What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You can run development, staging, and production on one VPS, but only if each environment has an explicit boundary. Use a current Ubuntu LTS image, a named sudo user, key-only SSH, a host and provider firewall, and a reverse proxy such as nginx or Caddy. Give development, staging, and production different hostnames, networks, credentials, secrets, and database instances. Build one immutable application artifact in CI, test that artifact in staging, then promote the identical tag to production. Move production to a separate VPS when traffic, compliance, recovery objectives, or noisy-neighbor risk makes one-host failure or access unacceptable.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide lays out a practical design for dev.example.com, staging.example.com, and example.com, including hardening, deployment, data handling, backups, monitoring, rollback, and rebuild procedures.
As an Amazon Associate I earn from qualifying purchases.
Choose the server layout before installing software
A VPS is a virtual machine that you must secure and operate yourself. It is not an application environment by default: the operating system, SSH access, firewall, runtime, databases, logs, backups, and updates are all your responsibility. DigitalOcean describes each Droplet as a new server that can be used alone or as part of a larger cloud infrastructure and recommends SSH keys, a sudo non-root user, disabled password-based root access, and a restricted cloud firewall in its production setup guidance.
For a small team, one VPS can host three isolated compose projects or service namespaces. The public edge is shared, but application processes, networks, environment files, databases, and credentials are separate. This arrangement lowers cost and keeps deployments straightforward. It does not remove the single point of failure: a kernel fault, storage failure, compromised administrator account, or exhausted disk can affect all three environments.
#1 Best Overall
- WHY CHOOSE G3 ULTRA MINI PC PENTIUM GOLD 7505 - Choose the Intel Pentium Gold 7505 for snappier everyday responsiveness: It delivers up to 30% faster single-core performance than the Ryzen 5 3500U, making office apps and web browsing feel noticeably quicker, while its Intel UHD Graphics (48 EUs) provides 2.4x the GPU performance of the N100 & N150's 24-EU graphics, ensuring smoother 4K streaming and light photo editing.
- 16GB RAM MEMORY & 512GB STORAGE - GMKtec Nucbox G3 Ultra mini computer is prebuilt with 16GB LPDDR4 RAM at 3200 MT/s, you will enjoy a speedier experience with Built-in 512GB M.2 SATA Hard Drive. Our mini desktop pc boots up in seconds, work on multiple browser tabs, software applications and quickly transfers files. There is a primary slot and secondary expansion storage. Primary slot is M.2 2280 PCIE and secondary slot is M.2 2280 SATA.
- RICH INTERFACE - Nucbox pentium mini computer is equipped with 3* USB 3.2 Gen2 ports, up to 10Gbps/S, 1*USB 2.0, HDMI(4K@60Hz)*2, 3.5mm Audio Jack. Supports WiFi 6, and Gigabit Ethernet RJ45 2.5GbE network connectivity, Bluetooth 5.2. This Mini PC supports multiple device connection and can be used with servers, monitoring equipment, office equipment, displays, projectors, televisions, etc.
- 4K DUAL SCREEN DISPLAY - Mini desktop computer is equipped with upgraded Intel Graphics(max 1000MHz), supports 4K video playback and AV1 decoding, connect the pc with a projector as a home theatre, enjoy a variety of entertainments. Two HDMI 2.0 ports allows you to multi-task efficiently on two 4K@60Hz displays.
- UPGRADED COOLING FAN - The G3 Ultra has upgraded the cooling fan to reduce fan noise and thermals. We are using an upgraded thermal paste as well to help reduce heat on the CPU.
