Recommended Free Tools
Host each Node.js app as an independent process on its own localhost port, then let one Nginx instance listen publicly on ports 80 and 443 and route requests by hostname. For example, app1.example.com can proxy to 127.0.0.1:3001, while app2.example.com proxies to 127.0.0.1:3002. Use PM2 or systemd to keep every process running, terminate HTTPS at Nginx, and keep application ports inaccessible from the Internet.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The architecture: one public Nginx gateway, many private Node.js processes
A VPS has one public IP address, but that does not limit you to one web application. Nginx examines the requested hostname and forwards the request to the matching Node.js process. The applications never need to bind to public ports.
As an Amazon Associate I earn from qualifying purchases.
Internet
|
| 80/443
v
Nginx (public listener)
|-- app1.example.com -> 127.0.0.1:3001 (Node app 1)
|-- app2.example.com -> 127.0.0.1:3002 (Node app 2)
`-- api.example.com -> 127.0.0.1:3003 (Node API)This hostname-based reverse-proxy pattern is documented in NGINX’s Node.js deployment guide and in a multi-application VPS tutorial from Hetzner. NGINX’s Node.js deployment guide covers upstreams, proxy_pass, HTTPS server blocks, and WebSocket locations; Hetzner’s reverse-proxy guide demonstrates routing several applications from one server.
What is isolated, and what is shared
- Each app has its own directory, environment variables, process, logs, and internal port.
- Nginx, the VPS kernel, the public IP address, and the host’s CPU, memory, disk, and network are shared.
- HTTPS certificates are configured at Nginx, although an app can still receive the original protocol through the
X-Forwarded-Protoheader. - Process supervision is separate from proxying: Nginx routes traffic, while PM2 or systemd starts, stops, and restarts Node.js.
Plan domains, ports, users, and resource boundaries first
Before installing packages, make a small inventory. Give every hostname one destination and every application one unique localhost port. A port collision prevents the second process from starting, while an incorrect hostname or port in Nginx produces a gateway error.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Hostname | Application directory | Internal bind address | Example supervisor name |
|---|---|---|---|
| app1.example.com | /srv/apps/app1 |
127.0.0.1:3001 |
app1 |
| app2.example.com | /srv/apps/app2 |
127.0.0.1:3002 |
app2 |
| api.example.com | /srv/apps/api |
127.0.0.1:3003 |
api |
Point each DNS A or AAAA record at the VPS address. If you use a wildcard record, still create an explicit Nginx server_name for each production app so an unrecognized hostname does not accidentally reach the wrong service.
Choose a port convention
Use a documented range such as 3001–3099 and record the assignment in deployment notes. Configure each app to read its port from an environment variable rather than hard-coding a production-only value:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →const port = Number(process.env.PORT || 3001);
app.listen(port, '127.0.0.1');Binding to 127.0.0.1 means the process accepts connections only from the VPS itself. If an app must be reached from another private machine, bind to the VPS’s private interface and restrict that interface with a firewall rule; do not expose every Node port publicly by default.
Use separate service accounts where practical
Deploying each app under a non-root account limits the damage from a compromised dependency or application bug. The account needs read and execute access to its own release directory and write access only to the directories it genuinely uses for uploads, caches, or logs. Keep secrets in a protected environment file or secret manager, not in a publicly served directory or a Git repository.
Install Node.js, Nginx, and a process supervisor
On a Debian- or Ubuntu-based VPS, update the operating system and install Nginx through the distribution’s package manager. Install the Node.js version required by your applications using the release method you standardize on, then verify both executables:
sudo apt update
sudo apt install nginx
node --version
npm --version
sudo nginx -tThe exact Node.js installation command depends on the distribution and the version your applications support. Keep that choice consistent across deployments; native modules compiled against one major Node version may not work after an unplanned upgrade.
Choose one lifecycle manager per app. PM2 is convenient when you want a Node-oriented command-line workflow and built-in clustering. systemd is already present on most Linux VPS images and integrates with operating-system boot, permissions, and journal logs. Do not run the same app under both supervisors, because two managers can start duplicate processes and compete for the same port.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Deploy each application as an independent service
Directory and dependency setup
- Create a directory for the application and assign ownership to its service account.
- Copy the source or a built release into that directory.
- Install production dependencies with the lockfile-aware command your project uses, such as
npm ci --omit=dev. - Set
PORT, database URLs, session secrets, and other environment variables for that app only. - Start it locally and confirm that
curl http://127.0.0.1:3001(or its assigned port) returns the expected response before involving Nginx.
Testing the local endpoint first separates application failures from proxy configuration failures. If the local request fails, inspect the app’s startup output, dependency installation, environment variables, and port assignment before editing Nginx.
PM2: straightforward Node.js supervision
Start each application with a distinct PM2 name and port-specific environment:
cd /srv/apps/app1
PORT=3001 pm2 start app.js --name app1
cd /srv/apps/app2
PORT=3002 pm2 start app.js --name app2
pm2 status
pm2 logs app1Save the process list and configure PM2’s startup integration according to the Linux distribution and the account that owns the applications. Test a deliberate restart and a machine reboot; a process that is visible in an interactive shell but absent after reboot is not production-ready.
