The reliable production pattern is to publish your ASP.NET Core application for Linux, run it behind Kestrel as a systemd service, keep MySQL private, and let Nginx accept public HTTP/HTTPS traffic as a reverse proxy. The sequence matters: verify the application and database first, then add the service manager, proxy, firewall rules, TLS, and operational controls.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide covers a framework-dependent or self-contained deployment, Entity Framework Core with either Pomelo or Oracle’s MySQL provider, a hardened systemd unit, Nginx proxying to loopback, and the checks needed to recover from common failures.
As an Amazon Associate I earn from qualifying purchases.
What the finished deployment looks like
A browser connects to Nginx on ports 80 or 443. Nginx forwards matching requests over the loopback interface to Kestrel, which listens on a private port such as 5000. The ASP.NET Core process uses Entity Framework Core to connect to MySQL through a dedicated database user. systemd starts the process at boot and restarts it when it exits unexpectedly.
- Internet edge: Nginx owns the public web ports and the hostname.
- Application: Kestrel listens only on localhost unless you have a specific reason to expose it elsewhere.
- Database: MySQL is reachable only from the application host or its private network.
- Process supervision:
systemdrecords service state and sends logs to the journal.
Do not expose Kestrel’s private port in a cloud security group or firewall rule. Public access should terminate at Nginx.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
1. Fix the version and deployment choices first
Confirm the target framework and Ubuntu release
Record the application’s target framework, the Ubuntu release on the server, and the .NET runtime required by that target. Microsoft supports both framework-dependent and self-contained publishing. A framework-dependent deployment expects the matching ASP.NET Core/.NET runtime to be installed on Ubuntu; a self-contained deployment includes the runtime in the publish output.
Install a runtime that matches the application’s target framework rather than assuming that the newest runtime is compatible. Shared-framework upgrades can require an application restart, so include them in your maintenance procedure.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsChoose framework-dependent or self-contained publishing
| Choice | What is copied to Ubuntu | Operational trade-off |
|---|---|---|
| Framework-dependent | Your application and its dependencies; the matching .NET runtime is installed separately. | Smaller application directory and centralized runtime patching, but the server must have the correct runtime. |
| Self-contained | Your application, dependencies, and the .NET runtime for the selected Linux runtime identifier. | Larger deployment, but no separate shared runtime installation is required for that application. |
Whichever option you select, keep the publish mode consistent across environments and document the runtime or runtime identifier used for the release.
Select one EF Core provider
Align the provider package with the application’s EF Core and .NET versions. Microsoft’s provider catalog lists Pomelo.EntityFrameworkCore.MySql and Oracle’s MySql.EntityFrameworkCore. Do not mix provider packages in the same application unless you have a specific, tested reason.
Pomelo uses MySqlConnector and requires a connection string plus a server-version choice. Its documented setup supports ServerVersion.AutoDetect; an explicit server version is preferable when you want startup behavior to be independent of database inspection. Pomelo’s 9.0.0 line is associated with EF Core 9.0 and testing against MySQL 8.4 and 8.0, but verify the current package release against your target framework before pinning it.
Oracle’s Connector/NET documentation publishes a compatibility table by Connector/NET, EF Core, and .NET version. The support matrix documented there requires MySQL 8.0 or later. Treat that matrix as a compatibility check, not as permission to upgrade your application or server without testing.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 112. Prepare Ubuntu safely
Create a deployment and service identity
Use a non-root account for deployment and a least-privilege account for the running service. The account needs read access to the published binaries and write access only to directories where the application genuinely stores uploads, generated files, or other mutable data.
sudo adduser --system --group yourapp
sudo mkdir -p /var/www/yourapp
sudo chown -R yourapp:yourapp /var/www/yourapp
sudo chmod 750 /var/www/yourappIf Nginx needs to read static files directly, grant it read access without granting it write access. Keep secrets outside the source tree and outside world-readable directories.
Update packages and install Nginx
sudo apt update
sudo apt upgrade
sudo apt install nginxThe Nginx package installs an integration with systemd. Start it while preparing the server and check its state:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo systemctl enable --now nginx
sudo systemctl status nginxInstall the matching ASP.NET Core/.NET runtime as well when you choose a framework-dependent deployment. Use Microsoft’s Ubuntu installation guidance for the exact repository and package names for your Ubuntu release and target framework.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the application directory layout
A simple layout is /var/www/yourapp/current for the active release and a separate location for uploaded or generated data. A versioned release directory makes rollback easier:
/var/www/yourapp/releases/2026-10-15-01
/var/www/yourapp/current -> /var/www/yourapp/releases/2026-10-15-01If you use a symlink, point the service’s WorkingDirectory and executable at the active release deliberately, and test the unit after every switch. Do not make the entire application tree writable by the service.
