How to Set Up a Node.js Server from Scratch (2026)

Complete guide: fresh server → running Node.js app with SSL, auto-restart, and monitoring.

Prerequisites

• A VPS (DigitalOcean $4/mo, Hetzner, Linode, etc.)
• A domain name (optional but recommended)
• SSH access to the server

Step 1: Initial Server Setup

# SSH into your server
ssh root@your-server-ip

# Update everything
apt update && apt upgrade -y

# Create a non-root user (security best practice)
adduser deploy
usermod -aG sudo deploy

# Switch to new user (or use su - deploy)
su - deploy

# Install essential tools
sudo apt install -y curl wget git vim ufw software-properties-common build-essential

Step 2: Install Node.js via NVM

# Don't use apt for Node.js! It's outdated.
# Use nvm instead:

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
source ~/.bashrc

nvm install 22          # Install latest LTS
nvm use 22              # Use it
nvm alias default 22    # Make default

node -v                 # v22.x.x
npm -v                  # 10.x.x

# Global packages I always need
npm install -g pm2 nodemon

Step 3: Firewall Setup

# Configure UFW firewall
sudo ufw allow OpenSSH        # Port 22 (SSH)
sudo ufw allow 80             # HTTP
sudo ufw allow 443            # HTTPS
sudo ufw enable               # Enable firewall
sudo ufw status verbose       # Check rules

# Optional: Allow additional ports
# sudo ufw allow 3000         # If your app runs on port 3000 directly

Step 4: Deploy Your App

# Clone your repo (or copy files)
cd /var/www/
sudo mkdir myapp && cd myapp
sudo chown deploy:deploy .
git clone https://github.com/you/your-app.git .

# Install dependencies
npm ci --production   # ci = clean install (respects package-lock.json)

# If TypeScript:
npm run build

# Test it works
npm start &
# Test with: curl http://localhost:3000
kill %1

Step 5: Process Manager (PM2)

# Start your app with PM2
pm2 start npm --name "myapp" -- start

# Check status
pm2 list
pm2 logs myapp           # View logs
pm2 monit                # Real-time monitoring dashboard

# Useful commands
pm2 restart myapp        # Restart
pm2 stop myapp           # Stop
pm2 delete myapp         # Remove
pm2 info myapp           # Detailed info

# Save process list (survives reboot)
pm2 startup              # Shows command to run
# Run the command it shows:
sudo env PATH=$PATH:/home/deploy/.nvm/versions/node/v22.x/bin pm2 startup systemd -u deploy --hp /home/deploy
pm2 save                 # Save current process list

# Now PM2 starts automatically on boot!

Ecosystem Config (Recommended)

// ecosystem.config.js
module.exports = {
  apps: [{
    name: 'myapp',
    script: 'npm',
    args: 'start',
    cwd: '/var/www/myapp',

    // Auto-restart on crash
    autorestart: true,

    // Max restarts per second (prevent infinite loop)
    max_restarts: 10,

    // Restart if using too much memory
    max_memory_restart: '500M',

    // Environment variables
    env: {
      NODE_ENV: 'production',
      PORT: 3000,
      HOST: '127.0.0.1',
    },

    // Logging
    log_date_format: 'YYYY-MM-DD HH:mm:ss Z',
    error_file: '/var/log/myapp/error.log',
    out_file: '/var/www/myapp/out.log',
    merge_logs: true,
  }],
};

// Usage:
// pm2 start ecosystem.config.js
// pm2 reload all     // Zero-downtime reload!

Step 6: Nginx Reverse Proxy

# Install Nginx
sudo apt install nginx -y

# Create config file
sudo nano /etc/nginx/sites-available/myapp

server {
    listen 80;
    server_name your-domain.com www.your-domain.com;  # Or your IP

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;

        # WebSocket support
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';

        # Headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # Static assets caching (if you serve any)
    location /static/ {
        alias /var/www/myapp/public/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
}

# Enable site
sudo ln -s /etc/nginx/sites-available/myapp /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default  # Remove default site

# Test config
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

# Your app is now live at http://your-server-ip or http://your-domain.com!

Step 7: Free SSL with Let's Encrypt

# Install Certbot
sudo apt install certbot python3-certbot-nginx -y

# Get certificate (auto-configures Nginx!)
sudo certbot --nginx -d your-domain.com -d www.your-domain.com

# Follow prompts:
# - Enter email
# - Agree to terms
# - Choose redirect (option 2: redirect HTTP to HTTPS)

# Done! Your site now has HTTPS.

# Test auto-renewal (certificates expire in 90 days)
sudo certbot renew --dry-run

# Auto-renewal is already set up via systemd timer
sudo systemctl status certbot.timer

Step 8: Security Hardening

# Add to your Nginx config (inside server block):

# Hide Nginx version
server_tokens off;

# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Block access to hidden files
location ~ /\. {
    deny all;
}

# Limit request size (prevent huge uploads)
client_max_body_size 10M;

# Additional security steps:

# Disable root SSH login
sudo sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# Install fail2ban (auto-block brute force attempts)
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Automatic security updates
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure unattended-upgrades  # Select "Yes"

Step 9: Monitoring & Log Rotation

# Create log directory
sudo mkdir -p /var/log/myapp
sudo chown deploy:deploy /var/log/myapp

# Log rotation (prevent disk fill!)
sudo nano /etc/logrotate.d/myapp

/var/log/myapp/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    create 0640 deploy deploy
}

# Quick health check script
cat > /var/www/myapp/health.sh << 'EOF'
#!/bin/bash
if pm2 pid myapp > /dev/null; then
  echo "✅ App running (PID: $(pm2 pid myapp))"
else
  echo "❌ App NOT running!"
  exit 1
fi

HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/)
echo "HTTP Status: $HTTP_STATUS"

DISK_USAGE=$(df -h / | awk 'NR==2{print $5}')
echo "Disk usage: $DISK_USAGE"

MEM_FREE=$(free -h | awk '/Mem:/{print $7}')
echo "Free memory: $MEM_FREE"
EOF
chmod +x /var/www/myapp/health.sh

# Run anytime: ./health.sh

Complete Deployment Checklist

□ Server updated (apt upgrade)
□ Non-root user created
□ Node.js installed via nvm
□ UFW firewall configured (SSH + HTTP + HTTPS only)
□ App code deployed to /var/www/myapp/
□ Dependencies installed (npm ci)
□ PM2 configured and running
□ PM2 startup saved (survives reboot)
□ Nginx installed and configured as reverse proxy
□ DNS pointing to server IP
□ SSL certificate installed (Let's Encrypt)
□ HTTP redirects to HTTPS
□ Security headers configured
□ Root SSH login disabled
□ Fail2Ban running
□ Log rotation configured
□ Health check script working
□ Tested: curl https://your-domain.com

---

What does your deployment setup look like? Anything you'd add?

Follow @armorbreak for more DevOps content.

Comments

[jaafar_soufiane22]

Really solid walkthrough. The deployment checklist at the end is especially useful since it's easy to forget things like log rotation or automatic backups. My recent Node.js projects have mostly been on Hostinger with their Node.js hosting, but the production workflow still ends up looking very similar. PM2 and Nginx have been reliable enough that I haven't felt the need to change much. Interested to hear what everyone else is using for production these days.