What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a small, always-on Slackbot, the shortest reliable path is Bolt for Python in Socket Mode, deployed from a virtual environment and supervised by systemd on Ubuntu. Socket Mode keeps your VPS from needing a public application port: Slack delivers events over an outbound WebSocket. Use HTTP mode instead when you already operate a public HTTPS service, need a stable Request URL, or are preparing a broadly distributed app.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide takes you from a new Slack app to a hardened Linux VPS deployment. It covers tokens, OAuth scopes, a working Python bot, the Socket Mode and HTTP delivery choices, firewall rules, systemd supervision, logs, retries, updates, and recovery.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What you are building
The finished system has four parts:
- A Slack app installed in your workspace, with only the bot scopes its features require.
- A Python process using the official Bolt for Python framework.
- A Linux VPS running that process under a dedicated, non-root account.
- A supervisor that restarts the process, keeps credentials outside the source tree, and makes failures visible in logs.
Slack sends an event such as a message mention to the delivery channel you choose. Bolt verifies and dispatches it to a listener, your listener calls Slack’s Web API or responds in the channel, and the supervisor keeps the process running after you close SSH.
Choose Socket Mode or HTTP before provisioning
For a single-workspace bot on a small VPS, Socket Mode is normally the simpler default. Slack creates and refreshes a WebSocket URL at runtime; your server makes the outbound connection, so the bot does not need an inbound application port or a public domain. HTTP mode is the better fit when a public web service already exists, a stable Request URL is required, or the app will be distributed widely.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Decision point | Socket Mode | HTTP Events API |
|---|---|---|
| Inbound exposure | No public bot listener is required; the VPS opens an outbound WebSocket. | Slack must reach your configured HTTPS Request URL. |
| Credentials | Bot token plus an app-level token with connections:write. |
Bot token plus the app’s signing secret; no Socket Mode connection is needed. |
| Network setup | Permit SSH and outbound HTTPS/WebSocket traffic. Keep the bot bound to no public listener. | Operate a reverse proxy, certificate, DNS, and an exposed HTTPS port, commonly forwarding to Bolt’s /slack/events path. |
| Firewall and corporate networks | Usually easier where inbound ports are restricted because the connection is outbound. | Requires a reachable public endpoint and correctly aligned cloud security-group and host-firewall rules. |
| Scaling architecture | One or more WebSocket workers can be managed as processes, but plan connection ownership as you scale. | Stateless HTTP workers can sit behind a load balancer more naturally. |
| Marketplace and distribution | Slack’s legacy Socket Mode guidance says these apps are not currently allowed in the public Marketplace; check the current policy before relying on that limitation. | Use the HTTP model when public distribution requirements make Socket Mode unsuitable. |
Both modes still require an installed Slack app and careful handling of credentials. Switching later is possible, but the network, signing, and supervision configuration changes, so make the choice before opening firewall ports.
Prerequisites and a safe project layout
VPS and administrator access
- A current Ubuntu Server image or another supported Linux distribution.
- An administrator account that can use
sudofor setup, but is not used to run the bot. - SSH access through the port you actually use.
- A plan for backups or snapshots, package updates, and a rollback.
Python
Bolt’s official Python repository documents Python 3.7 and newer. Select an interpreter that is supported by your chosen operating-system release and by every dependency you intend to install; do not assume that the system Python can be upgraded safely in place.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRecommended directories
A simple layout keeps code, the virtual environment, and secrets separate:
/opt/slackbot/app.py
/opt/slackbot/.venv/
/etc/slackbot/slackbot.envThe application directory can be owned by the dedicated service account. The environment file belongs to root and should be readable only by root and, if necessary, the service account.
Create and configure the Slack app
1. Work in a development workspace first
Create the app in a development workspace, implement and test the smallest useful feature, and install it there before considering a production workspace. Keeping development and production installations separate prevents test messages and experimental scopes from leaking into the live bot.
