To start off some public notes and documenting what I learn, I decided to tackle setting up a fresh Ubuntu VPS to host my personal website, a side-project, and a small Minecraft server.

Introduction

While I’ve been coding on and off since about 2013 (nearly half my life now), I spent way too much of that time following a YouTube tutorial series, copy and pasting code, and not doing any real learning. During my time in college, I learned the value of just parsing the standard library, learning my tools and learning how to use them well, and just creating something is a far greater than I initially thought it was.

Around the start of 2024 I got hooked on the IndieWeb movement (introduced by the website jvt.me, not sure how I initially found it, unfortunately) and creating my own personal garden. That, coupled with the trend now to move from the cloud back to self-hosting applications (which is ironic given that I was on a project at work to move from self-hosting to the cloud…), I really wanted to learn things on my own without relying on heavy infrastructure like Vercel and the like.

With that I thought it would be a golden oppertunity to take the time to document setting up a VPS, securing it, while learning a bit about the web on the way. I will be setting all of this up on an OVH Comfort VPS running a fresh Ubuntu 24.04 installation. Before getting into it, I should define a few requirements.

Requirements

Two domains, HTTPS, www

I have two domains, taxborn.com and braxtonfair.com. I have the username taxborn everywhere, so I essentially ‘brand’ myself as such. I did also want to have my name as a domain in case I ever decided to ditch the name, but today is not that day. I want to redirect all traffic from braxtonfair.com -> https://www.taxborn.com.

I want to ensure all traffic is encrypted with SSL, and force www. I went back and forth on whether to have www.taxborn.com or the non-prefixed taxborn.com. Looked at a couple [1] [2] resources and determined it was mostly bikeshedding and went with www.taxborn.com.

Easy deployments and updates

I got to learn a lot about GitHub Actions at work during my internship.

Understand my setup

VPS Cleanup

I have created notes on setting up a VPS already, and can be found here.

Installing Nginx

These commands are pulled from nginx’s instructions.

As of writing, the default apt repository has Nginx version 1.24.0, but checking the nginx website downloads shows a recent mainline version 1.27.2. I want to use the latest mainline version (not the stable, seems recommended to use mainline), so we need to change which repository apt uses to download Nginx:

Mainline version (recommended)

If you want the latest and greatest, you can use the mainline version of Nginx. This branch may also have experimental modules and new bugs.

# install required packages
sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring
# get the signing key
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
    | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
# install mainline packages
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/mainline/ubuntu `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list
# ensure apt uses nginx's repos over apt's
echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" \
    | sudo tee /etc/apt/preferences.d/99nginx
# install nginx and check version
sudo apt update
sudo apt install nginx

Stable version

The only difference in this process is the 3rd command, setting the url to http://nginx.org/packages/ubuntu over http://nginx.org/packages/mainline/ubuntu.

# install required packages
sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring
# get the signing key
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
    | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
# install stable packages
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list
# ensure apt uses nginx's repos over apt's
echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" \
    | sudo tee /etc/apt/preferences.d/99nginx
# install nginx and check version
sudo apt update
sudo apt install nginx

Creating a site to host

*TODO: I want to explore using Docker, K8s, or Earthly, so I may come back and update this part for that.*

I already have a website I want to host, taxborn.com. This is a website created with Astro. On their website, Astro describes itself as:

Astro is a JavaScript web framework optimized for building fast, content-driven websites.

I have had a great experience with the framework, and love the fast outputs. It has the option to output a statically-generated website (SSG), or output to a server (in my case, Node.JS).

Start by creating a /var/www folder: sudo mkdir -p /var/www. This is where our website will live. We then need to setup permissions for the www folder. sudo chown -R ubuntu:www-data /var/www, which allows the ubuntu user and the www-data user group to own this directory. Also, add the ubuntu user to the www-data group sudo usermod -aG www-data ubuntu.

We can then cd /var/www, and clone the repo we want to use (e.g. git clone https://github.com/taxborn/taxborn.com).

Getting Node

I’ve recently been enjoying using fnm, so will install the latest Node version through that. fnm use --install-if-missing 22.

I eventually want to use deploy keys and GitHub Actions CI/CD so this way of updating the website will change.

Then it’s just a matter of installing the dependencies and building: npm i && npm run build. The built website is in the dist/ folder. To run my website, I execute the command node dist/server/entry.mjs, which results in:

01:23:43 [@astrojs/node] Server listening on http://localhost:4321

The website is running on the VPS on port 4321. We can’t access this quite yet, we are going to configure Nginx as a reverse proxy (cloudflare has a nice article about this) as a TLS termination proxy to handle https traffic.

This allows our Node application to not have to handle https communication itself, allowing some performance gains (I should really benchmark this claim, though).