PM2’s documented production pattern places Nginx in front of a Node.js process. See PM2’s Nginx production setup for the reverse-proxy arrangement. PM2 can also spread one application across CPU cores with:
pm2 start app.js -i maxAccording to PM2’s load-balancing guide, max detects the available CPU count and starts as many workers as possible. Cluster mode is an option for scaling one stateless application; it does not replace the need to give different applications distinct ports or Nginx server blocks.
Clustered workers must be stateless. Move sessions, caches, WebSocket presence, and other shared state into an external system or a shared data service. In-memory sessions can send a user’s next request to a different worker without the session data it needs.
systemd: operating-system-native supervision
A systemd unit gives one app a predictable service identity and restart policy. Create a unit such as /etc/systemd/system/app1.service and adapt the user, paths, and Node executable to your installation:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
[Unit]
Description=Node.js app1
After=network.target
[Service]
Type=simple
User=app1
WorkingDirectory=/srv/apps/app1
Environment=NODE_ENV=production
Environment=PORT=3001
ExecStart=/usr/bin/node /srv/apps/app1/app.js
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetActivate and inspect it with:
sudo systemctl daemon-reload
sudo systemctl enable --now app1
sudo systemctl status app1
sudo journalctl -u app1 -fRepeat the unit with a different service name, directory, user, and port for every app. Put sensitive values in an environment file readable only by the service account or root instead of placing credentials directly in a world-readable unit.
Configure one Nginx server block per hostname
Nginx should be the only service listening on public ports 80 and 443. Create a configuration file for each hostname under your distribution’s Nginx configuration directory and enable it using the distribution’s normal mechanism.
Basic HTTP reverse proxy
This server block sends app1.example.com to the first local process:
server {
listen 80;
listen [::]:80;
server_name app1.example.com;
access_log /var/log/nginx/app1.access.log;
error_log /var/log/nginx/app1.error.log;
location / {
proxy_pass http://127.0.0.1:3001;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Duplicate the block for each hostname, changing server_name, the log filenames, and the local port:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallserver {
listen 80;
listen [::]:80;
server_name app2.example.com;
location / {
proxy_pass http://127.0.0.1:3002;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
listen [::]:80;
server_name api.example.com;
location / {
proxy_pass http://127.0.0.1:3003;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}The forwarded headers preserve the original host, client address chain, and HTTP-versus-HTTPS scheme. Applications should trust proxy headers only when configured to trust the Nginx proxy; otherwise, a client could forge them by connecting directly.
Validate before reloading
- Run
sudo nginx -t. Fix every syntax or file-reference error before continuing. - Reload without dropping existing connections:
sudo systemctl reload nginx. - Test each hostname with
curl -I http://app1.example.comand the corresponding names. - Check the matching access and error logs if the response is not what you expect.
A reload applies configuration changes while keeping Nginx running. Restarting Nginx is usually unnecessary for a normal server-block edit and creates a larger failure window.
Add HTTPS and redirect HTTP
Nginx can terminate client TLS and forward ordinary HTTP to the local Node process. The Nginx SSL module provides HTTPS support and relies on OpenSSL, as described in the Nginx SSL module documentation. Certificate and key directives, along with current HTTPS configuration guidance, are covered in Nginx’s HTTPS configuration guide.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Obtain a certificate for each hostname, or a certificate whose names cover the hostnames you operate, using an ACME client or certificate authority process you control. Store the private key with restrictive permissions. A typical HTTPS block is:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name app1.example.com;
ssl_certificate /etc/ssl/app1/fullchain.pem;
ssl_certificate_key /etc/ssl/app1/privkey.pem;
location / {
proxy_pass http://127.0.0.1:3001;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
listen [::]:80;
server_name app1.example.com;
return 301 https://$host$request_uri;
}Repeat the pair for every hostname and use the correct certificate paths. Keep the port-80 block available for certificate renewal challenges when your certificate process requires it; do not assume that permanently closing port 80 is compatible with every renewal method.
Support WebSockets explicitly
Ordinary HTTP proxying does not automatically provide the WebSocket upgrade negotiation. Put the upgrade headers in the location that handles the socket endpoint. Define this map once in the Nginx http context, outside any server block:
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}Then use a dedicated location, changing /ws/ to the path used by your application:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorslocation /ws/ {
proxy_pass http://127.0.0.1:3001;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}The required HTTP/1.1 and upgrade headers are included in the NGINX Node.js deployment guidance. Test a real socket client after every proxy change; a normal page load can succeed even when the upgrade path is broken.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Subdomains versus path-based routing
Separate subdomains are usually the least surprising arrangement because each application receives the URL paths it was designed to handle. Path routing can work, but the app must understand that it lives below a prefix and must generate links, cookies, redirects, and asset URLs accordingly.
| Routing choice | Example | Advantages | Costs and risks |
|---|---|---|---|
| Subdomain | app1.example.com |
Simple server blocks; independent cookies and deployments; apps usually need no base-path changes. | Requires a DNS name and certificate name for each app. |
| Path prefix | example.com/app1/ |
Can share one hostname and certificate. | Every app must support a base path; redirects, static assets, cookies, and WebSockets require careful rewriting. |
If you choose paths, use distinct locations and verify whether the trailing slash is significant. For example, proxy_pass http://127.0.0.1:3001/; and a pass without the trailing slash can produce different upstream request paths. Confirm the behavior with your framework instead of copying a location block blindly.
