Recommended Free Tools
Yes. One Ubuntu VPS with a public IP can host many domains by using HAProxy as the public edge, one LXD container per website, and Nginx inside each website container. DNS sends every domain to the VPS; HAProxy examines the HTTP Host header or HTTPS SNI name and forwards the request to the matching private container. Each site keeps its own files, Nginx configuration, logs and optional application stack, so a mistake or outage in one container has a smaller blast radius than a single shared installation.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The reference layout is three containers: two website containers and one HAProxy container. Add more website containers without exposing their service ports directly to the Internet. HAProxy listens publicly on TCP 80 and 443, while the LXD bridge carries traffic privately between containers.
As an Amazon Associate I earn from qualifying purchases.
What the architecture looks like
The VPS has one public IPv4 address. All domains use an A record pointing to that address. HAProxy is the only component bound to public ports 80 and 443. It selects a backend from the requested hostname and sends the request over the LXD-managed bridge to the appropriate Nginx container.
Internet
|
Public VPS address:80,443
|
HAProxy LXD container
|-- site1.example.com -> website-site1 container:80
|-- site2.example.com -> website-site2 container:80
|-- other domains -> additional containers
LXD supplies the isolation and lifecycle layer. It manages system containers and virtual machines, images, networking and a REST API. A command such as lxc launch ubuntu:24.04 first creates and starts an Ubuntu 24.04 container by default. Each website can therefore have an independent operating-system package set and service configuration.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Why put HAProxy in its own container?
- One public edge: firewall rules and certificate handling are concentrated in one place.
- Hostname routing: several domains share one IP and the same ports while still reaching different backends.
- Smaller failure domains: a bad Nginx configuration in one website container does not replace the configuration of every other site.
- Port discipline: website containers remain on private bridge addresses instead of publishing each service on the host.
- Migration: a container and its data can be backed up or moved independently.
The trade-off is another service to patch and monitor, an additional proxy hop, and LXD networking to operate. If you only need a few static sites and do not need isolation, a single host-level Nginx installation is simpler.
Prerequisites and capacity planning
Required before installation
- An Ubuntu VPS or server with a public IP, a sudo-capable non-root administrator and a host firewall.
- One fully qualified domain name per website. Create an A record for each name pointing to the VPS address. Add separate records for names such as
wwwwhen they should resolve independently. - Enough storage for LXD images, container filesystems, access and error logs, application data, databases and backups. A historical tutorial used 20 GB or more as an example; it is not a universal requirement.
- Inbound TCP 80 and 443 allowed to HAProxy. Do not expose container service ports unless a specific publication requirement exists.
- A plan for certificates, updates, monitoring and tested backups before putting production traffic on the server.
There is no universal site-per-VPS number
No authoritative source provides a fixed number of websites that every VPS can host. Capacity depends on request rate, dynamic application work, database queries, memory usage, CPU, storage latency, log volume and backup retention. Static sites may consume little CPU but still require storage and file-descriptor headroom; several busy applications can exhaust memory even when the HTML footprint is small. Measure the real workload and leave reserve capacity for deploys, package updates and traffic spikes.
Prepare the VPS and LXD network
- Update the host and create an administrator: log in with your provider’s console or SSH, create a non-root sudo user, update Ubuntu packages and enable a host firewall. Allow SSH only from the networks that need it, plus TCP 80 and 443.
- Install and initialise LXD: install the LXD package supplied for your Ubuntu release, run
lxd init, choose storage sized for containers and backups, and create a managed bridge. The initialisation wizard can provide a bridge with DHCP and private addressing. - Confirm the bridge: run
lxc network listandlxc network show lxdbr0(substitute your bridge name). Managed bridges usednsmasqfor DHCP, IPv6 route announcements and DNS services. - Launch the containers: for example,
lxc launch ubuntu:24.04 haproxy,lxc launch ubuntu:24.04 website-site1andlxc launch ubuntu:24.04 website-site2. Check state and addresses withlxc list.
Use stable addresses for backends. A DHCP reservation in the LXD profile or a carefully managed static address prevents a container restart from changing HAProxy’s target. Record the mapping of domain, container name, private address and service port in version-controlled configuration. If a service must be reachable through a host address, LXD proxy devices can forward a host socket to an instance and support different protocols; this is not needed for the normal HAProxy-to-container path.