One VPS versus separate VPS instances
| Decision factor | One VPS with isolated environments | Separate VPS instances |
|---|---|---|
| Blast radius | A host failure or host-level compromise can affect development, staging, and production. | Failures and administrative access can be contained to one environment or role. |
| Resource contention | Builds, test jobs, databases, and production traffic share CPU, memory, disk I/O, and network capacity. | Each environment has dedicated capacity and cannot be slowed by another host’s workload. |
| Operational complexity | One operating system, firewall, monitoring stack, and backup target are simpler to maintain. | More hosts mean more patching, access control, monitoring, and recovery procedures. |
| Deployment speed | Shared networking and a single edge proxy make an initial setup quick. | Cross-host networking, DNS, and certificate management add configuration. |
| Compliance and access | Production data and administrative controls must be carefully separated on the same host. | Physical or virtual separation makes audit boundaries and restricted access easier to demonstrate. |
| Recovery objectives | A host rebuild is a recovery event for every environment unless production data and services are independently recoverable. | One environment can be restored or rebuilt while others continue running. |
| Scaling | Scaling one workload may require resizing a host that also carries the other environments. | Each environment can be resized or moved independently. |
Stay on one VPS while the application is small and the team can tolerate a shared failure domain. Use a second production VPS when a service-level objective, regulatory requirement, customer contract, sustained resource contention, or recovery-time target requires a smaller blast radius. Separation is a risk decision, not a status symbol.
Define names, access, and prerequisites
Write the target layout down before provisioning. A typical public naming plan is:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →dev.example.comfor developer integration and exploratory testing.staging.example.comfor production-like acceptance testing.example.com(and any required API subdomain) for production.
Decide which environment is public. Development is often restricted by VPN, an identity-aware proxy, or an IP allowlist; staging may be limited to testers; production is public only through the edge proxy. Record who may access each environment, where secrets will live, how long non-production data is retained, and which services require persistent storage.
Provision a current Ubuntu LTS cloud image. Ubuntu’s server documentation covers SSH, firewalls, DNS, nginx, Docker, cloud images, databases, storage, monitoring, and alerting at ubuntu.com/server/docs/. Have a domain you control, an SSH key, a second administrative key held securely, and a source-control repository for application code, Compose files, infrastructure configuration, migration scripts, and recovery documentation.
Provision and harden the Ubuntu VPS
Perform these actions from a trusted administration network. Keep an existing console session open until key-based access for the new account has been tested.
Rank #2
- 12th Intel Alder Lake N95 Processor – The GMKtec G3 S Mini PC is powered by the 12th Gen Intel N95 processor with 4 cores, 4 threads, 6MB cache and a burst frequency up to 3.4GHz. Compared with N100/N5105/N5100/N5095, the N95 delivers up to 36% overall performance improvement. Perfect for routine tasks, office work, and home entertainment, this compact mini desktop is more convenient than traditional bulky PCs.
- 8GB RAM & 256GB SSD Storage – Pre-installed with 8GB DDR4 memory and a fast 256GB M.2 2242 SSD, the G3 S mini desktop offers quicker startup, smoother multitasking, and faster file transfers. Enjoy seamless performance whether you’re working on multiple applications, browsing, or streaming content.
- Rich Interfaces & Connectivity – The G3 S mini computer comes equipped with USB 3.2 (up to 10Gbps), dual HDMI 2.0 (4K@60Hz), and a 3.5mm audio jack. With support for WiFi 5, Bluetooth 5.0, and Gigabit Ethernet (RJ45 1000MbE), it connects easily with monitors, projectors, printers, office equipment, and other peripherals, making it versatile for both home and business use.
- Dual 4K Display Support – Featuring upgraded Intel UHD Graphics (up to 1000MHz), the G3 S supports 4K video playback and AV1 decoding for a smooth viewing experience. With dual HDMI outputs, you can connect two 4K@60Hz displays simultaneously, enabling efficient multitasking for work and entertainment.
- GMKTEC WARRANTY - GMKtec offers a 3-year limited warranty (1 year replacement + 2 years parts replacement) for each mini PC, starting from the date of the purchase effective on all sales starting Oct. 2026. All defects due to design and workmanship are covered. With a professional after sales team always ready to attend to your needs, you can simply relax and enjoy your mini PC
- Create the VPS from a current Ubuntu LTS image. Select the provider region that meets your users’ latency, residency, and recovery requirements. Add your SSH public key during provisioning rather than creating a password-only account.
