Short answer: Run the official nodered/node-red container on a Linux VPS, persist its /data directory, keep MQTT on a private Docker network, and place the editor and dashboard behind HTTPS with authentication. This layout survives container replacement, limits the public attack surface, and gives you a practical backup and recovery path.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What self-hosting Node-RED on a VPS means
Node-RED is a flow-based tool for wiring together MQTT messages, HTTP requests, APIs, sensors, and actuators. Self-hosting puts the Node-RED runtime on a virtual machine you control instead of leaving it on a desktop, single-board computer, or managed service. A VPS gives the runtime a persistent cloud address and lets it run continuously while your local devices come and go.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The VPS is only the compute layer. You still need to decide how traffic reaches Node-RED, where its data is stored, how MQTT is secured, and how you will restore the system after a failed upgrade. A sound deployment separates those concerns:
- Node-RED runtime: the editor, flows, installed nodes, settings, and credentials.
- Persistent storage: a Docker named volume or host directory mounted at
/data. - Message transport: an MQTT broker on the same private Docker network or at a separately secured address.
- Public edge: a reverse proxy with TLS, or a private VPN that avoids public exposure altogether.
- Recovery: versioned backups of
/dataand a tested restore procedure.
The official Docker documentation identifies /data as the location for user configuration. If that directory is not persisted, replacing the container removes flows and settings.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose Docker or a native installation
Both approaches can run on a VPS. Docker is usually the easier operational choice because the runtime, dependencies, and restart policy are described as code. A native installation can integrate more directly with the host operating system, but upgrades and rollback require more manual package and service management.
| Decision | Docker deployment | Native installation |
|---|---|---|
| Isolation | Node-RED and its dependencies run in a container. | Node-RED runs directly on the VPS operating system. |
| Persistence | Mount a named volume or host directory at /data. |
Back up the Node-RED user directory and service configuration. |
| Updates | Pull a tested image, recreate the container, and retain the volume. | Update the Node.js and Node-RED packages under the service manager. |
| MQTT networking | Use a user-defined Docker network and the broker service name. | Use localhost or a private address and host firewall rules. |
| Rollback | Reuse the data volume with the previous image tag. | Restore packages and configuration from your own backups. |
Docker does not remove the need for administration. You still patch the VPS, protect SSH, review logs, rotate credentials, and test backups. Pin an image tag that you have tested rather than depending indefinitely on a moving latest tag.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsPrepare the VPS before installing Node-RED
Use a supported Linux image
Choose a current, supported Linux distribution offered by your VPS provider. Node-RED documentation describes cloud and virtual-machine deployment, but it does not prescribe one provider, region, price, CPU size, or memory size. Your workload determines those choices: a few sensors and scheduled flows need far less capacity than image processing, high-frequency telemetry, or many dashboard users.
Set the hostname and time zone
Give the server a stable hostname and set the correct time zone for your automations. A wrong clock can break TLS validation, scheduled inject nodes, log correlation, and token expiry. In Docker, set the container TZ environment variable to the desired IANA time-zone name.
Patch the operating system and restrict the firewall
Run the distribution’s update process before exposing any service. On a Debian- or Ubuntu-style host, the basic sequence is:
sudo apt update
sudo apt full-upgrade -y
sudo apt install -y ca-certificates curl ufwAllow SSH before enabling the firewall, then allow only the ports required by your chosen edge design:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallsudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseIf you use a private VPN and do not issue public web traffic, you can omit public HTTP and HTTPS rules and allow the VPN interface instead. Do not open MQTT ports merely because a broker is running. When the broker is a private Docker service, no host rule for port 1883 is needed.
