The most maintainable arrangement is one public Nginx entry point: Nginx serves Angular’s compiled static files and proxies /api/ requests to Spring Boot on a private loopback port such as 8080. Run Spring Boot as a dedicated, non-root systemd service, terminate HTTPS at Nginx with Certbot, and keep frontend and backend releases in separate versioned directories. You can then build, restart, roll back, and troubleshoot each application independently without exposing the Java process or Angular’s development server to the internet.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide covers a same-hostname deployment such as app.example.com with the API at https://app.example.com/api/. A separate API hostname is possible, but it adds CORS, cookie, DNS, and certificate decisions.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What the finished deployment looks like
A browser requests the public hostname on ports 80 and 443. Nginx handles TLS and chooses the destination by URL:
/, JavaScript, CSS, images, and other frontend assets are read from the active Angular release directory./api/is reverse-proxied to Spring Boot at127.0.0.1:8080(or another private port).- Spring Boot is not bound to a public network interface and is supervised by systemd.
Angular’s deployment documentation describes the production artifact as a directory copied to a web server or CDN. The default ng build output is under dist/my-app/ (the exact project name comes from your workspace), and production configuration is used by default. Because Angular routing runs in the browser, Nginx must return index.html for an application route such as /orders/42 instead of returning a 404.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Do not run ng serve as the public production server. It is a development server, not the static web-server boundary you need for a hardened deployment.
Choose the hostname and network boundary first
Same hostname with an /api/ path
Point a hostname such as app.example.com at the VPS and let the browser call /api/... . This is usually the simplest option: requests are same-origin, browser cookies do not cross an origin boundary, and one certificate covers the site.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Separate API hostname
You can use api.example.com for Spring Boot, but the frontend and API then have different origins. Configure Spring Security CORS deliberately, including allowed origins, methods, headers, credentials, and preflight responses. Never “fix” production CORS by allowing every origin. You also need DNS and certificates for both names and must understand how your cookie attributes behave across origins.
Prerequisites and planning
| Item | What to decide or verify |
|---|---|
| VPS | A supported Linux distribution, a static public address, sufficient CPU and RAM for your Java workload, storage for current and previous releases, and a backup or snapshot plan. |
| DNS | An A (and, if used, AAAA) record for the chosen hostname pointing to the VPS. DNS must resolve before HTTP-01 certificate validation. |
| Runtime | A Java runtime supported by the Spring Boot version used by your build. Keep the server JDK/JRE choice aligned with the project’s Maven or Gradle configuration. |
| Web server | Nginx installed from a supported distribution package or another maintained installation. |
| Build outputs | An Angular production directory and an executable Spring Boot JAR created by your CI or build workstation. |
| Accounts | A normal administrative account for the VPS and a separate restricted service account for Spring Boot. Do not run the application as root. |
| Firewall | SSH restricted to an administratively appropriate source, plus HTTP and HTTPS for the website and certificate validation. The Java listener remains private. |
There is no universal VPS price for this architecture: the appropriate size depends on JVM memory use, traffic, database placement, logging, backups, and redundancy requirements. Compare providers on location, CPU and RAM, snapshots, backups, IPv6, support, and inbound bandwidth rather than choosing from a nominal price alone.
1. Prepare DNS, users, and directories
Create the DNS record before requesting a certificate. On the VPS, create a dedicated service account and a release layout. The exact administrative commands vary by distribution; the following illustrates a Debian or Ubuntu-style system:
sudo adduser --system --group --home /opt/myapp springapp
sudo mkdir -p /opt/myapp/backend/releases
sudo mkdir -p /var/www/app/releases
sudo ln -sfn /var/www/app/releases/initial /var/www/app/currentCreate the actual initial frontend release after building it; the symlink command is shown to illustrate the stable path Nginx will use. Keep release directories immutable after activation where practical, and give the service account ownership only of the backend files and directories it needs.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Install the runtime components
Install Nginx, the Java runtime required by your Spring Boot release, and file-transfer tools through your distribution’s supported package mechanism. Do not assume that the Java version on your development machine is available or supported on the VPS. Check the application’s build file and Spring Boot compatibility requirements first.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
2. Build and publish Angular
Create the production artifact
From the Angular project, run the production build used by your release process:
ng buildIf your workspace defines named configurations, specify the one intended for production, for example:
ng build --configuration productionInspect the output path reported by the CLI. Angular commonly produces dist/my-app/, but a custom outputPath or workspace layout can change it. The directory you publish is the one containing index.html and the generated asset files.