- Create a named sudo user. Log in with the provider’s initial account, create a personal administrator account, add it to the
sudogroup, and verify thatsudoworks. Do not run the application, database, or deployment process as root. - Test the new key before changing SSH policy. Open a separate terminal and log in as the named user. Keep the original console available in case a configuration error locks you out.
- Disable password authentication and direct root login. In the SSH server configuration, set key authentication as the only method and prohibit direct root login. Reload SSH, then confirm that a fresh key-based session succeeds before closing the old one. Keep a documented emergency console or provider recovery path.
- Apply security updates and reboot when required. Update the package index, install available security fixes, and reboot for kernel or library updates. Establish a regular patch window instead of allowing an unmaintained image to run indefinitely.
- Configure two firewalls. Use the provider’s cloud firewall to allow SSH only from an administration allowlist and to allow public HTTP and HTTPS. Mirror that policy with the Ubuntu host firewall. Do not expose PostgreSQL, MySQL, Redis, a Docker daemon, internal admin panels, or application ports to the public internet.
- Review listening services. After installing software, inspect listening sockets and firewall rules. Every public port should have a documented reason. Bind application containers to private networks or localhost so that only the reverse proxy is reachable from the internet.
- Enable baseline host protections. Use least-privilege Unix users and groups, keep AppArmor enabled where supported, and send authentication and system logs to a retained location. Ubuntu’s security guidance covers firewalls, AppArmor, users and groups, web servers, containers, logging, monitoring, and alerting at ubuntu.com/server/docs/how-to/.
Do not copy production secrets into shell history, a public repository, an image layer, or a shared chat. Restrict the permissions of deployment keys and rotate them when a person, machine, or vendor no longer needs access.
Install the runtime and public edge
Choose one runtime model and document it. Docker Engine with Compose gives each environment a repeatable service definition; a language runtime with a process supervisor can also work when containers are unnecessary. Whichever model you use, pin base images and package versions, define health checks, and make the application stateless where possible so that a replacement container can start from configuration and persistent data.
Use a reverse proxy as the only public application entry point
Install nginx or Caddy on the host. Configure it to terminate TLS, select a virtual host from the requested hostname, and proxy traffic to the corresponding private service. For example, requests for staging.example.com should reach only the staging application network, while example.com reaches only production. Set explicit proxy timeouts, request-size limits, forwarding headers, and access-log formats appropriate for your application.
Do not publish a container’s internal port directly just because it is convenient during development. A published port bypasses the hostname routing, TLS policy, and access controls at the edge. If an administrator needs a private service, use an SSH tunnel or a private network rather than opening the database or cache to the internet.
Create DNS records and certificates
- Create DNS records for each hostname and point them to the VPS public address. Use a low time-to-live while migrating, then raise it after the records are stable.
- Configure one edge virtual host per environment. Verify that the default virtual host does not accidentally route an unknown hostname to production.
- Issue certificates for every public name using an automated ACME client supported by your proxy. Renew them automatically and monitor expiry; a certificate that expires is an outage even when the application is healthy.
- Redirect HTTP to HTTPS after the certificate is working. Keep internal service traffic on private networks; do not assume that a public certificate makes a database safe to expose.
Build hard boundaries between development, staging, and production
Create separate directories or Compose project names such as /srv/app-dev, /srv/app-staging, and /srv/app-prod. Each project should have its own network, service names, environment file, persistent-volume paths, deployment identity, and database instance. A concrete VPS runbook also uses separate production and staging hostnames and a separate PostgreSQL database for each environment (VPS deployment runbook).
Recommended Free Tools
Rank #3
- ➊ [ Trusted Quality for Everyday Agentic AI ] GEEKOM equips its SSDs with reliable original-grade flash and conducts rigorous stability testing to support dependable everyday operation. This commitment to quality is backed by a 3-year warranty. Simply connect the Air12 to cloud AI services for research, writing, study support and daily productivity—no NPU or complex local setup required. Designed for students, home users, light office work and first-time buyers, the Air12 is a high-value Cloud Agentic PC for everyday tasks
- ➋ [ Intel 7505 processor ] Powered by the Intel 7505 processor (2 cores, 4 threads, up to 3.5GHz), the GEEKOM Mini PC Air12 delivers smooth performance for everyday computing, office tasks, and home entertainment. With enhanced single-core processing, it handles daily workloads efficiently and responsively. Compact, quiet, and energy-efficient — a solid alternative to bulky desktops.