3. Publish and transfer the application
Publish a Release build
Run the publish command from the project or solution directory in your build environment:
dotnet publish --configuration ReleaseFor a self-contained release, add the Linux runtime identifier and self-contained option appropriate to your server architecture. For a framework-dependent release, publish for the target framework and install its runtime on Ubuntu. The publish directory, rather than the project source directory, is what belongs on the server.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Copy only the publish output
Transfer the resulting directory with an approved mechanism such as SCP or SFTP. Copy it into a controlled release directory, then set ownership and permissions:
sudo chown -R yourapp:yourapp /var/www/yourapp/releases/2026-10-15-01
sudo find /var/www/yourapp/releases/2026-10-15-01 -type d -exec chmod 750 {} ;
sudo find /var/www/yourapp/releases/2026-10-15-01 -type f -exec chmod 640 {} ;Adjust permissions for executable files if your publishing method requires it. Never copy development secrets, local database files, or the repository’s .git directory into the web root.
Run Kestrel directly before adding Nginx
Test the copied application from Ubuntu. Use the DLL name generated by your project:
cd /var/www/yourapp/current
dotnet YourApp.dllIn another shell, request the local endpoint:
curl -I http://127.0.0.1:5000If the process exits, read its console error before continuing. Typical causes are a missing runtime for framework-dependent publishing, an incorrect working directory, a missing configuration value, or a database connection failure during startup.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
4. Connect EF Core to MySQL
Install and pin the provider
From the application project, add one provider and commit the resulting package version to the project file and lock strategy used by your build:
dotnet add package Pomelo.EntityFrameworkCore.MySqlUse Oracle’s package instead when its Connector/NET compatibility table is the better match for your EF Core and .NET versions:
dotnet add package MySql.EntityFrameworkCoreAfter adding a package, restore and build in the same target configuration used for publishing. A provider that compiles against a different EF Core major version can fail at startup or migration time even when the application itself builds.
Create a dedicated database and application user
Give the application its own database and a user with only the permissions required by the application. Keep administrative credentials for operations, not in the web application’s connection string. Apply the same principle when the database is managed on another host: restrict network access to the application’s private address or security group.
Recommended Free Tools
Store the connection string outside source control
A production connection string normally contains the database host, port, database name, user, and password:
Server=127.0.0.1;Port=3306;Database=yourapp;User ID=yourapp;Password=use-a-secret;Do not commit that value to appsettings.json, a migration, or a repository secret that is copied into a public build artifact. Supply it through protected production configuration or a secret manager. On Linux, an environment variable using ASP.NET Core’s double-underscore convention can map to a nested configuration key:
ConnectionStrings__Default=Server=127.0.0.1;Port=3306;Database=yourapp;User ID=yourapp;Password=...Protect the file or service environment that contains the value so only the service account and administrators can read it.
Configure the DbContext
A Pomelo setup reads the connection string and selects a server version:
var connectionString = builder.Configuration.GetConnectionString("Default"実);
builder.Services.AddDbContext<AppDbContext>(options =>
options.UseMySql(connectionString, ServerVersion.AutoDetect(connectionString)));Replace AutoDetect with an explicit provider server-version value when you have a controlled MySQL fleet and want deterministic startup. Test the selected value against the actual server before release.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Run migrations as a release operation
Review generated migration SQL before applying it to production. Confirm that a tested backup and restore procedure exists, then run the migration as an explicit release step rather than allowing every web-process startup to alter the schema. Keep application and schema changes backward-compatible during a rolling or rollback deployment.
5. Run the app with systemd
Create the unit file
Create /etc/systemd/system/yourapp.service with paths and names that match your deployment:
[Unit]
Description=Your ASP.NET Core application
[Service]
WorkingDirectory=/var/www/yourapp/current
ExecStart=/usr/bin/dotnet /var/www/yourapp/current/YourApp.dll
Restart=always
RestartSec=10
KillSignal=SIGINT
SyslogIdentifier=yourapp
User=yourapp
Environment=ASPNETCORE_ENVIRONMENT=Production
[Install]
WantedBy=multi-user.targetFor a self-contained publish, change ExecStart to the published executable instead of /usr/bin/dotnet. Add environment settings, resource limits, and a protected environment file only when the application needs them. The service account must be able to traverse every parent directory and read the application files.
Enable, start, and inspect the service
sudo systemctl daemon-reload
sudo systemctl enable yourapp
sudo systemctl start yourapp
sudo systemctl status yourapp
sudo journalctl -u yourapp -e
sudo journalctl -u yourapp -fenable schedules startup at boot; it does not start a currently stopped service, which is why the example runs both commands. Restart=always and RestartSec=10 ask systemd to recover from process exits, but they do not fix an application that repeatedly fails because of a bad configuration or schema.