2. Add the minimum bot scopes
In the app’s OAuth and permissions settings, add only the bot scopes required by the features you will actually run. A command that only posts replies should not receive broad history, administration, or user-data permissions merely because they might be useful later. Add a scope deliberately, reinstall the app when Slack requests it, and document why it exists.
Recommended Free Tools
3. Install the app and identify its tokens
After installing the app to the workspace, you will use a bot token for Web API calls. Slack distinguishes token classes by prefix:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Token | Purpose in this deployment | Keep it |
|---|---|---|
xoxb |
Bot token used by Bolt for authenticated Web API operations. | As a secret in the VPS environment, never in source control. |
xapp |
App-level token used to open Socket Mode connections. Grant connections:write when creating it. |
As a separate secret, also outside the repository. |
xoxp |
User-token class. It is not the normal credential for a single-workspace bot process. | Do not substitute it for the bot token unless your design explicitly requires a user token. |
Slack’s official guidance is: “Treat your tokens like passwords and keep them safe.” Do not commit them, paste them into issue trackers, or place them in a world-readable file. If a token is exposed, revoke or rotate it in Slack, replace the environment value, and restart the service.
4. Enable the delivery mode
For Socket Mode, enable Socket Mode in the app configuration and create the app-level token with connections:write. For HTTP, enable Event Subscriptions, set the Request URL to your public HTTPS address ending in /slack/events, and provide the signing secret to Bolt so incoming requests can be authenticated.
Create the Python bot
1. Create a virtual environment
On the VPS, create the project directory, make a virtual environment, activate it, upgrade packaging tools, and install Bolt:
sudo mkdir -p /opt/slackbot
sudo chown "$USER":"$USER" /opt/slackbot
cd /opt/slackbot
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -U pip slack_boltUse the same interpreter path later in the service unit. Record the installed versions after the first successful deployment; a lock file or an equivalent repeatable dependency record makes rollback possible.
2. Write a minimal Socket Mode application
Save this as /opt/slackbot/app.py:
import os
from slack_bolt import App
from slack_bolt.adapter.socket_mode import SocketModeHandler
app = App(token=os.environ['SLACK_BOT_TOKEN'])
@app.message('hello')
def message_hello(message, say):
say(f'Hey there <@{message["user"]}>!')
if __name__ == '__main__':
SocketModeHandler(app, os.environ['SLACK_APP_TOKEN']).start()The decorator registers a listener for messages matching hello. The bot token initializes the Web API client; the app token is consumed by SocketModeHandler to establish the WebSocket. Keep the values out of this file.
3. Test interactively before daemonizing
Create temporary environment variables in your shell and run the program in the foreground:
export SLACK_BOT_TOKEN='xoxb-replace-me'
export SLACK_APP_TOKEN='xapp-replace-me'
/opt/slackbot/.venv/bin/python /opt/slackbot/app.pyInvite the bot to a test channel if your app’s scopes require that, then send a message that matches the listener. A successful run remains attached to the terminal and prints connection or error information. Stop it with Ctrl+C after confirming the response.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Configure HTTP mode when you need a public endpoint
HTTP mode uses the same Bolt listeners but a web adapter instead of SocketModeHandler. Put a reverse proxy and TLS certificate in front of the application, publish the exact Request URL configured in Slack, and pass the signing secret when constructing the Bolt app. Slack must be able to reach the URL from the public internet, and the proxy must forward the request body and headers without altering the signature input.
Use the HTTP branch when you already have a domain and reverse-proxy stack, need conventional load balancing, or are building an app whose distribution requirements conflict with Socket Mode. Expose only HTTPS to the internet; keep the Python listener on a private local address or socket. For a small bot without those requirements, the extra DNS, certificate, proxy, and inbound-firewall work is usually unnecessary.
Provision and harden the Linux VPS
Create a least-privilege service account
Create a dedicated account such as slackbot and do not run the process as root. Grant administrative privileges only to the separate administrator account used for setup and maintenance. The service account should own the application files it must read, but it should not own system configuration or unrelated home directories.