- ➌ [440lbs(200kg) Pressure Rated Metal Frame for Demanding Environments] Unlike the Plastic Shells You’ll Find on Most Mini PCs, geekom Mini Air12 features a triple-reinforced ABS+PC shell, precision-crafted metal frame and baseplate—engineered to withstand up to 440 lbs of pressure for the perfect balance of strength and thermal efficiency. Tool-free upgrades, shock-absorbing feet, and a 3D antenna deliver true durability
- ➍ [Dual-Channel RAM & NVMe SSD Expandability] Ships with 8GB DDR4 RAM and a 256GB NVMe SSD for smooth everyday performance. Dual memory slots and dual storage slots give you the flexibility to upgrade to 64GB RAM and 2TB SSD, so your system can adapt as your workload grows. Enjoy faster load times, smoother multitasking, and long-term reliability.
- ➎ [Triple 4K Displays for Maximum Productivity] Connect up to three 4K monitors via HDMI 2.0, Mini DisplayPort 1.4, and USB-C — ideal for stock trading dashboards, multi-tab research, office document editing, and light spreadsheet work. WiFi 6 and Bluetooth with high-gain antenna ensure stable wireless connections throughout your workspace. 5x USB ports and a full-size SD card reader provide quick access to peripherals and camera files — no adapters required.
Database isolation
Staging should use its own database, not a live connection to production. Development should have another database, usually disposable and populated with fixtures. Separate database instances or at least separate database servers and credentials prevent a migration, test cleanup, or accidental write from altering customer data. Grant each application only the permissions it needs; a web process should not have unrestricted administrative rights over every database.
If staging needs production-like records, export only the fields required for testing, anonymize names, email addresses, tokens, payment details, and other personal or secret values, then transfer the sanitized dataset through a controlled channel. Define who may access the copy, when it is deleted, and how long backups retain it. Never solve a testing problem by handing production credentials to a developer or by copying an unredacted database into a shared environment.
Secrets and configuration
Keep non-production secrets in protected CI variables or a dedicated secret store, and keep production secrets in a separately controlled store. Environment files on the VPS should be readable only by the deployment user and the services that need them. Use different signing keys, encryption keys, webhook secrets, OAuth credentials, and third-party API accounts for every environment. Add a startup check that fails clearly when a required variable is missing rather than silently using a development default.
Networks and service discovery
Attach only the edge proxy to the public-facing network. Put each environment’s application, worker, database, and cache on a private network with unique names. Do not connect development and staging networks merely to make debugging easier; use an explicit, temporary tunnel when cross-environment inspection is unavoidable, and remove it afterward.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Automate a build-once, promote-the-same-artifact pipeline
The safest small-team workflow is a single immutable image or package built by CI. Rebuilding separately for staging and production can produce different dependencies, timestamps, or compiler output, so test the exact artifact that will serve users.
Rank #4
- 【AMD Ryzen 4300U True 4-Core CPU: Outperforms N95 & i3-10110U】KAMRUI P2 Mini PC is equipped with true 4-core AMD Ryzen 4300U processor built on advanced 7nm Zen2 architecture，This means you get consistent, unthrottled performance for hours on end, whether you’re running multiple browser tabs, streaming 4K content, or managing virtual machines. Compare that to Intel N95 (4 efficiency cores that throttle under load) or Intel i3-10110U (only 2 cores total), and the difference is night and day: The KAMRUI P2 AMD Ryzen 4300U (28W) is 40% faster than the Intel i3-10110U and 25% faster than the Intel N95 in multi-core tasks, ensuring smooth, lag-free performance even during heavy workloads.