Free tools Windows power users keep installed
One-click scans. No signup required.
Copy to a versioned release
Use a version identifier that you can map back to a commit, build, or release date:
sudo mkdir -p /var/www/app/releases/2026-10-15-001
sudo cp -a dist/my-app/. /var/www/app/releases/2026-10-15-001/
sudo chown -R root:root /var/www/app/releases/2026-10-15-001
sudo ln -sfn /var/www/app/releases/2026-10-15-001 /var/www/app/currentThe current symlink gives Nginx a stable document root. Keep at least one known-good previous release so a frontend rollback is a symlink change rather than a rebuild under pressure.
Keep secrets out of the bundle
Angular environment files are compiled into JavaScript and therefore are public. Angular’s documentation explicitly warns not to store secrets such as API keys in src/environments; use a server-side proxy or a secrets manager instead. Database passwords, signing keys, OAuth client secrets, and internal service credentials belong in Spring Boot’s server-side configuration or a secrets manager. Treat every value shipped to the browser as readable by anyone.
3. Configure Nginx for static files and the API
Create a server block in the location used by your distribution for enabled sites. The important ordering is that the /api/ location appears before the general SPA location, so an API failure is returned as an API failure instead of being replaced with Angular’s index.html.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
server {
listen 80;
listen [::]:80;
server_name app.example.com;
root /var/www/app/current;
index index.html;
location /api/ {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location / {
try_files $uri $uri/ /index.html;
}
}With this form of proxy_pass, the incoming URI is forwarded to Spring Boot, so a request for /api/orders reaches the application with that path. If your controller mappings do not include the /api prefix, use an intentional rewrite and test it; do not change the trailing slash by trial and error.
Why the SPA fallback is required
When a user opens /orders/42 directly, Nginx looks for a file or directory with that name. There is usually neither, so try_files ... /index.html returns the Angular shell, after which the client-side router displays the order page. Without the fallback, refreshing or bookmarking a deep link produces a server-side 404.
Validate before reloading
sudo nginx -t
sudo systemctl reload nginxIf nginx -t reports an error, do not reload. Fix the syntax, duplicate server_name, missing semicolon, or incorrect file path first.
4. Build and publish Spring Boot
Build the executable JAR with the production profile defined by your project. Maven and Gradle commands differ by project, so use the wrapper and task your repository specifies. The result is commonly under target/ for Maven or build/libs/ for Gradle.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Copy the JAR into a versioned backend release directory rather than overwriting the running file:
sudo mkdir -p /opt/myapp/backend/releases/2026-10-15-001
sudo cp build/libs/myapp.jar /opt/myapp/backend/releases/2026-10-15-001/app.jar
sudo chown -R springapp:springapp /opt/myapp/backend/releases/2026-10-15-001
sudo chmod 750 /opt/myapp/backend/releases/2026-10-15-001
sudo chmod 640 /opt/myapp/backend/releases/2026-10-15-001/app.jarUse the corresponding Maven output path if your project creates the JAR under target/. Keep the frontend and backend version identifiers independent; they may be released at different times.
5. Run Spring Boot under systemd
Create /etc/systemd/system/myapp.service. Spring Boot’s reference documentation demonstrates the essential pattern: a unit in that directory, a dedicated User, an ExecStart command, and WantedBy=multi-user.target.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
[Unit]
Description=My Spring Boot API
After=network.target
[Service]
User=springapp
Group=springapp
WorkingDirectory=/opt/myapp/backend/releases/2026-10-15-001
ExecStart=/usr/bin/java -jar /opt/myapp/backend/releases/2026-10-15-001/app.jar
EnvironmentFile=-/etc/myapp/myapp.env
Restart=on-failure
RestartSec=5
SuccessExitStatus=143
[Install]
WantedBy=multi-user.targetAdjust the Java path, release path, JVM options, and environment-file location to your installation. Put database URLs, credentials, signing keys, active profiles, and other secrets in a root-readable environment file or a secrets manager, not in the unit file or Angular bundle. Restrict that file’s permissions:
sudo install -d -m 750 -o root -g springapp /etc/myapp
sudo chmod 640 /etc/myapp/myapp.envA service account limits the damage a compromised application process can cause. Add further systemd hardening only after confirming that the application does not need additional filesystem, network, or device access.