Apply firewall rules without locking yourself out
Ubuntu identifies ufw as its default firewall frontend. Before enabling it, add a rule that matches your real SSH port and confirm that your cloud provider’s security group allows the same path:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemssudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verboseIf SSH runs on a custom port, replace OpenSSH with the matching port rule. Do not enable the firewall until you have checked the rule from a second session or otherwise confirmed that your current access path is covered.
For Socket Mode, allow SSH inbound and the outbound HTTPS/WebSocket traffic needed to reach Slack. Do not open an inbound application port merely because the process exists. For HTTP mode, allow only the HTTPS port exposed by the reverse proxy, keep the application port private, and align the VPS firewall with the cloud security group.
Keep the operating system current
Use a supported release and enable security updates. Ubuntu says unattended-upgrades is installed by default for automatic security updates and normally runs daily through systemd timers. Review its logs, reboot policy, and whether updates restart services. Schedule maintenance when a kernel reboot, Python update, or dependency change can interrupt the bot.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Store secrets in an environment file
Create a root-controlled file at /etc/slackbot/slackbot.env:
SLACK_BOT_TOKEN=xoxb-replace-me
SLACK_APP_TOKEN=xapp-replace-meFor an HTTP deployment, use the bot token and signing secret required by your Bolt configuration instead of the app token. Set ownership and permissions tightly:
sudo chown root:root /etc/slackbot/slackbot.env
sudo chmod 600 /etc/slackbot/slackbot.envNever commit this file. Keep a separate template containing variable names but no values, and protect backups of the real file as carefully as the live copy.
Run the bot continuously with systemd
Create /etc/systemd/system/slackbot.service:
[Unit]
Description=Slackbot
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=slackbot
WorkingDirectory=/opt/slackbot
EnvironmentFile=/etc/slackbot/slackbot.env
ExecStart=/opt/slackbot/.venv/bin/python /opt/slackbot/app.py
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetThe unit starts only after networking is considered online, loads secrets without putting them in the command line, uses the virtual-environment interpreter explicitly, and restarts an abnormal exit after five seconds. The dedicated user and working directory prevent accidental access to unrelated files.
Activate and inspect it:
sudo systemctl daemon-reload
sudo systemctl enable --now slackbot
sudo systemctl status slackbot
sudo journalctl -u slackbot -fenable --now both enables startup at boot and starts the service immediately. status shows the current state and recent messages; journalctl -u slackbot -f follows live output. Systemd service units are Ubuntu’s native configuration for controlling long-running processes, so the bot no longer depends on an open SSH session, screen, or a shell loop.
Verify the deployment in layers
- Process: confirm
systemctl status slackbotreportsactive (running)and that the executable path points to/opt/slackbot/.venv/bin/python. - Credentials: inspect the environment file’s ownership and mode without printing its contents. If authentication fails, rotate any value that may have been exposed while troubleshooting.
- Delivery: in Socket Mode, look for a successful WebSocket connection and send a test message. In HTTP mode, check the reverse-proxy access log, TLS certificate, Request URL, and Bolt’s signature validation errors.
- Permissions: verify that the service account can read the application and environment file but cannot modify system unit files or unrelated data.
- Restart behavior: stop the process or deliberately trigger a controlled failure, then confirm systemd restarts it and that the journal records the event.
- Reboot behavior: reboot during a maintenance window and verify that networking comes up, the unit starts automatically, and the bot responds after the machine returns.
Design listeners for retries and slow work
Slack’s Events API can retry a delivery when a request fails. A handler should therefore be safe if the same event arrives more than once. Avoid creating duplicate records or sending duplicate side effects solely because the first acknowledgement was delayed. Store an event identifier when durable deduplication is needed, and make updates idempotent where possible.
Acknowledge quickly before doing slow work. In HTTP mode, return the acknowledgement within Slack’s expected window, then queue or delegate expensive operations. In Socket Mode, keep listener code short enough that the connection remains responsive. Network calls, large file processing, and long-running jobs should not block acknowledgement or the event loop.