- 【Integrated AMD Radeon Graphics: 2.5X Stronger for Tri 4K】The KAMRUI P2 AMD 4300U Mini PC have unlocked the full potential of the built-in AMD Radeon Vega 5 graphics with 28W power delivery, making it 2.5 times stronger than the Intel UHD graphics found in the N95 and i3-10110U. This means you can enjoy Tri 4K@60Hz displays without a single stutter, perfect for productivity setups, home theaters, or even light photo/video editing and casual gaming. While the Intel N95/i3-10110U struggle to run a single 4K display without lag, The KAMRUI AMD 4300U Mini PC handles Tri 4K effortlessly, turning your workspace into a high-efficiency hub or your living room into a premium entertainment center.
- 【Large Storage Capacity, Easy Expansion】KAMRUI Pinova P2 mini computers is equipped with 16GB LPDDR4 for faster multitasking and smooth application switching. 512GB M.2 SSD ensures fast startup, fast file transfers and plenty of storage space,eliminating slow loading times and ensuring fast responsiveness. the two storage slots (1x M.2 2280 SATA/NVMe PCIe3.0 slot, 1x M.2 2280 SATA slot) can be combined to provide up to 4TB of total storage(Not included). This gives you enough space for all your projects, media and data.
- 【4K Triple Display】KAMRUI Pinova P2 4300U mini desktop computers is equipped with HDMI2.0 ×1 +DP1.4 ×1+USB3.2 Gen2 Type-C ×1 interfaces for faster transmission, Triple 4K@60Hz Display, KAMRUI P2 mini computer is ideal for visual home entertainment, home office, conference rooms, etc. USB3.2 Gen2 Type-A port ×2 with a transfer speed of up to 10 Gbps (21 times faster than USB 2.0) for efficient data transfer. Ideal for seamless multitasking between spreadsheets, browsers and presentations, or for an immersive entertainment experience.
- 【USB3.2 Gen2 Type-C 10Gbps, Versatile connectivity】KAMRUI P2 mini desktop pc fast and versatile connectivity! The USB3.2 Gen2 Type-C port offers a data transfer rate of 10Gbps and simultaneously supports DisplayPort 1.4 video output. The P2 AMD Ryzen 4300U Mini PC is complemented by Gigabit LAN, WiFi and Bluetooth, so nothing stands in the way of a productive working environment.
- Commit or pull request: Run formatting checks, static analysis, unit tests, integration tests, and dependency or container scans. Reject the change when required checks fail.
- Build: CI creates one versioned image or release archive, records its source revision, and pushes it to a private registry. Use an immutable digest or unique tag rather than a floating
latesttag. - Deploy staging: The staging deployment identity can pull the artifact and update only the staging Compose project. Apply compatible database migrations, restart or roll the services, and wait for health checks.
- Exercise staging: Test login, critical workflows, background jobs, outbound integrations in a sandbox mode, queue processing, and representative load. Confirm that logs contain no secrets and that the proxy routes the intended hostname.
- Gate promotion: Require an explicit approval or a policy gate after staging health checks. Record who approved the release and which artifact digest was tested.
- Promote production: Use the same digest, not a new build. Deploy with a production-only identity, apply migrations in the planned order, verify service health, and watch error rates, latency, logs, and queue depth.
- Record the release: Save the artifact digest, migration version, configuration change, approver, and rollback target. Keep deployment scripts and Compose definitions in version control.
The cited runbook describes GitHub Actions building images once per merge, deploying staging, gating on health, and promoting the same tag to production (VPS deployment runbook). Adapt the provider and CI system to your team, but preserve the build-once and promote-the-same-artifact property.
Handle schema changes safely
When old and new application versions may run together during a rollout, use expand-and-contract migrations. First add nullable columns, new tables, or compatible indexes; deploy code that can read both old and new shapes; backfill in controlled batches; switch reads and writes; then remove obsolete columns in a later release. Avoid a migration that drops or renames a column while the previous version may still be serving requests. Test the migration and its rollback implications against a staging copy before production.