DNS

I already have my domains (taxborn.com and braxtonfair.com) verified with OVH and pointing at this server. Currently not being proxied through Cloudflare but will turn that on later. TTL is set to 1 day and I set both A and AAAA records.

Configuring Nginx

The configuration files for Nginx (at least in Ubuntu, likely in other distributions) lay in /etc/nginx. Let’s make sure we have 2 folders available to us, sudo mkdir /etc/nginx/sites-available and sudo mkdir /etc/nginx/sites-enabled. We can create a config for taxborn.com with sudo vim /etc/nginx/sites-available/www.taxborn.com:

1
server {
2
    listen 80;
3
    server_name taxborn.com www.taxborn.com 15.204.234.44;
4

5
    location / {
6
        proxy_pass http://localhost:4321;
7
        proxy_http_version 1.1; # TODO: how does HTTP/2 perform?
8
        proxy_set_header Upgrade $http_upgrade;
9
        proxy_set_header Connection 'upgrade';
10
        proxy_set_header Host $host;
11
        proxy_cache_bypass $http_upgrade;
12
    }
13

14
    # Optional: Add logging
15
    access_log /var/log/nginx/your_app_access.log;
16
    error_log /var/log/nginx/your_app_error.log;
17
}

Let’s now enable the site www.taxborn.com by creating a symlink sudo ln -s /etc/nginx/sites-available/www.taxborn.com /etc/nginx/sites-enabled/, and ensure our nginx configuration loads the site sudo vim /etc/nginx/nginx.conf

1
user  nginx;
2
worker_processes  auto;
3

4
error_log  /var/log/nginx/error.log notice;
5
pid        /var/run/nginx.pid;
6

7
events {
8
    worker_connections  1024;
9
}
10

11
http {
12
    include       /etc/nginx/mime.types;
13
    default_type  application/octet-stream;
14

15
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
16
                      '$status $body_bytes_sent "$http_referer" '
17
                      '"$http_user_agent" "$http_x_forwarded_for"';
18

19
    access_log  /var/log/nginx/access.log  main;
20
    sendfile        on;
21
    #tcp_nopush     on;
22

23
    keepalive_timeout  65;
24
    #gzip  on;
25

26
    # include /etc/nginx/conf.d/*.conf;
27
    include /etc/nginx/sites-enabled/*;
28
}

I plan to thoroughly document these settings soon, in a seperate note. To ensure your configuration is valid, run sudo nginx -t, and if all is well, restart with sudo systemctl restart nginx.

From there, we need to ensure our firewall allows traffic over port 80, really easy with ufw: sudo ufw allow 80/tcp and sudo ufw reload. Now I can access my website at http://15.204.234.44.

Generating an SSL certificate

Certbot AKA LetsEncrypt has been my go-to for this for a while. Before we get too far, let’s ensure that we also allow traffic over port 443, with sudo ufw allow 443/tcp && sudo ufw reload.

Installing certbot is easy, sudo apt install certbot python3-certbot-nginx. From there, we can generate an SSL certificate with the following command: sudo certbot --nginx -d taxborn.com -d www.taxborn.com. Let certbot do it’s thing, and you should see something like the following at the end:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/taxborn.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/taxborn.com/privkey.pem
This certificate expires on 2025-01-11.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for taxborn.com to /etc/nginx/sites-enabled/www.taxborn.com
Successfully deployed certificate for www.taxborn.com to /etc/nginx/sites-enabled/www.taxborn.com
Congratulations! You have successfully enabled HTTPS on https://taxborn.com and https://www.taxborn.com

The file at /etc/nginx/sites-available/www.taxborn.com should look a bit different now:

1
server {
2
    server_name taxborn.com www.taxborn.com;
3

4
    location / {
5
        proxy_pass http://localhost:4321;
6
        proxy_http_version 1.1; # TODO: how does HTTP/2 perform?
7
        proxy_set_header Upgrade $http_upgrade;
8
        proxy_set_header Connection 'upgrade';
9
        proxy_set_header Host $host;
10
        proxy_cache_bypass $http_upgrade;
11
    }
12

13
    # Optional: Add logging
14
    access_log /var/log/nginx/your_app_access.log;
15
    error_log /var/log/nginx/your_app_error.log;
16

17
    listen 443 ssl; # managed by Certbot
18
    ssl_certificate /etc/letsencrypt/live/taxborn.com/fullchain.pem; # managed by Certbot
19
    ssl_certificate_key /etc/letsencrypt/live/taxborn.com/privkey.pem; # managed by Certbot
20
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
21
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
22
}
23

24
server {
25
    if ($host = www.taxborn.com) {
26
        return 301 https://$host$request_uri;
27
    } # managed by Certbot
28

29
    if ($host = taxborn.com) {
30
        return 301 https://$request_uri;
31
    } # managed by Certbot
32

33
    listen 80;
34
    server_name taxborn.com www.taxborn.com;
35
    return 404; # managed by Certbot
36
}