Protect administrative access
Use SSH keys, disable password authentication after verifying key access, and avoid logging in as the root account for routine work. Keep the VPS provider’s recovery console available; it is useful if a firewall change blocks SSH. Automatic security updates can reduce exposure, but they do not replace planned Node-RED and container updates.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Install Docker and create persistent storage
Install Docker Engine and the Compose plugin using the instructions for your Linux distribution. Confirm that the daemon and Compose command work:
docker --version
docker compose version
sudo systemctl enable --now dockerDecide between a named volume and a bind mount. A named volume is managed by Docker and keeps the Compose file clean. A bind mount, such as /srv/node-red/data, makes the files visible to normal host backup tools and is convenient when you already have a server-wide backup system.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Storage choice | Advantages | Operational caution |
|---|---|---|
| Named volume | Simple portability between containers and fewer host-permission mistakes. | Backups require a Docker-aware command or a temporary helper container. |
| Bind mount | Easy to inspect, archive, and include in host-level backups. | Permissions, ownership, and accidental edits are your responsibility. |
Whichever option you choose, treat /data as application state. It contains flows, installed nodes, settings, and encrypted credentials. Do not place it in a public web directory or a repository.
Deploy Node-RED with Docker Compose
Create a private application directory, for example /srv/iot, and save a Compose file there. The following layout publishes Node-RED only on the VPS loopback address and leaves the MQTT broker unexposed to the Internet:
services:
node-red:
image: nodered/node-red:latest
container_name: nodered
restart: unless-stopped
ports:
- '127.0.0.1:1880:1880'
environment:
- TZ=Etc/UTC
volumes:
- node-red-data:/data
networks:
- iot
mqtt:
image: eclipse-mosquitto:2
container_name: mqtt
restart: unless-stopped
volumes:
- mosquitto-data:/mosquitto/data
- mosquitto-config:/mosquitto/config
- mosquitto-log:/mosquitto/log
networks:
- iot
volumes:
node-red-data:
mosquitto-data:
mosquitto-config:
mosquitto-log:
networks:
iot:Replace Etc/UTC with your time zone and replace latest with a specific Node-RED image tag after you have selected and tested one. The broker image and its configuration are examples; configure broker authentication, authorization, and TLS before treating it as production infrastructure.
Start the stack and verify that both services stay running:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →cd /srv/iot
docker compose up -d
docker compose ps
docker compose logs -f node-redOpen the editor through the protected hostname or, during initial setup from a trusted network, through an SSH tunnel:
ssh -L 1880:127.0.0.1:1880 user@your-vpsThen browse to http://127.0.0.1:1880 on your local computer. The tunnel does not make port 1880 public.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Connect a domain and HTTPS endpoint
Reverse proxy: the usual public arrangement
Point a DNS record such as nodered.example.com at the VPS and terminate TLS at a reverse proxy. Nginx, Caddy, or another maintained proxy can handle certificate issuance and renewal, while Node-RED remains bound to 127.0.0.1:1880. The proxy must forward the original host and protocol and support WebSocket upgrades used by the editor.
A minimal Nginx-style location has the following important directives:
Recommended Free Tools
location / {
proxy_pass http://127.0.0.1:1880;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
}Use the proxy’s normal certificate workflow, redirect HTTP to HTTPS, and renew certificates before they expire. Test both the editor and every dashboard or HTTP-in route after enabling the proxy.
Private VPN: the smallest public attack surface
If only you, your household, or an internal operations team needs access, put the VPS and clients on a private VPN. Bind Node-RED to the VPN address or loopback interface and avoid public DNS and public ports. A VPN protects reachability, but it does not replace Node-RED authentication or host patching.
Direct Node-RED HTTPS
Node-RED can serve HTTPS itself through the https setting in settings.js, using certificate and private-key material readable by the process. This is appropriate when you do not need a separate reverse proxy, but you must manage certificate renewal, permissions, protocol settings, and any proxy-equivalent headers yourself. Never commit private keys or certificate files containing secrets to a public repository.
Secure the editor, APIs, and static content
The editor is unsecured by default: anyone who can reach its address can open it and deploy changes. Treat an unprotected port 1880 as an emergency setup state, not a finished deployment.
