DEV Community: marlinekhavele

Deploying a FastAPI Application on Digital Ocean Droplet with Nginx and CI/CD

marlinekhavele — Tue, 16 Sep 2025 09:24:50 +0000

Deploying a FastAPI application with Nginx on Digital Ocean droplet can be challenging especially for beginners. This guide will walk you through setting up an Droplet, installing necessary dependencies, configuring Nginx as a reverse proxy, and setting up a CI/CD pipeline with GitHub Actions.
Prerequisites

A Digital Ocean account.
A FastAPI application in a GitHub repository.
Basic familiarity with the command line and SSH.

Part 1: Setting Up Your Digital Ocean Droplet

Create a Droplet:

Log in to your Digital Ocean dashboard and click "Create" -> "Droplets".
Choose Ubuntu (a recent LTS version like 22.04 or 24.04) as your distribution.
Select a plan. The Basic Shared CPU plan is a great starting point.
Choose a datacenter region closest to you.
Authentication: For security, highly prefer SSH keys over a password. Add your SSH public key. If you haven't set one up, follow this guide.
Finalize and create the Droplet.

Access Your Droplet:

Once created, find the Droplet's public IP address in your dashboard.
Open your terminal and connect:

ssh root@your_droplet_ip_address

Part 2: Server Setup and Application Installation
Once logged in as root, run these commands to prepare your server.

Create a Non-root User (Security Best Practice):

adduser deployer
usermod -aG sudo deployer

This creates a new user named deployer and adds it to the sudo group.

Copy your SSH key to the new user to allow password less login:

rsync --archive --chown=deployer:deployer ~/.ssh /home/deployer

Now, you can disconnect and log in as the new user: ssh deployer@your_droplet_ip_address.

Update the System:

sudo apt update && sudo apt upgrade -y

Install Python, Pip, and Pipenv: We will use pipenv for managing your application's virtual environment and dependencies.

sudo apt install python3-pip -y
pip3 install pipenv

Install Nginx: Nginx will act as a reverse proxy, handling client requests and passing them to your FastAPI app.

sudo apt install nginx -y

Set Up Firewall (UFW): Configure the firewall to allow SSH, HTTP, and HTTPS traffic.

sudo ufw allow 'OpenSSH'
sudo ufw allow 'Nginx Full'
sudo ufw enable

Part 3: Configuring Nginx as a Reverse Proxy
Create an Nginx Configuration File:

Create a new file for your site in /etc/nginx/sites-available/. Paste the following configuration: Replace your_droplet_ip_addresswith your actual IP or domain name if you have one.

server {
    listen 80;
    server_name your_droplet_ip_address;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

This tells Nginx to listen on port 80 and forward all traffic to the FastAPI application running on 127.0.0.1:8000.

Enable the Configuration:

Create a symbolic link to the sites-enableddirectory:

sudo ln -s /etc/nginx/sites-available/fastapi_app /etc/nginx/sites-enabled/

Test the Nginx configuration for syntax errors:

sudo nginx -t

If successful, restart Nginx:

sudo systemctl restart nginx

Part 4: Deploying the Application Manually

Clone Your Repository:

git clone https://github.com/your_username/your_repo_name.git /home/deployer/app
cd /home/deployer/app

Install Dependencies with Pipenv:

pipenv install

Run the Application:
Let's test if everything works. Run your app inside the Pipenv shell

pipenv run uvicorn main:app --host 0.0.0.0 --port 8000

Visit http://your_droplet_ip_address in your browser. You should see your FastAPI app running behind Nginx! Press Ctrl+C to stop the server.

Part 5: Automating Deployments with GitHub Actions CI/CD
We'll create a workflow that automatically deploys our app when we push to the main branch.

Create GitHub Secrets:
In your GitHub repository, go to Settings > Secrets and variables > Actions.

Create two new secrets: HOST: Your Droplet's IP address. SSH_PRIVATE_KEY: The entire contents of your private SSH key (the one that matches the public key you added to Digital Ocean).

Create the Workflow File:
In your repo, create the directory .github/workflows/ and a file inside it named deploy.yml.

Configure the Deployment Workflow:
Paste the following YAML configuration into .github/workflows/deploy.yml:

name: Deploy to DigitalOcean Droplet

on:
  push:
    branches: [ main ]

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Deploy to Droplet
      uses: appleboy/ssh-action@v1.0.0
      with:
        host: ${{ secrets.HOST }}
        username: deployer
        key: ${{ secrets.SSH_PRIVATE_KEY }}
        script: |
          cd /home/deployer/app
          git pull origin main
          pipenv install
          sudo systemctl restart fastapi.service

Create a Systemd Service

The CI/CD script above tries to run sudo systemctl restart fastapi.service. We need to create this service to run our app in the background and restart on reboot.
On your Droplet,create a service file:

sudo nano /etc/systemd/system/fastapi.service

Paste the following configuration, adjusting paths if necessary (User, WorkingDirectory, and the command):

[Unit]
Description=FastAPI Application
After=network.target

[Service]
User=deployer
Group=www-data
WorkingDirectory=/home/deployer/app
Environment="PATH=/home/deployer/.local/bin"
ExecStart=/usr/local/bin/pipenv run uvicorn main:app --host 0.0.0.0 --port 8000

[Install]
WantedBy=multi-user.target

Enable and start the service:

sudo systemctl daemon-reload
sudo systemctl enable fastapi.service
sudo systemctl start fastapi.service

You can check its status with: sudo systemctl status fastapi.service.