Configure Nginx in each website container
Install the service and create site directories
Enter a website container with lxc exec website-site1 -- bash. Install Nginx, create the document root and place the site’s files there:
apt update
apt install nginx
mkdir -p /var/www/site1
chown -R www-data:www-data /var/www/site1Ubuntu’s multi-site layout stores a site definition in /etc/nginx/sites-available/<your-domain> and enables it with a symlink in /etc/nginx/sites-enabled/. Every site needs a unique server_name.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Static site example
server {
listen 80;
server_name site1.example.com www.site1.example.com;
root /var/www/site1;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}Save that file as /etc/nginx/sites-available/site1.example.com, enable it and remove the distribution default if it would answer unmatched requests:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →ln -s /etc/nginx/sites-available/site1.example.com /etc/nginx/sites-enabled/site1.example.com
rm -f /etc/nginx/sites-enabled/default
nginx -t
systemctl reload nginxRepeat the process in the second container with a different document root and server_name. A request arriving from HAProxy still uses the original hostname, so Nginx can serve the correct virtual host even when several sites share port 80 inside the container.
Proxying to an application
For an application server listening privately on port 3000, replace the static location with a proxy definition. Nginx supports HTTP and other upstream protocols such as FastCGI, uwsgi, SCGI and memcached; choose the protocol your application actually exposes.
server {
listen 80;
server_name app.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Keep the application bound to the container’s loopback or private interface unless another container needs direct access. Test with nginx -t before every reload.
Install and configure HAProxy at the edge
Enter the HAProxy container, install HAProxy and create a configuration directory for certificates. The exact package version follows the Ubuntu release; validate the resulting configuration before any reload.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
apt update
apt install haproxy
mkdir -p /etc/haproxy/certs
chmod 700 /etc/haproxy/certsHTTP routing configuration
A frontend defines client-facing addresses and ports. The following configuration redirects plain HTTP to HTTPS and routes requests by hostname on the TLS frontend. Replace private addresses with the stable addresses shown by lxc list.
global
log /dev/log local0
log /dev/log local1 notice
user haproxy
group haproxy
daemon
defaults
mode http
log global
option httplog
option dontlognull
timeout connect 5s
timeout client 30s
timeout server 30s
frontend http_in
bind *:80
http-request redirect scheme https code 301
frontend https_in
bind *:443 ssl crt /etc/haproxy/certs/
acl host_site1 hdr(host) -i site1.example.com www.site1.example.com
acl host_site2 hdr(host) -i site2.example.com www.site2.example.com
use_backend site1_backend if host_site1
use_backend site2_backend if host_site2
http-request deny unless host_site1 or host_site2
backend site1_backend
server site1 10.10.10.11:80 check
backend site2_backend
server site2 10.10.10.12:80 check
The leading space before defaults in the displayed example is cosmetic; configuration directives must be syntactically valid in the file. Use your actual bridge addresses, and add one ACL, use_backend rule and backend per domain. The explicit deny prevents an unknown Host header from reaching an unintended site.
Validate and reload safely
- Run
haproxy -c -f /etc/haproxy/haproxy.cfg. Do not reload if validation reports an error. - Check listeners with
ss -ltnpin the HAProxy container and on the host. - Reload through the service manager only after validation, using a graceful reload so existing connections can finish.
- Confirm that the HAProxy container can reach each backend address and port with a private HTTP request.
Choose how TLS is handled
HAProxy can terminate HTTPS centrally, re-encrypt traffic to Nginx, or pass TLS through. The choice affects certificate ownership, inspection and operational effort.
| Model | Public edge | Backend connection | Advantages | Costs and cautions |
|---|---|---|---|---|
| Terminate at HAProxy | HAProxy presents each domain certificate on port 443. | HTTP over the private LXD bridge. | One renewal location, one security policy and straightforward hostname routing. | Traffic is decrypted in HAProxy; protect that container and its certificate keys. |
| Re-encrypt to Nginx | HAProxy presents the public certificate. | HTTPS from HAProxy to each Nginx backend. | Encryption continues across the bridge; HAProxy can require backend certificate verification with ssl verify required ca-file .... |
Every backend needs certificates and renewal, plus trust-chain and hostname configuration. |
| Pass through TLS | HAProxy operates in TCP mode and forwards the TLS stream. | Each Nginx container terminates TLS. | Private containers retain end-to-end TLS termination. | Certificates are distributed; hostname routing requires SNI inspection and TCP-mode rules. |
For central termination, place one PEM bundle per domain in the configured certificate directory. The bundle must contain the certificate chain and private key in the format required by your HAProxy version. Restrict file permissions, keep keys out of application directories and renew before expiry. Production Nginx deployments generally use HTTPS on port 443 with certificate files; the same public expectation applies when HAProxy is the TLS endpoint.
DNS, certificates and first verification
- After the A records have propagated, run
dig +short site1.example.comand verify that it returns the VPS public address. - Request a certificate for every public name that users will enter. Include both the apex and
wwwonly when both are configured in DNS and HAProxy. - Place renewed bundles in the HAProxy certificate directory, validate the configuration and perform a graceful reload.
