1. Understand Your VPS Networking

Before touching any software, understand how your server talks to the internet.

VNIC (Virtual Network Interface Card) – This is your server’s “network adapter.” All incoming and outgoing traffic passes through it.
Subnet – Defines the range of IP addresses your VPS can use. Your VPS typically sits in a public subnet so it can be accessed from the internet.

Why it matters:

Your firewall rules and NGINX configuration depend on which ports are open on your VNIC/subnet.
Many VPS providers block high-numbered ports by default (e.g., 3000). This is why apps running on ports like 3000 or 5000 are often unreachable externally unless proxied through NGINX.

Best practice: Use port 80 (HTTP) and 443 (HTTPS) for public access, and keep your app running on localhost ports (like 3000) behind a reverse proxy.

2. Update Your Server and Add Basic Security

Start by updating your server packages and setting up firewall rules:

sudo apt update && sudo apt upgrade -y
sudo apt install ufw fail2ban -y

Enable UFW firewall:

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable
sudo ufw status

OpenSSH allows you to connect via SSH.
Nginx Full opens ports 80 (HTTP) and 443 (HTTPS).
Fail2Ban protects your server from brute-force attacks.

3. Create a Non-root User

Running your app as root is dangerous. Let’s create a safe user:

sudo adduser akash
sudo usermod -aG sudo akash

Set up SSH keys for this user:

ssh-keygen -t ed25519
cat ~/.ssh/id_ed25519.pub | ssh akash@YOUR_VPS_IP 'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys'

Now you can log in as akash instead of root. ✅

4. Install Node.js and NPM Permanently

Many tutorials use NVM, but it can reset after session logout. For a system-wide installation, do:

curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs
node -v
npm -v

This ensures Node.js and NPM are available across all users and sessions.

Deploying a Node.js Application in Production on Ubuntu

Deploying a Node.js application in a production environment requires a stable runtime, process management, and automatic recovery on failures. On Ubuntu, this can be achieved efficiently using PM2, a production-grade process manager for Node.js.

Installing Node.js on Ubuntu

The recommended way to install Node.js in production is by using NVM (Node Version Manager), which allows easy version management and upgrades.


sudo apt update
sudo apt install -y curl
curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
source ~/.bashrc
nvm install --lts
node -v
npm -v

Installing Application Dependencies

After uploading or cloning your Node.js application to the server, navigate to the project directory and install production dependencies.


cd /home/ubuntu/your-app
npm install --production

Running the Application with PM2

PM2 ensures your Node.js application remains online by restarting it automatically if it crashes. It also runs the app in the background and tracks resource usage.


npm install -g pm2
pm2 start app.js --name node-app
pm2 list

Enabling Auto-Start on Server Reboot

To ensure your application starts automatically after a server reboot, PM2 must be registered with Ubuntu’s systemd service manager.


pm2 startup
sudo env PATH=$PATH:/home/ubuntu/.nvm/versions/node/bin \
/home/ubuntu/.nvm/versions/node/lib/node_modules/pm2/bin/pm2 \
startup systemd -u ubuntu --hp /home/ubuntu
pm2 save

Once configured, PM2 will resurrect your application automatically during system startup.

Monitoring and Logs

PM2 provides built-in monitoring and logging tools that help diagnose issues in production.


pm2 logs node-app
pm2 monit

Best Practices for Production

Always use a Node.js LTS version, keep sensitive values in environment variables, and avoid running applications as the root user. For better security and performance, use Nginx as a reverse proxy and enable HTTPS with SSL certificates.

5. Install PHP (Optional)

If your project uses PHP:

sudo apt install php-cli php-fpm -y
php -v

PHP FPM is suitable for production.
For quick testing, you can also run the built-in dev server:

php -S 127.0.0.1:3000

6. Set Up Your App Directory

Organize your project:

mkdir -p ~/fm
cd ~/fm

For Node projects:

npm init -y
npm install -g live-server

Start your app for testing:

live-server --port=3000 --host=127.0.0.1

Your app now runs locally on port 3000, but it’s not accessible from the internet yet. We’ll fix that with NGINX.

7. Install and Configure NGINX

sudo apt install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx

Check NGINX is listening:

sudo ss -tulnp | grep 80

7.1 Reverse Proxy Configuration

Create an NGINX site configuration:

sudo nano /etc/nginx/sites-available/college.skytup.com

Add the following:

server {
    listen 80;
    server_name college.skytup.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

Enable the site:

sudo ln -s /etc/nginx/sites-available/college.skytup.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Now all traffic to college.skytup.com on port 80 will forward to your app on 127.0.0.1:3000.

8. DNS Setup

Go to your domain registrar / Cloudflare dashboard.
Add an A record:

Type	Name	Value	TTL	Proxy
A	@	YOUR_VPS_IP	Auto	On
A	www	YOUR_VPS_IP	Auto	On

Wait for DNS propagation (can take a few minutes to 24 hours).

Check propagation:

dig +short college.skytup.com
ping college.skytup.com

Both should return your VPS IP.

9. Enable HTTPS with Certbot

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d college.skytup.com

Follow prompts and select redirect HTTP → HTTPS.
Test NGINX config and reload:

sudo nginx -t
sudo systemctl reload nginx

Now your app works at:

https://college.skytup.com

10. Security Checklist

Run apps under non-root users.
Open only required ports: 22 (SSH), 80 (HTTP), 443 (HTTPS).
Use NGINX as a reverse proxy → protects your dev server.
Enable Fail2Ban for SSH protection.
Use Certbot for free SSL and auto-renewal.
Keep packages updated (sudo apt update && sudo apt upgrade -y).

11. Common Pitfalls and Fixes

Issue	Cause	Solution
Cannot access port 3000 externally	VPS firewall blocks it	Use NGINX reverse proxy instead
522 Error Cloudflare	Cloudflare cannot reach server	Open firewall and ensure NGINX listens on 0.0.0.0:80/443
Node/NPM resets	NVM session lost	Install Node/NPM system-wide via NodeSource
HTTPS fails	No SSL cert or misconfigured NGINX	Use Certbot and enable redirect
DNS not pointing	Domain not propagated	Use `dig` or `ping` to verify IP resolution

12. Test Everything

Direct IP access (HTTP): http://YOUR_VPS_IP → works, optional.
Domain (HTTPS): https://college.skytup.com → works with SSL and redirection.
Check Cloudflare proxy: Orange cloud → Full SSL recommended.
Node app runs on localhost:3000, NGINX handles all external traffic.

✅ Key Takeaways

Never expose dev servers directly.
Use NGINX as a reverse proxy for security, performance, and HTTPS.
System-wide Node/NPM installation prevents session resets.
Configure DNS correctly, wait for propagation, and verify.
Use Certbot for HTTPS and automatic renewal.
Security first: firewall, non-root users, Fail2Ban.

Deploying Your App on a VPS: From Scratch to HTTPS with NGINX, Node, and PHP

Comments