Enable adminAuth
Set adminAuth in settings.js to protect the editor and Admin API. A credentials configuration contains a username, a bcrypt password hash, and permissions:
adminAuth: {
type: 'credentials',
users: [{
username: 'admin',
password: 'BCRYPT_HASH_HERE',
permissions: '*'
}]
},Generate the hash with the Node-RED administrator utility, node-red admin hash-pw, in an environment where the Node-RED command is installed. Store the resulting bcrypt string in the settings file, not the original password. Bcrypt is the recommended password format; legacy MD5 hashes should not be used for a new deployment.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Protect HTTP-in and static routes separately
adminAuth protects the editor and Admin API, not every endpoint created by a flow. If an HTTP-in route receives commands, webhooks, or sensitive data, configure httpNodeAuth or enforce authentication in the flow and at the proxy. Use httpStaticAuth when static content served by Node-RED should not be public. A dashboard can be reachable even when the editor is hidden, so review each exposed path independently.
Free tools Windows power users keep installed
One-click scans. No signup required.
Encrypt stored credentials
Node-RED encrypts node credentials using its credential-secret mechanism. Set a deliberate credentialSecret in settings.js or provide it through a protected environment variable. Keep that secret outside source control and include it in your disaster-recovery records. Losing it can make encrypted credentials unusable after a restore; exposing it lets an attacker read stored broker or API credentials.
Reduce the editor’s exposure
- Publish only 443 at the public edge, not 1880.
- Use a separate hostname for the editor if your dashboard has a different audience.
- Restrict proxy access by VPN, IP allow-list, or an additional identity layer when practical.
- Use least-privilege broker accounts and API tokens for individual flows.
- Review installed palette nodes; remove packages you no longer trust or need.
Connect Node-RED to MQTT without exposing the broker
Broker on the same Compose network
In the MQTT node configuration, set the broker host to the Compose service name, such as mqtt, and use port 1883 for the internal Docker connection. Docker’s user-defined network resolves that name to the broker container. Because the Compose file has no ports entry for mqtt, the broker is not published on the VPS interfaces.
Create broker users and permissions rather than allowing anonymous access. Give each application or integration only the topics it needs. If devices connect from outside the VPS, do not route them to an unencrypted public 1883 listener; use the broker’s TLS listener, client authentication, and firewall rules appropriate to those devices.
Broker on another private or managed host
For a remote broker, enter its private DNS name or address in the MQTT node and enable TLS and certificate validation as supported by the broker. Store the username, password, client certificate, or key in Node-RED credentials, not in a flow comment or Git repository. Confirm that the VPS can resolve and reach the broker while the broker remains inaccessible to arbitrary Internet clients.
Use stable topic and reconnect behavior
Define a topic convention before adding many flows. Configure a deliberate client identifier, clean-session behavior, quality of service, retained-message policy, and last-will message. Test what happens when the broker restarts and when the VPS loses its network connection; a flow that works only after manual redeployment is not resilient.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Expose a dashboard without exposing the editor
Install the dashboard nodes you need, then identify the route they create. Put that route behind the same HTTPS proxy, a separate hostname, or a VPN according to the audience. The editor and dashboard do not have to share the same access policy: operators may need the editor, while household or business users may need only read-only dashboard pages.
Protect dashboard actions that control locks, power, heating, machinery, or other consequential devices. Authentication at the proxy, flow-level authorization, and broker topic permissions should agree. Do not assume that hiding the editor URL protects a control endpoint; an exposed HTTP-in route can still be called directly.
Back up and restore the Node-RED data directory
Back up a named volume
Stop writes briefly or use a maintenance window so the archive represents a consistent state. For the named volume in the example, an archive can be created with a temporary container:
mkdir -p /srv/backups
cd /srv/backups
docker run --rm -v node-red-data:/data -v $PWD:/backup alpine tar czf /backup/node-red-data.tgz -C /data .Copy the archive off the VPS, restrict its permissions, and retain more than one generation. The archive may contain encrypted credentials, flow logic, and connection details, so protect it like a secret.
Back up a bind mount
With a bind mount, stop the container or pause changes, then archive the directory with the host’s normal backup tooling:
sudo tar czf /srv/backups/node-red-data.tgz -C /srv/node-red dataVerify that the archive contains flows, settings.js, installed-node metadata, and credential files as applicable. Do not assume a successful archive command proves that the backup is usable.