Enable, start, and inspect the service
sudo systemctl daemon-reload
sudo systemctl enable myapp.service
sudo systemctl start myapp.service
sudo systemctl status myapp.service
sudo journalctl -u myapp.service -n 100 --no-pagerBefore involving Nginx, verify the application locally on its configured port:
curl -i http://127.0.0.1:8080/actuator/healthUse the health endpoint only if Actuator is enabled and secured appropriately; otherwise call a harmless application endpoint. A successful local response proves that Java, configuration, database connectivity, and port binding are working independently of Nginx.
6. Connect Nginx to the private API
Once the local check succeeds, request the public URL through Nginx:
curl -i http://app.example.com/api/healthConfirm that the API location is selected. Test a deliberate application error, such as a known missing resource, and verify that you receive the expected JSON or HTTP status rather than Angular’s HTML shell. This catches an overly broad location / rule or a misplaced SPA fallback.
The Spring Boot listener should bind to loopback, for example with server.address=127.0.0.1, unless you have a specific internal-network requirement. Even if the process binds to all interfaces, the firewall must not permit direct public access to port 8080; loopback binding is the stronger boundary.
7. Add HTTPS with Certbot
After DNS resolves and the HTTP server is reachable, install the Certbot Nginx integration supplied for your operating system. Ubuntu’s documented flow uses:
sudo certbot --nginx -d example.com -d www.example.comReplace the names with the hostname(s) in your Nginx server block. Certbot can edit the matching block, obtain the certificate, and configure the HTTPS redirect. HTTP-01 validation requires the site to be reachable on port 80, so do not close that port if you rely on this challenge method.
Ubuntu documents a systemd timer for renewal. Test the renewal path rather than assuming it works:
sudo certbot renew --dry-runAfter certificate issuance, check both the browser and command-line responses on HTTPS. Confirm that the proxy’s forwarded protocol header reaches Spring Boot if the application generates redirects or secure-cookie decisions from the original scheme.
8. Apply the firewall policy
Ubuntu identifies UFW as its standard firewall tool. The exact commands depend on your SSH policy, but the intended rules are:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Allow SSH only from an administratively appropriate source or management network.
- Allow HTTP (port 80) when serving the site over HTTP or performing HTTP-01 validation.
- Allow HTTPS (port 443) for public traffic.
- Do not allow inbound connections to Spring Boot’s port 8080.
Make sure your current SSH session will remain allowed before enabling or tightening the firewall. If you use IPv6, apply equivalent policy there instead of securing only the IPv4 path.
9. Deploy independent releases and roll back safely
Frontend release
- Build Angular with the intended production configuration.
- Copy the output to a new directory under
/var/www/app/releases/. - Check that
index.htmland all referenced hashed assets exist. - Switch
/var/www/app/currentatomically to the new directory. - Reload Nginx only if its configuration changed; a symlink switch does not normally require a reload.
- Open the site, a client-side deep link, and an API-backed screen.
Backend release
- Build and verify the executable JAR.
- Copy it to a new directory under
/opt/myapp/backend/releases/. - Update the systemd unit’s release path or a stable backend symlink.
- Run
systemctl daemon-reloadif the unit changed, then restart the service. - Inspect
systemctl statusandjournalctl, then call the local health endpoint. - Test the API through Nginx before declaring the release complete.
Rollback
Keep the previous frontend directory and JAR until the new release has passed smoke tests. Roll back the frontend by repointing current; roll back the backend by restoring the previous unit path or backend symlink and restarting systemd. If a database migration is not backward-compatible, application rollback alone may not restore service, so design migrations with a compatibility window.
10. Verification checklist after every change
- Process: systemd reports
active (running); logs show no startup, binding, or database errors. - Local API: a loopback request returns the expected status.