Security controls that matter on a multi-app VPS
- Allow inbound TCP 80 and 443 at the VPS firewall and provider firewall. Keep 3001, 3002, 3003, and similar application ports closed to the Internet.
- Bind Node processes to localhost unless another private service must reach them.
- Run applications as non-root users and keep deployment directories out of Nginx’s static document root.
- Keep Nginx, Node.js, operating-system packages, and application dependencies patched on a maintenance schedule.
- Limit file permissions on environment files, private keys, upload directories, and logs.
- Set application-level limits for request bodies, timeouts, and authentication; Nginx is not a substitute for authorization.
- Review access and error logs for unexpected hostnames, repeated failures, and probing of administrative paths.
The reverse proxy reduces the public attack surface, but it does not isolate applications from one another at the kernel level. A process consuming all available memory can still affect every other app on the VPS, so use service limits, container or VM separation, or a larger deployment when the risk warrants it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Understand resource limits before adding more apps
There is no universal maximum number of Node.js applications per VPS. Capacity depends on each app’s idle memory, peak concurrency, CPU-intensive work, database usage, background jobs, log volume, and whether PM2 cluster mode multiplies worker processes. A tiny mostly static service and a real-time API have very different footprints.
Measure the host while representative traffic is running:
- Memory usage and swap activity, including the total of all Node workers.
- CPU utilization and load average during expected peaks.
- Disk space and I/O from dependencies, uploads, databases, and logs.
- Network bandwidth and connection counts.
- Application error rates, response latency, and restart counts.
Set log rotation and alerts before the disk fills. If memory pressure causes the kernel to terminate processes, adding another supervisor restart policy will only create a crash loop; reduce worker counts, fix the leak, optimize the workload, or move an app to another VPS.
Compare one process with PM2 cluster mode
| Operating mode | Use it when | State requirement | Resource effect |
|---|---|---|---|
| One process per app | The app fits on one CPU worker or simplicity is the priority. | Can use local in-memory state, subject to normal restart loss. | Lowest process overhead. |
| PM2 cluster mode | One app needs to use multiple CPU cores and can share state externally. | Must be stateless across workers; sessions and caches need shared storage. | Starts multiple workers and increases memory use. |
Cluster mode improves utilization of one application; it does not create stronger security boundaries between unrelated applications. Keep separate app ports and Nginx routes even when one app has several workers behind its own internal load-balancing arrangement.
Failure diagnosis: follow the request path
| Symptom | Likely layer | Checks |
|---|---|---|
| DNS name does not resolve | DNS or domain configuration | Confirm the A/AAAA record points to the VPS address and allow propagation time. |
| 502 Bad Gateway | Nginx-to-Node connection | Run curl http://127.0.0.1:PORT; check that the service is running, listening on the expected port, and that proxy_pass matches it. |
| Connection refused locally | Application or supervisor | Inspect systemctl status, journalctl, or pm2 logs; look for a crash, missing environment variable, or occupied port. |
| Wrong app answers | Server-name selection | Check the exact server_name, duplicate default servers, and the Host header sent by the client. |
| HTTPS warning or handshake failure | Certificate or TLS block | Verify certificate names, file permissions, paths, expiration, and that the 443 block is enabled and passes nginx -t. |
| WebSocket disconnects | Upgrade proxying or app path | Confirm HTTP/1.1, Upgrade, and Connection headers in the socket location and test the exact endpoint. |
| Works until reboot | Startup supervision | Enable the systemd unit or PM2 startup integration, save the process list where applicable, and perform a reboot test. |
Always identify which hop failed: client to DNS, client to Nginx, Nginx to localhost, or the application to its database and other dependencies. That prevents changing a valid proxy configuration to compensate for an unrelated app error.
Production deployment checklist
- Point every required DNS record to the VPS and confirm the names resolve.
- Install and patch Node.js, Nginx, and either PM2 or systemd.
- Create separate application directories, service accounts, environment settings, and unique localhost ports.
- Start each app under its supervisor and test its localhost endpoint.
- Create one Nginx server block per hostname, including forwarded headers and separate logs.
- Run
nginx -t, reload Nginx, and test every hostname. - Install certificates, configure 443 blocks, and redirect HTTP to HTTPS.
- Add WebSocket upgrade headers for every socket endpoint that needs them.
- Restrict application ports with localhost binding and firewall rules.
- Test normal requests, authentication, uploads, WebSockets, supervisor restarts, reboot recovery, certificate renewal, and log rotation.
- Monitor memory, CPU, disk, network, latency, and application errors before adding another workload.
With this arrangement, adding an application is repeatable: assign a port, deploy and supervise the process, create its hostname-specific Nginx block, validate, reload, and test. The public surface remains concentrated in Nginx while each Node.js service keeps an independent lifecycle.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