Verify the private listener
Confirm that Kestrel is listening on the expected loopback port before configuring Nginx:
ss -ltnp | grep 5000
curl -i http://127.0.0.1:5000If no listener appears, inspect the journal and verify the application’s URL or port configuration. If the listener binds only to IPv6 or to a different port, make the Nginx upstream match the actual endpoint.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Put Nginx in front of Kestrel
Create an explicit server block
Create /etc/nginx/sites-available/yourapp:
server {
listen 80;
server_name example.com www.example.com;
location / {
proxy_pass http://127.0.0.1:5000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}Replace the example hostnames with the real names served by this application. An explicit server_name prevents unintended hostnames from reaching the application and avoids the host-header exposure that can result from leaving the default server selection ambiguous.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Define the WebSocket connection map when needed
The Connection header in the example expects a map in Nginx’s http context, usually in /etc/nginx/nginx.conf:
http {
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
# existing http configuration ...
}Use the upgrade headers when the application uses WebSockets or SignalR. If it does not, remove the upgrade directives rather than keeping an incomplete configuration. Keep the map in the http context, not inside a server block.
Enable, test, and reload
sudo ln -s /etc/nginx/sites-available/yourapp /etc/nginx/sites-enabled/yourapp
sudo nginx -t
sudo nginx -s reloadResolve every error from nginx -t before reloading. Request the public hostname and compare the result with the direct loopback request. A 502 response usually means Nginx cannot reach Kestrel, the service is stopped, the port differs from proxy_pass, or a local permission or socket policy blocks the connection.
7. Open only the required network paths
Configure the Ubuntu firewall and cloud firewall
Allow public HTTP and HTTPS, and keep the Kestrel port private:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw statusApply equivalent inbound rules in the cloud provider’s security group when the server is hosted in a cloud. Do not add port 5000 to public rules. If MySQL is on another host, allow MySQL traffic only between the application host’s private network identity and the database, not from the entire Internet.
Verify DNS and reachability
Point the application’s DNS records at the server’s public address, then test from outside the server. A successful local curl does not prove that DNS, the cloud firewall, Nginx, and the public route are correct. Check each layer separately when the hostname is unreachable.
8. Add HTTPS and forwarded-header handling
Do not send user credentials, session cookies, or other sensitive traffic over plain HTTP. Add a certificate and an HTTPS listener at Nginx, then redirect HTTP to HTTPS. Nginx can terminate TLS centrally while forwarding ordinary HTTP to Kestrel on loopback.
Configure forwarded headers in the ASP.NET Core pipeline so the application knows that the original request was HTTPS and can generate correct absolute URLs, redirects, and secure-cookie behavior. Trust forwarded headers only from the proxy addresses you control; do not accept arbitrary client-supplied forwarding headers.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11After enabling TLS, test the complete flow rather than only the certificate: HTTP redirect behavior, secure cookies, login callbacks, WebSockets or SignalR, static files, and large request bodies if the application uses them.
9. Production operations you should not defer
Backups and restore tests
Schedule MySQL backups, retain them according to your recovery requirements, and periodically restore one into an isolated environment. A backup that has never been restored is not a verified recovery plan. Coordinate destructive or long-running migrations with the backup window.
Logs and monitoring
Use journalctl -u yourapp for application service logs and Nginx’s access and error logs for proxy behavior. Monitor restart loops, HTTP 5xx responses, disk usage, database connectivity, certificate expiry, and available memory. Keep enough log retention to investigate an outage without allowing logs to fill the filesystem.
Updates and rollback
Patch Ubuntu, .NET, Nginx, and MySQL on a defined schedule. Restart applications after shared-framework upgrades and verify the service after each change. Keep the previous publish directory available until the new release has passed smoke tests; rollback should switch the active release and restart the service, not rebuild from an unverified workstation.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Secret rotation
Rotate database passwords and other credentials without committing replacements to source control. Plan how the service receives a new secret, when the database accepts it, and when the old credential is revoked. Check that logs do not print connection strings or secret-bearing configuration values.
Deployment checklist
- Target framework, Ubuntu release, provider package, and MySQL version are compatible.
- The chosen framework-dependent runtime is installed, or the deployment is self-contained.
- The Release publish output is copied to a controlled directory owned by the service account.
- The application runs successfully with a direct loopback request before Nginx is involved.
- The EF Core provider is version-aligned and the production connection string is supplied through protected configuration.
- The application uses a dedicated least-privilege MySQL user and database.
- Migrations were reviewed and run as an explicit release step after a verified backup.
- The
systemdunit starts at boot, restarts on failure, and produces readable journal output. - Nginx has an explicit
server_name, points to the correct loopback port, and passesnginx -t. - Only ports 80 and 443 are public; Kestrel and MySQL remain private.
- TLS, forwarded headers, backups, monitoring, patching, and rollback procedures are in place.
The Bottom Line
Deploy the published app first, prove that Kestrel and MySQL work locally, then let systemd supervise the process and Nginx proxy the private endpoint. Version alignment, least-privilege credentials, explicit host and port configuration, tested migrations, and ongoing backups are what turn a working Ubuntu demo into a maintainable production deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
