To deploy a web-facing application on a VPS, keep the application on a private listener, put NGINX on the public edge, allow only the required firewall ports, point DNS at the server, and obtain a TLS certificate through an ACME service such as Let’s Encrypt. You can install the application directly and supervise it with systemd, or package it in Docker; both are valid when their networking, updates, logs, secrets, and restart behavior are managed deliberately.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the finished deployment looks like
A production request normally follows this path:
- A browser resolves your hostname to the VPS public IPv4 or IPv6 address.
- The VPS firewall permits the request on TCP port 80 or 443.
- NGINX accepts the connection, terminates TLS for HTTPS, and applies the matching server block.
- NGINX proxies the request over a private interface to the application, for example
127.0.0.1:8000or an internal Docker network. - The application returns a response without exposing its own runtime port directly to the internet.
NGINX is both a web server and a reverse proxy. Keeping it at the edge gives you one place to handle certificates, redirects, request limits, access logs, and host-based routing while the application remains isolated behind it.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Prerequisites and decisions
Server prerequisites
- A Linux VPS with a public IPv4 address, IPv6 address if you intend to publish AAAA records, and enough CPU, memory, and disk for the application and its database.
- A supported distribution and CPU architecture for your runtime, database client, NGINX packages, and any container images you plan to use.
- Administrative access through SSH. Record the initial root login method, but perform routine work from a separate account with sudo.
- A hostname you control. Decide whether the application will answer at the bare domain, a subdomain such as
app.example.com, or both. - A backup destination separate from the VPS if the application stores uploads, database data, or other state.
Choose the process model before installing
| Consideration | Direct install with systemd | Docker with NGINX |
|---|---|---|
| Runtime layers | Fewer layers and direct access to host files. | An image and container runtime add a layer between the host and application. |
| Dependency isolation | You must keep language runtimes and libraries from conflicting with one another. | Dependencies are packaged in the image, reducing host-level conflicts. |
| Reproducibility and rollback | Requires disciplined package pinning and deployment scripts. | Versioned images make a previous build easier to redeploy, provided database migrations are reversible or planned. |
| Logs and volumes | Logs and files live in normal host paths and need explicit rotation and permissions. | Container logs, bind mounts, named volumes, and retention policies need explicit design. |
| Startup supervision | systemd handles ordering, restarts, limits, and boot activation. | Use a restart policy or an orchestrator and ensure the Docker service itself starts at boot. |
| Best fit | A small team comfortable with Linux service files and host-based upgrades. | A team that already builds images and values repeatable packaging. |
Do not choose Docker merely because it is popular, or a direct install merely because it is familiar. Choose the model your team can patch, observe, restore, and troubleshoot at 02:00.
Provision and harden the VPS
1. Record the network and platform details
From the provider console, record the server’s public addresses, distribution release, architecture, hostname, and storage layout. Confirm that the runtime supports that distribution and architecture before copying an installation command from its documentation.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
2. Connect with SSH and create an administrative account
Use the provider’s initial credentials only to create a named account. The exact commands vary slightly by distribution; on a sudo-enabled Linux system, a typical sequence is:
ssh root@SERVER_IP
adduser deploy
usermod -aG sudo deploy
install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
install -m 600 -o deploy -g deploy /root/.ssh/authorized_keys /home/deploy/.ssh/authorized_keys
Test a second SSH session as the new account before changing the root-login policy:
Recommended Free Tools
ssh deploy@SERVER_IP
sudo -v
After confirming that key-based access works, disable password authentication and, if your operational policy permits it, direct root SSH login in the distribution’s SSH server configuration. Reload SSH only after validating the configuration, and keep the existing session open while testing the new policy.
3. Apply security updates first
Use the package manager for your distribution to apply security updates, then reboot if the kernel or a core service requires it. For Debian- or Ubuntu-based systems this commonly resembles:
sudo apt update
sudo apt full-upgrade
sudo reboot
Red Hat-family and other distributions use different commands. Do not mix repositories or package instructions between distributions. After reconnecting, verify the account still has sudo access and note any changed service versions.