A little messy, I am going to clean that up a bit and add some comments…

1
# HTTP Server block - responsible for upgrading all http:// traffic to https://www.taxborn.com
2
server {
3
    listen 80;
4
    server_name taxborn.com www.taxborn.com;
5

6
    if ($host = www.taxborn.com) {
7
        return 301 https://$host$request_uri;
8
    }
9

10
    if ($host = taxborn.com) {
11
        return 301 https://www.$$request_uri;
12
    }
13

14
    return 404;
15
}
16

17
# HTTPS Server block - responsible for handling the SSL certificate
18
server {
19
    listen 443 ssl; # managed by Certbot
20
    server_name taxborn.com www.taxborn.com;
21

22
    # OPTIONAL: I like to enforce the www subdomain
23
    if ($host = taxborn.com) {
24
        return 301 https://www.taxborn.com$request_uri;
25
    }
26

27
    # Reverse proxy for our node application being hosted locally on port 4321
28
    location / {
29
        proxy_pass http://localhost:4321;
30
        proxy_http_version 1.1; # TODO: how does HTTP/2 perform?
31
        proxy_set_header Upgrade $http_upgrade;
32
        proxy_set_header Connection 'upgrade';
33
        proxy_set_header Host $host;
34
        proxy_cache_bypass $http_upgrade;
35
    }
36

37
    # Optional: Add logging
38
    access_log /var/log/nginx/taxborn_access.log;
39
    error_log /var/log/nginx/taxborn_error.log;
40

41
    # SSL options
42
    ssl_certificate /etc/letsencrypt/live/taxborn.com/fullchain.pem; # managed by Certbot
43
    ssl_certificate_key /etc/letsencrypt/live/taxborn.com/privkey.pem; # managed by Certbot
44
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
45
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
46
}

Much better… again test the config with an sudo nginx -t and reload with sudo systemctl restart nginx.

SSL

Mozilla provides a helpful resource for some reasonable SSL defaults in an Nginx config. Let’s incorporate those recommendations.

They also have configurations for various server software like Apache, HAProxy, etc…

1
# HTTP Server block - responsible for upgrading all http:// traffic to https://www.taxborn.com
2
server {
3
    listen 80;
4
    listen [::]:80;
5
    server_name taxborn.com www.taxborn.com;
6

7
    location / {
8
        return 301 https://www.taxborn.com$request_uri;
9
    }
10
}
11

12
# HTTPS Server block - responsible for handling the SSL certificate
13
server {
14
    listen 443 ssl;
15
    listen [::]:443 ssl;
16
    server_name taxborn.com www.taxborn.com;
17

18
    # enable http2
19
    http2 on;
20

21
    ssl_certificate /etc/letsencrypt/live/taxborn.com/fullchain.pem;
22
    ssl_certificate_key /etc/letsencrypt/live/taxborn.com/privkey.pem;
23
    ssl_session_timeout 1d;
24
    ssl_session_cache shared:MozSSL:10m; # about 40k sessions
25

26
    # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
27
    ssl_dhparam /etc/nginx/dhparam;
28

29
    # HSTS and Preload
30
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" always;
31
    add_header Content-Security-Policy "frame-ancestors 'none'" always;
32
    add_header X-Frame-Options "DENY" always;
33
    add_header X-Content-Type-Options "nosniff" always;
34

35
    # OCSP stapling
36
    ssl_stapling on;
37
    ssl_stapling_verify on;
38

39
    # intermediate *configuration*
40
    ssl_protocols TLSv1.2 TLSv1.3;
41
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
42
    ssl_prefer_server_ciphers off;
43

44
    # OPTIONAL: I like to enforce the www subdomain
45
    if ($host = taxborn.com) {
46
        return 301 https://www.taxborn.com$request_uri;
47
    }
48

49
    # Reverse proxy for our node application being hosted locally on port 4321
50
    location / {
51
        proxy_pass http://localhost:4321;
52
        proxy_http_version 1.1; # TODO: how does HTTP/2 perform?
53
        proxy_set_header Upgrade $http_upgrade;
54
        proxy_set_header Connection 'upgrade';
55
        proxy_set_header Host $host;
56
        proxy_cache_bypass $http_upgrade;
57
    }
58

59
    # Optional: Add logging
60
    access_log /var/log/nginx/taxborn_access.log;
61
    error_log /var/log/nginx/taxborn_error.log;
62
}

Testing our configuration

There are a few resources I use to test my website configuration.

MDN’s HTTP Observatory - ensure proper headers are setup.
Qualys SSL Labs - test SSL configuration to ensure a secure setup.
Probely Security Headers - another headers check.

Conclusion

That’s about what it took for me to deploy my web application on a VPS with Nginx and secured with HTTPS. I will issue a few more updates to this as I learn more but that got me to a place where I was initially happy.