You're Live!
Your automated pipeline is now set up. The next time you push code to the main branch on GitHub, the GitHub Action will:

SSH into your Droplet.
git pull the latest code.
pipenv install any new dependencies.
Restart the fastapi.service to apply the changes.

You can now visit your Droplet's IP address in a web browser, and you will see your automatically deployed FastAPI application!

Terraform: UP& Running

marlinekhavele — Mon, 15 Sep 2025 06:52:22 +0000

As programmers, git is our safety net. git commit is a snapshot of our application's truth. git log tells a story of what changed, when, and why. We can experiment with git branch and, if things go wrong, revert to a known good state with git revert.

Now, imagine your cloud infrastructure the servers, databases, and networks on AWS, Azure, or Google Cloud is governed by the same principles. No more frantic note taking, trying to remember which checkbox you clicked in a web console. No more "works on my machine" extended to "works in my cloud account." This is the promise of Terraform

What is Terraform?
Terraform is an Infrastructure as Code (IaC) tool created by HashiCorp. It allows you to define and provision your entire infrastructure using a declarative configuration language.

Think of it like this: Instead of manually clicking buttons in the AWS console to create a server, you write a configuration file that describes that server. You then tell Terraform to make the real world infrastructure match your description. It's version control for your infrastructure.

The Console Clicking Problem
You have felt the pain. You need a new staging environment. You spend an hour carefully clicking through the AWS console, configuring a VPC, subnets, security groups, EC2 instances, and a load balancer. It works yeeei!

Two weeks later you need to create an identical environment for a new client. You can't remember the exact steps. Was the ingress rule on the security group for port 8080 or 8000? Which AMI ID did I use? The knowledge of how to build the system is trapped in your head and a series of irreversible clicks.

Terraform solves this by capturing that knowledge in code.The Same Changes, The Same Knowledge

The core beauty of Terraform is that the same changes we do locally are the same knowledge we are using to build our infrastructure.

Write Code: You define your infrastructure in files with a.tf extension using HashiCorp Configuration Language (HCL), which is both human and machine readable.

Plan: You run terraform plan. Terraform reads your code, compares it to the current state of your infrastructure, and generates an execution plan. This is like a dry run it shows you exactly what will be created, changed, or destroyed before it happens. This is your ultimate safety check.

Apply: You run terraform apply. Terraform executes the plan, making API calls to the cloud provider to build the infrastructure you described.

The .tffiles you write become the single source of truth. They are the knowledge.

They can be:
Version Controlled: Committed to git, alongside your application code.
Reviewed: Peer reviewed in pull requests.
Reused: Used to create identical dev, staging, and production environments.
Shared: Onboard new team members by giving them the code, not a 50 page manual.

The Manual Click Way:

Go to EC2 Dashboard.
Click "Launch Instance".
Choose "Amazon Linux 2 AMI".
Choose "t2.micro".
Click "Review and Launch", then "Launch".

The Terraform Way:
You create a file named main.tf:

# Configure the AWS Provider
provider "aws" {
  region = "us-east-1"
}

# Declare the resource you want to create
resource "aws_instance" "my_web_server" {
  ami           = "ami-0c02fb55956c7d316" # Amazon Linux 2
  instance_type = "t2.micro"

  tags = {
    Name = "MyWebServer"
  }
}

Then, you execute the plan:

terraform init    # Initializes Terraform and downloads the AWS provider
terraform plan    # Shows the execution plan
terraform apply   # Creates the EC2 instance

This code is now documentation. It's repeatable. It's shareable. If you want a second server, you copy the block, change the Name tag, and run apply again. The knowledge is no longer in your head; it's in the codebase.

Core Benefits

Visibility & Collaboration: Everyone on the team can see the infrastructure design and propose changes via code reviews.
Consistency & Reliability: Eliminates manual error and ensures environments are identical.
Speed & Efficiency: Provisioning a complex infrastructure that took days can now be done in minutes.
Lifecycle Management: Terraform isn't just for creation. It manages the entire lifecycle updates, scaling, and, crucially, clean destruction (terraform destroy), which is perfect for tearing down test environments to save costs.

Getting started is straightforward:

Install Terraform on your machine.
Configure Credentials for your cloud provider (e.g AWS CLI).
Write a .tf file defining a simple resource (like the EC2 instance above).
Run terraform init, plan, and apply.

You have just taken the first step out of the console and into a world of codified, version controlled, and reliable infrastructure management.