Install the application directly with systemd
1. Create a dedicated service user and application directory
Run the process as a non-root account. Keep source or release files in a directory owned by that account and keep secrets outside publicly served paths.
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo useradd --system --home /opt/myapp --shell /usr/sbin/nologin myapp
sudo install -d -o myapp -g myapp /opt/myapp/current
sudo install -d -o myapp -g myapp /var/lib/myapp
sudo install -d -o root -g myapp -m 750 /etc/myapp
Install the runtime and application dependencies using the project’s supported method. If the application needs a database, create a separate database role with only the permissions it requires; do not put a database password directly in a world-readable unit file.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
2. Bind the application privately
Configure the application to listen on a loopback address and an internal port, for example 127.0.0.1:8000. If it supports a trusted-proxy setting, configure it to trust only the local NGINX proxy or the private container network. The application should not bind to 0.0.0.0 unless you intentionally need direct network access and have firewall rules that enforce it.
3. Add a systemd unit
Create a unit such as /etc/systemd/system/myapp.service. Replace the executable and arguments with those required by your runtime:
[Unit]
Description=My web application
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=myapp
Group=myapp
WorkingDirectory=/opt/myapp/current
EnvironmentFile=-/etc/myapp/myapp.env
ExecStart=/opt/myapp/current/bin/start-server --host 127.0.0.1 --port 8000
Restart=on-failure
RestartSec=5
# Set limits appropriate to the application.
[Install]
WantedBy=multi-user.target
Protect the environment file, validate the unit, and start it:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchsudo chown root:myapp /etc/myapp/myapp.env
sudo chmod 640 /etc/myapp/myapp.env
sudo systemctl daemon-reload
sudo systemctl enable --now myapp.service
sudo systemctl status myapp.service
curl -I http://127.0.0.1:8000
The local curl request should return an HTTP status from the application. If it fails, inspect sudo journalctl -u myapp.service -e before involving NGINX. A process that is unhealthy locally will remain unhealthy behind a reverse proxy.
4. Plan upgrades and rollback
Deploy a new release into a separate versioned directory, run migrations and local health checks, then switch a current symlink or update the unit’s working directory. Keep the previous release until the new one has passed public checks. Database migrations often cannot be rolled back automatically, so test them separately and take a verified backup first.
Run the application in Docker
1. Install Docker from a supported source
Follow the Docker Engine instructions for your exact distribution and architecture. Keep the engine and Compose tooling updated through the same repository method; do not combine unrelated package sources. NGINX’s container documentation also lists a Docker Hub account among prerequisites for its Open Source image workflow, although a host-installed NGINX does not require that setup.
2. Define a private application service
A Compose file can publish the application only on the VPS loopback interface so that host NGINX can reach it while the public internet cannot:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
services:
app:
image: registry.example/app:1.4.2
restart: unless-stopped
ports:
- "127.0.0.1:8000:8000"
env_file:
- .env
volumes:
- app-data:/var/lib/app
volumes:
app-data:
The image must itself listen on port 8000 inside the container. If NGINX also runs in Compose, place both services on a private network and proxy to the service name instead of publishing the application port at all.
3. Handle images, secrets, and data deliberately
- Pin production images to a reviewed version or digest rather than silently pulling a moving tag.
- Store secrets in a protected environment mechanism or secret store, not in a public repository or image layer.
- Use named volumes or carefully permissioned bind mounts for uploads and other state. Containers are replaceable; volumes and backups are not.
- Define a restart policy, but do not mistake automatic restarts for health monitoring. Add an application health check and alerting appropriate to the service.
- Review image updates for operating-system and application changes, then retain the previous image long enough to perform a controlled rollback.
4. Verify the container before adding NGINX
docker compose up -d
docker compose ps
docker compose logs --tail=100 app
curl -I http://127.0.0.1:8000
Resolve container startup, permission, migration, and environment errors at this stage. NGINX should be the next layer, not a hiding place for an application that never became ready.