- Run
curl -I https://site1.example.comand repeat for every domain. - Inspect certificate selection and SNI with
openssl s_client -connect VPS_IP:443 -servername site1.example.com. The returned certificate should match the requested name.
If HTTP is intentionally left available for ACME validation or a legacy endpoint, create an explicit exception instead of exposing an accidental default site. Otherwise, redirect all port-80 requests to HTTPS as shown above.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Security and isolation checklist
- Allow public TCP 80 and 443 only to HAProxy. Keep the LXD bridge private and deny unsolicited access from the Internet.
- Use separate Unix users, file ownership and least-privilege permissions inside each website container.
- Patch the host, LXD, HAProxy, Nginx and application packages on a defined schedule.
- Limit SSH access, disable direct root login and use key authentication where possible.
- Set resource limits when one container could consume all host memory or CPU; monitor before tightening limits.
- Protect certificate keys and HAProxy configuration backups as production secrets.
- Give each site its own logs and retention policy. Central collection helps correlate an edge request with a backend error.
- Do not assume container boundaries replace application security. Patch CMSs, frameworks, databases and upload handlers independently.
Adding another website
- Launch a new Ubuntu container from the required image and assign it a stable private address.
- Install Nginx, create its document root and add a unique site definition under
sites-available. - Enable the site, run
nginx -tand reload Nginx inside that container. - Create the DNS A record for the new hostname and wait until it resolves to the VPS address.
- Obtain the certificate, add its PEM bundle to HAProxy, then add the hostname ACL and backend server.
- Run
haproxy -c, reload gracefully and test both HTTP redirect behavior and HTTPS SNI. - Record the domain-to-container mapping, deployment steps and rollback procedure with the rest of the infrastructure configuration.
Troubleshooting by symptom
The domain resolves to the wrong address
Use dig +short domain.example from multiple networks. Correct the A record or stale DNS rather than changing HAProxy. Confirm that the VPS public address has not changed.
Port 80 or 443 is unreachable
Check the provider firewall, the Ubuntu host firewall and ss -ltnp. HAProxy must be listening on the public interface, and no other process may already own the port.
Free tools Windows power users keep installed
One-click scans. No signup required.
HAProxy returns a denial or default response
Inspect the Host header and compare it with the ACL spelling, including www aliases. Confirm that the request reached the intended frontend and that the certificate bundle contains the requested name for HTTPS.
HAProxy reports a backend as down
From the HAProxy container, connect to the private address and port. Verify the website container is running, Nginx is listening on the bridge interface, the address has not changed and container firewall rules permit the connection.
Nginx returns its default page or a 404
Run nginx -T inside the website container to inspect loaded server blocks. Check the enabled symlink, exact server_name, document-root ownership and requested file path.
HTTPS shows the wrong certificate
Use openssl s_client with the correct -servername. Check that the certificate directory contains the intended PEM bundle, that the bind references that directory and that HAProxy was reloaded after renewal.
The site is slow or intermittently unavailable
Compare HAProxy timing and status logs with Nginx access and error logs. A healthy edge with slow backend responses points to the application, database or container resources; connection failures point to addressing, listeners or firewall rules. Check memory, CPU, storage and log growth on the host.
Backups and recovery
Back up LXD container data, HAProxy configuration, Nginx site files, certificate material and DNS records. Keep a copy outside the VPS and document the order of restoration: recreate the LXD network, restore containers and addresses, restore Nginx sites, restore HAProxy and certificates, then repoint or verify DNS. Test restoration on a separate instance; a backup that has never been restored is only an assumption.
Containerized edge versus one host-level Nginx
| Concern | HAProxy plus LXD containers | One host-level Nginx |
|---|---|---|
| Isolation | Separate filesystems and service configurations per site. | All sites share the host Nginx environment and operating system. |
| Blast radius | A site-level failure is usually confined to one container; HAProxy remains a shared dependency. | A broken shared Nginx configuration can affect every site. |
| TLS management | Centralised at HAProxy when using termination. | Handled in one Nginx configuration on the host. |
| Operational complexity | Higher: LXD, bridge addressing, HAProxy and Nginx all require maintenance. | Lower for small deployments. |
| Memory overhead | Each container and its services consume resources, although system containers are lighter than full virtual machines. | Fewer service processes and less overhead. |
| Backups | Each container can have an independent backup boundary, plus shared edge configuration. | Backups focus on the host configuration and site data. |
| Moving one site | Move or restore one container and update its HAProxy backend. | Extracting one site from a shared host requires more separation work. |
Choose the containerized design when isolation, independent lifecycles or future migration justify the extra moving parts. Choose a single Nginx installation when simplicity and low resource use matter more than per-site boundaries.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