- Nginx:
nginx -tpasses and the service reloads cleanly. - Frontend shell:
index.htmlloads over HTTPS and browser developer tools show no missing assets. - Deep link: refreshing an Angular route returns the application, not a 404.
- API success: a normal request returns the expected JSON and status.
- API failure: an intentional error remains an API response rather than HTML.
- Security: the Java port is not reachable from the public internet; secrets are absent from the JavaScript bundle.
- TLS: the certificate is valid for the hostname and
certbot renew --dry-runsucceeds. - Operations: Nginx access/error logs, application logs, backups, and release directories are monitored and retained according to your policy.
Common failures and targeted fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| Refreshing an Angular route returns 404 | The general Nginx location lacks an SPA fallback. | Add try_files $uri $uri/ /index.html; in location /, test the configuration, and reload Nginx. |
| An API URL returns the Angular page | The /api/ location is missing, too broad, or evaluated after an incorrect rewrite. |
Define the specific API location before the SPA fallback and test a deliberate API error. |
| Nginx returns 502 Bad Gateway | Spring Boot is stopped, listening on another port/address, or blocked locally. | Check systemd status and journal logs, then use curl against 127.0.0.1:8080 and correct the proxy target. |
| Spring Boot works locally but not through Nginx | Proxy headers, URI prefix, or application security rules do not match the public path. | Inspect Nginx access/error logs, confirm the forwarded headers, and verify whether controllers expect /api. |
| Browser reports CORS errors | The frontend and API use different origins or a preflight request is rejected. | Prefer same-origin /api/; otherwise configure explicit Spring Security CORS origins, methods, headers, and credentials. |
| Certificate issuance fails | DNS is not pointing to the VPS, port 80 is blocked, or the requested name does not match the server block. | Verify DNS from outside the VPS, allow HTTP for HTTP-01, and check the Nginx server_name. |
| Service stops when SSH closes | Spring Boot was started interactively instead of as a supervised service. | Stop the shell-launched process and use the systemd unit with enable, start, and restart policy. |
| Frontend shows old files after deployment | Browser or intermediary caching, or an incomplete asset copy. | Use Angular’s hashed assets, verify the new release contains every referenced file, and inspect cache headers before clearing caches broadly. |
Deployment choices and their trade-offs
| Decision | Advantages | Costs or complications |
|---|---|---|
Same host and /api/ path |
Simple browser origin and cookies; one public entry point and certificate. | Frontend and API share the VPS failure domain and public hostname. |
| Separate API hostname | Independent DNS and deployment boundary; useful when services move to different infrastructure. | Requires deliberate CORS, cookie, DNS, and certificate configuration. |
| systemd services | Low overhead, familiar Linux logs, boot start, and process supervision. | Release isolation and dependency reproducibility require discipline in directory and runtime management. |
| Containers | Reproducible images and clearer dependency packaging. | More operational components, image storage, networking, and resource overhead for a single VPS. |
| One VPS | Lowest infrastructure complexity and a single Nginx boundary. | Frontend, API, and possibly the database share a failure and maintenance domain. |
| Split services | Better fault isolation and independent scaling. | More networking, certificates, monitoring, backups, and maintenance boundaries. |
| Manual releases | Transparent and easy to begin; useful for small teams. | More room for human error and less auditability or repeatability. |
| CI/CD | Repeatable builds, approvals, audit trails, and automated rollback workflows. | Requires secure credentials, pipeline maintenance, and careful handling of production secrets. |
| Nginx TLS termination | Centralized certificates and simpler Spring Boot configuration. | Traffic between Nginx and the local process is not separately encrypted; use application TLS when an end-to-end requirement demands it. |
What to retain as the operating model
Publish Angular as static files behind Nginx, keep Spring Boot private and supervised by systemd, and expose only the Nginx ports. Use the /api/ path when same-origin behavior is useful, preserve a real index.html fallback for Angular routes, automate certificate renewal, and keep secrets on the server. Version both artifacts so a failed release can be reversed without rebuilding under pressure. After every deployment, test the browser shell, a deep link, a successful API call, an intentional API error, the local service, logs, firewall exposure, and certificate renewal.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
