Tools
Connections drop only when idle
Compare the silence period with NGINX’s read timeout and any upstream network timeout. Increase the applicable timeout and implement periodic ping/pong traffic rather than relying on an indefinitely silent TCP connection.
Clients reconnect in a loop after deployment
Inspect close codes and authentication logs, then test the new process locally and through NGINX. During a rolling restart, make sure the application closes connections deliberately and that clients use bounded exponential backoff so a fleet does not reconnect simultaneously.
Pre-launch checklist
- DNS resolves to the intended VPS address.
- The application listens on loopback and is not publicly reachable on its backend port.
- The systemd unit starts at boot, runs unprivileged, restarts on failure, and writes useful journal entries.
- NGINX configuration validates successfully and forwards HTTP/1.1 upgrade headers.
- The certificate matches the hostname, includes the required chain, and has a tested renewal process.
- Provider and host firewalls allow only required public and management ports.
- An external client completes a real authenticated handshake, exchanges messages, disconnects, and reconnects.
- Heartbeat behavior survives a quiet period longer than the normal application silence interval.
- Resource limits, origin policy, logging, monitoring, and a restart or rollback procedure are documented.
- Load testing has measured the selected VPS and workload instead of assuming a generic connection limit.
Deployment options at a glance
| Model | TLS owner | Backend visibility | Operations profile | Main trade-off |
|---|---|---|---|---|
| NGINX plus loopback application | NGINX | Private | systemd, one public entry point | Requires correct proxy and timeout configuration, but offers the clearest security boundary. |
| Application directly on a public port | Application | Public | Application-specific supervisor and certificate handling | Fewer proxy layers, but more internet-facing code and fewer centralized controls. |
| Containerized application behind a proxy | Proxy or application | Usually private container network | Container supervisor, image and health-check workflow | Consistent packaging, with additional networking and operational layers. |
| Multiple VPS instances | Shared proxy or load balancer | Private per node | Connection draining, shared state, monitoring, and coordinated deploys | Higher resilience and capacity, but substantially more complexity. |
Bottom line
A VPS is a suitable home for a WebSocket server when you treat it as a continuously running network service rather than a normal short-lived web request. Put NGINX on ports 80/443, terminate TLS, forward the HTTP/1.1 upgrade to a loopback-bound application, supervise that application with systemd, configure both firewall layers, and send heartbeats before idle timers expire. Then measure the actual client and message workload on the VPS size you selected; no universal concurrent-connection figure can substitute for that test.
Frequently Asked Questions
Can I run the WebSocket application without NGINX?
Yes, but the application must then handle public exposure, TLS certificates, upgrade requests, origin checks, logging, and restart behavior itself. The loopback-plus-NGINX design centralizes those responsibilities and keeps the backend port private.
Is port 8080 required for a WebSocket server?
No. Port 8080 is only a convenient local example. You can choose another high, unused port, provided the application, NGINX upstream, service documentation, and local firewall policy all agree.
Do WebSocket clients always need a public IP address?
No. Clients need a reachable DNS name or address for the public proxy. The application process can remain on a loopback or private address because NGINX accepts the external connection and forwards it internally.
What should happen when the VPS reboots?
The systemd unit should be enabled for boot, start the application after networking is available, and use its restart policy for unexpected failures. Verify the service and NGINX after a planned reboot before relying on unattended recovery.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