Install and configure NGINX as the public edge
1. Install NGINX
Install the distribution package or the official NGINX repository appropriate to your operating system. The configuration directory is commonly /etc/nginx/, and the standard access and error logs are under /var/log/nginx/. Confirm that the service is running locally:
sudo systemctl enable --now nginx
curl -I http://127.0.0.1
2. Create a server block
Put a site configuration in the location used by your distribution, then enable it according to that distribution’s convention. This example proxies a hostname to the private application listener:
server {
listen 80;
listen [::]:80;
server_name app.example.com;
access_log /var/log/nginx/app.access.log;
error_log /var/log/nginx/app.error.log;
location / {
proxy_pass http://127.0.0.1:8000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
Applications using WebSockets need the appropriate upgrade headers and timeout values. Applications that stream responses or accept large uploads may also need proxy buffering, body-size, and timeout settings adjusted to their documented requirements. Change only what the application needs.
3. Test before every reload
sudo nginx -t
sudo systemctl reload nginx
sudo tail -n 50 /var/log/nginx/app.error.log
If nginx -t reports an error, correct it before reloading. A failed reload leaves the previous running configuration in place, but repeatedly editing without checking can make diagnosis harder. Keep the access and error logs available while testing so you can distinguish a proxy error from an application error.
Configure the firewall without locking yourself out
Firewall rules are part of deployment, not a later polish step. Permit SSH before enabling the firewall, and restrict the public surface to the ports the design actually uses. With UFW, a common policy is:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose
Use the equivalent commands for firewalld, nftables, or your provider’s network firewall. Do not open the application port 8000, a database port, or Docker’s published ports to the world when NGINX is the intended public entry point. If SSH uses a nonstandard port, allow that port before enabling the firewall. Test a new SSH connection from another terminal after activation.
Point DNS at the VPS
Create an A record for the hostname pointing to the VPS IPv4 address. Add an AAAA record only when the VPS has working IPv6 routing and the application, firewall, and NGINX listen on IPv6 as intended. A stale AAAA record can make some visitors fail even when IPv4 works.
Wait for the record to resolve publicly, then verify from a network outside the VPS:
dig +short app.example.com A
dig +short app.example.com AAAA
curl -I http://app.example.com
The HTTP request should reach the server block that names the hostname. If it reaches a default page, check the server name, enabled-site links, and NGINX reload status. If it cannot connect, check DNS, provider security rules, UFW, and whether NGINX is listening on port 80.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Obtain HTTPS with an ACME certificate
1. Meet validation requirements
Before requesting a certificate, make sure the hostname resolves to this VPS and that an ACME validation request can reach it on port 80. Keep port 80 open even if your final policy redirects every HTTP request to HTTPS; HTTP validation and recovery workflows commonly rely on it.
2. Use an ACME client
Install an ACME client supported by your distribution and follow its NGINX integration instructions. A client can request a certificate for app.example.com, install it in NGINX, and arrange renewal. The exact package and command differ by distribution, so use the client’s current instructions rather than copying a command for another release.
3. Test renewal and then redirect HTTP
After issuance, verify HTTPS from the server and an external network. Confirm that the renewal timer or scheduled job exists, then perform the client’s dry-run renewal test. Only after the certificate works should you make the port-80 server block redirect to HTTPS:
server {
listen 80;
listen [::]:80;
server_name app.example.com;
return 301 https://$host$request_uri;
}
Keep the TLS-enabled server block separate and preserve the application proxy headers there. Check certificate expiry through monitoring rather than relying solely on a renewal job that has never been tested.
Enable services and perform the first verification loop
After each deployment change, verify from the inside out:
- Check the application process:
systemctl status myapp.serviceandjournalctl -u myapp.service -e, ordocker compose psanddocker compose logs. - Check the private listener:
curl -i http://127.0.0.1:8000/healthif the application provides a health endpoint, or request a known public route. - Check NGINX syntax with
sudo nginx -t, reload it, and inspect its access and error logs. - Check local HTTP or HTTPS behavior with
curl -I http://127.0.0.1and, after TLS is configured,curl -I https://app.example.com. - Check the public hostname from a separate network, including redirects, cookies, uploads, WebSockets, and any API routes the application requires.