Use structured, useful logs: event type, a safe correlation or event identifier, outcome, elapsed time, and an error class. Never log bot tokens, app tokens, signing secrets, authorization headers, or complete private message bodies. Alert on repeated restarts, authentication failures, delivery retries, and a sustained absence of successful events.
Rotate tokens and update dependencies safely
Token rotation
- Create or regenerate the replacement credential in Slack according to the token type being rotated.
- Update the root-owned environment file without changing its restrictive mode.
- Restart the service with
sudo systemctl restart slackbot. - Watch
sudo journalctl -u slackbot -fand send a controlled test message. - Revoke the old credential after the new one is confirmed, and search backups or logs for accidental exposure.
Package and operating-system updates
Record Python, Bolt, and transitive dependency versions. Before upgrading, copy the source, dependency lock or requirements record, environment-file template, and any persistent state. Test the upgrade in the development workspace, schedule a maintenance window, then deploy and monitor restarts. If the bot fails, restore the previous virtual environment and application revision rather than guessing at a live fix.
Automatic operating-system security updates reduce exposure but do not replace application maintenance. Review unattended-upgrades logs and determine whether a reboot or service restart is pending. A VPS snapshot is useful only if you know how to restore it and have separately backed up data that changes between snapshots.
Common failure modes and fixes
The bot works in a shell but not under systemd
The service usually lacks the shell’s environment, uses the wrong Python path, or cannot read the environment file. Check WorkingDirectory, ExecStart, EnvironmentFile, file ownership, and the journal. Use absolute paths and restart after every configuration change.
Socket Mode cannot connect
Confirm that Socket Mode is enabled, the app-level token begins with xapp, and it was granted connections:write. Check outbound firewall and cloud-egress rules, system time, DNS resolution, and the journal. Do not open an inbound port as a first response; Socket Mode is designed around an outbound connection.
HTTP requests fail signature validation
Verify the signing secret, the exact public Request URL, and that the reverse proxy preserves the raw request body and relevant headers. A proxy that rewrites or consumes the body before Bolt verifies it can make every legitimate request appear invalid.
Slack reports retries or duplicate replies
Shorten acknowledgement work, move slow operations out of the listener, and make side effects idempotent. Inspect timestamps and event identifiers in safe logs before changing retry behavior.
The firewall appears to have broken SSH
Do not repeatedly enable and disable rules blindly. Use the VPS provider’s console or recovery access, add an allow rule for the actual SSH port and source path, then verify the cloud security group and ufw status verbose together. Only after a second-session test should you remove an old rule.
Production-readiness checklist
- The app is installed in the intended workspace with only necessary scopes.
xoxb,xapp, and signing credentials, where applicable, are outside source control and readable only by the service.- The bot runs as a dedicated non-root account from a pinned or repeatable virtual environment.
- Socket Mode has no unnecessary inbound listener, or HTTP mode has a maintained HTTPS reverse proxy and certificate.
- Cloud security-group rules and
ufwrules agree with the selected delivery mode. systemdstarts the service at boot, restarts failures, and provides a usable journal.- Handlers acknowledge quickly, tolerate Slack retries, and avoid duplicate side effects.
- Logs exclude secrets and support alerts for restart loops, authentication errors, and delivery failures.
- Security updates, reboot windows, dependency upgrades, backups, and rollback steps are documented and tested.
What the ecosystem indicates
Slack’s April 14, 2026 Python development article reported 8.6 million monthly downloads for the Python Slack SDK and 1.5 million monthly downloads for Bolt for Python. Those are download figures reported by Slack, not a performance, reliability, or uptime benchmark for your VPS. They do indicate that Bolt is the practical official framework for a Python integration, while your own network, handler design, and operations determine how dependable the deployed bot is.
Free tools Windows power users keep installed
One-click scans. No signup required.
With Socket Mode, Bolt, a least-privilege service account, and a small systemd unit, a modest VPS can run a Slackbot continuously without leaving an SSH terminal open. HTTP mode remains the right architectural choice when a public, TLS-terminated endpoint and conventional web scaling are requirements rather than optional complexity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