Test a restore
On a test VPS, create an empty volume, extract the archive into /data, apply the same credential secret, and start the exact image tag used for the backup. Confirm that flows open, credentials decrypt, palette nodes load, MQTT reconnects, and dashboards respond. A restore test also exposes missing external files, certificates, environment variables, and broker configuration that are not inside Node-RED’s data directory.
Operate and update the deployment
Inspect health and logs
docker compose ps
docker compose logs --tail=200 node-red
docker stats noderedWatch for repeated restarts, failed palette-node loads, authentication errors, MQTT disconnects, and filesystem-full messages. Keep host disk space available for Docker layers, logs, backups, and broker persistence.
Update deliberately
- Read the Node-RED and image release notes for breaking changes.
- Create and verify a fresh
/databackup. - Pin the candidate image tag in Compose.
- Pull and recreate the container with
docker compose pull node-redfollowed bydocker compose up -d node-red. - Open the editor, deploy a test flow, verify MQTT and dashboard behavior, and inspect logs.
- Keep the previous image tag available for rollback until the new version is proven.
Do not run an in-place container replacement without a persistent volume. The container can be disposable; the data and secrets cannot.
Quick Recap
Common failures and their fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| Browser cannot reach the editor | Port 1880 is loopback-only, the proxy is down, DNS is wrong, or the firewall blocks the edge port. | Check docker compose ps, proxy logs, DNS resolution, and firewall rules. Use an SSH tunnel to separate Node-RED failure from proxy failure. |
| Flows disappear after recreation | /data was not mounted or the Compose project used a different volume name. |
Inspect mounts with docker inspect nodered and restore the intended named volume or bind mount. |
| Editor loads but deploy fails | Admin authentication, file permissions, or a broken palette node is preventing writes or startup. | Review Node-RED logs, verify the /data owner and mode, and remove or repair the failing node package. |
| MQTT node cannot connect | The flow uses localhost instead of the broker service name, credentials are wrong, or the broker is not on the same network. |
Use mqtt for the Compose service, check network membership, and verify broker authentication and logs. |
| Dashboard works but editor is exposed | Port 1880 was published on all interfaces or the proxy routes the editor hostname publicly. | Bind 1880 to loopback, remove public port mappings, and put only the intended paths behind the HTTPS edge. |
| HTTPS warnings or redirect loops | The certificate hostname is wrong or the proxy is not forwarding the original protocol. | Renew the certificate for the exact hostname and set the proxy’s X-Forwarded-Proto handling consistently. |
| Credentials fail after restore | The credential secret was not restored with the data or changed between installations. | Restore the original credential secret and retest decryption before editing flows. |
Deployment patterns and when to use them
| Pattern | Public exposure | Best fit | Main trade-off |
|---|---|---|---|
| Docker, reverse proxy, HTTPS | 443 only; Node-RED and MQTT stay private | Public dashboards, webhooks, and regular remote administration | Requires proxy and certificate maintenance |
| Docker, VPN-only access | No public editor or dashboard port | Private home or business automation | Every client needs VPN access |
| Docker with remote MQTT | Node-RED edge is public or VPN-only; broker is elsewhere | Teams that already operate a secured broker | Depends on reliable private connectivity and TLS configuration |
| Native Node-RED service | Depends on host and proxy configuration | Administrators who need direct OS integration | More manual dependency, update, and rollback work |
Final pre-launch checklist
- Operating system and Docker packages are patched.
- SSH keys work and the host firewall allows only required ports.
/datais mounted persistently and its backup has been restored on a test system.- Node-RED editor access requires
adminAuthand HTTPS or a private VPN. - HTTP-in and static routes have their own authentication decision.
- The credential secret is stored securely and included in recovery records.
- MQTT is private unless external clients genuinely require access; external access uses broker authentication and encrypted transport.
- Dashboard control actions are authorized independently of editor access.
- Image tags, Compose files, proxy configuration, broker configuration, and restore steps are documented.
- Logs, disk usage, container restarts, certificate expiry, and backup success are monitored.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