Enable the application and NGINX at boot. For a systemd application, systemctl enable should already be part of the installation. For Docker, ensure the Docker service starts at boot and that the Compose project has a restart policy. A successful first request is not proof that reboot recovery, certificate renewal, or persistent data handling works; test those separately during a maintenance window.
Storage, databases, and operations that deployment must include
Persistent data
Separate immutable application code from mutable uploads, generated files, and database data. Document each path or volume, its owner, its backup method, and the restore procedure. A backup that has never been restored is an assumption, not a recovery plan.
Database connectivity
Keep a database on a private network or localhost unless remote access is an explicit requirement. Use a dedicated database account, encrypted connections where supported, least-privilege grants, and credentials outside source control. Test migrations against a copy of production data before applying them to the live database.
Logs and monitoring
Retain enough application and NGINX logs to diagnose failures without allowing disks to fill. Configure rotation for host logs, container logs, and large upload or error files. Monitor at least process state, HTTP status codes, disk usage, memory pressure, certificate expiry, and backup success. The first diagnostic clues are usually the systemd status, NGINX syntax result, NGINX logs, and application logs.
Updates and change control
Apply operating-system security updates on a schedule, review runtime and image updates, and record configuration changes. Before a release, capture the current image or application version, database backup status, environment changes, and rollback command. Afterward, repeat the local and public health checks.
Troubleshooting by symptom
| Symptom | Likely checks | Typical correction |
|---|---|---|
| SSH stopped working after firewall changes | Provider console, firewall status, SSH port, and whether the allow rule was added first. | Restore the SSH rule from the console, test a second session, then tighten rules gradually. |
| Connection refused on the private port | Application service status, container status, bind address, and application logs. | Start the service, correct its listen address or port, fix missing environment values, or resolve a failed migration. |
| NGINX returns 502 Bad Gateway | NGINX error log, private curl request, and the proxy target. | Start the application, correct the upstream address, or fix a permission or startup failure. |
| Hostname shows the wrong site | DNS A/AAAA answers, server_name, enabled configuration, and reload result. |
Correct DNS or the server block, remove an unintended default site, run nginx -t, and reload. |
| HTTPS certificate cannot be issued | Public DNS, port 80 reachability, provider firewall, and conflicting proxy or redirect rules. | Make the hostname resolve to this VPS, allow validation traffic, and retry the ACME client. |
| Works on IPv4 but not IPv6 | AAAA record, IPv6 route, firewall, and NGINX listen [::] directives. |
Fix IPv6 end to end or remove the AAAA record until IPv6 is genuinely ready. |
| Application loses uploads after a restart | Container volume or host path, ownership, and backup configuration. | Move mutable data to a persistent, permissioned volume and verify restore procedures. |
| Requests hang or uploads fail | Application timeouts, NGINX buffering and body-size limits, and upstream logs. | Set values appropriate to the documented workload and retest without weakening unrelated limits. |
Deployment checklist
- Distribution, architecture, runtime, database, and storage requirements are confirmed.
- A named sudo account works over SSH, and the existing session remains available while SSH policy changes are tested.
- Security updates are installed and a reboot requirement is handled.
- The application runs as a non-root user, listens privately, and has a tested local health check.
- Either the systemd unit or Docker Compose project starts at boot and has a defined restart behavior.
- NGINX is installed, its server block names the real hostname, and
nginx -tpasses before reload. - The firewall allows SSH, 80, and 443 only where required; the application and database ports are not publicly exposed.
- A and, where appropriate, AAAA records resolve to the VPS.
- An ACME certificate is issued, renewal is scheduled and dry-run tested, and HTTP redirects to HTTPS after issuance.
- Logs, backups, monitoring, upgrade steps, and rollback steps are documented and tested.
Which approach should you use?
Use a direct systemd installation when the application is simple, the team is comfortable maintaining host packages, and direct access to files and logs is valuable. Use Docker when repeatable image builds, dependency isolation, and image-based rollback outweigh the additional work of managing volumes, secrets, networks, image updates, and container logs. In either case, the reliable pattern is the same: private application listener, NGINX at the edge, minimal firewall exposure, DNS that points to the correct addresses, automated TLS renewal, and a verification loop that starts with local service health and ends with a public HTTPS request.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