Operate the VPS as a service, not a one-time installation
Logs and monitoring
Retain application and reverse-proxy logs outside the container filesystem. Include timestamps, request identifiers, status codes, and latency while filtering credentials, tokens, and personal data. Monitor CPU, memory, disk usage and inode exhaustion, container health, database connections and storage, queue depth, certificate expiry, and backup success. Alerts should identify an owner and a response path; an alert that nobody can act on becomes background noise.
Backups and restore drills
Back up databases and persistent volumes on a schedule appropriate to the data-loss objective. Keep at least one copy outside the VPS and protect it with separate credentials. Encrypt backups where they contain sensitive data, restrict access, and define retention so that a corrupted or deleted record is not replicated forever. A successful backup job is not proof of recoverability: periodically restore into an isolated environment, run integrity checks, and time the process. Document the restore command, required secrets, DNS changes, and validation checks.
Patching and capacity
Schedule operating-system, runtime, container-base, database, and proxy updates. Read release notes for breaking changes and test updates in staging first. Track capacity trends rather than waiting for an outage: sustained memory pressure can trigger the kernel’s out-of-memory killer, full disks can stop databases and certificate renewal, and an unbounded log or upload directory can consume a shared volume. Set alerts before those limits are reached.
Prepare rollback and full rebuild procedures
A rollback is useful only when it is faster and safer than improvisation. Keep the previous known-good image available, document the command or automation that selects it, and define which migrations are backward-compatible. For an application-only fault, revert the image and configuration while preserving data. For an incompatible schema change, follow the tested migration recovery plan rather than restoring a database blindly.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAlso maintain a clean rebuild procedure. It should start with a fresh Ubuntu image and end with DNS, certificates, firewall rules, service definitions, encrypted secrets, restored data, and health checks. Store infrastructure code, Compose files, proxy configuration, backup instructions, and migration documentation outside the VPS. A rebuild drill exposes hidden dependencies such as manually edited files, an administrator’s personal SSH key, or a certificate account that exists only on the old host.
Quick Recap
Troubleshoot by following the request path
The hostname resolves but returns a proxy error
- Check the DNS record and confirm it points to the intended public address.
- Verify the edge proxy has a matching virtual host and a valid certificate.
- Check that the upstream container is healthy and listening on its private network address.
- Inspect proxy and application logs for connection-refused, timeout, or TLS errors.
SSH access stopped working after hardening
- Use the provider console or recovery mode rather than opening SSH to the whole internet.
- Confirm the user’s home directory and
authorized_keyspermissions, the active key, and the firewall allowlist. - Validate SSH configuration before reloading it, then restore key access from a second terminal.
A deployment passes CI but fails in staging
- Compare the deployed image digest with the artifact recorded by CI; do not assume a mutable tag points to the tested image.
- Check missing environment variables, file permissions, database connectivity, migration status, and health-check commands.
- Inspect differences between staging and development that are intentional, such as TLS, callback URLs, worker counts, and sandbox credentials.
Production slows down during a staging test
- Check CPU, memory, disk I/O, network throughput, and database connections for contention.
- Throttle builds, tests, and background workers, and assign resource limits to non-production services.
- If contention persists or production cannot meet its recovery and performance objectives, move production to a separate VPS.
Final security and recovery checklist
- Current Ubuntu LTS image with security updates applied.
- Named sudo account; application processes never run as root.
- SSH keys tested; password login and direct root login disabled.
- Provider and host firewalls expose only administration SSH and public HTTP/HTTPS.
- Databases, caches, Docker, and internal admin ports remain private.
- Separate hostnames, networks, Compose projects, directories, credentials, secrets, and databases for every environment.
- Production data is inaccessible to development and staging; any test copy is minimized and anonymized.
- One immutable artifact is built, tested in staging, health-checked, approved, and promoted unchanged.
- Logs, capacity, certificate expiry, database health, and backup success are monitored.
- Backups include an off-host copy and have been restored in a drill.
- Rollback, migration recovery, and clean-host rebuild steps are written and tested.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
