DEV Community: Manuchehr

Fixing my sleep schedule fixed my year

Manuchehr — Sat, 03 Jan 2026 04:44:59 +0000

I've been thinking about this article for a bit long time. I didn't want to talk about something until I finished. For a record, I was a night coder who worked till 1-2 am and woke up barely at 10 am, that was a real mess, because I didn't feel productive but lazy and somewhat sleepy. I just decided to fix that because I used to sleep from 9-10 pm to 7 am and I really liked it so I gave it a shot.

New sleeping schedule

I made a goal: waking up early without laziness and unproductive, to do so I made a plan:

Go to bed at 10 pm no matter what.
Wake up at 6-7 am. First week it was a real struggle and I felt worse but I started to get used to it and most importantly I started to feel more productive and stress-free. Now, let's be more specific about the plan.

Go to bed at 10 pm no matter what

Well, logically I slept early to wake up early. Go to bed at 10 pm, no phones, no laptop, no light, no books, no kindle, no headsets, no music, nothing. Just go to bed, close my eyes and sleep. If you're sleeping with your phone (probably doom-scrolling) you SHOULD end this. It doesn't even help you sleep at all. Listening to music is controversial it may help you, maybe not, but it's probably the best without these.
As you've guessed, it was basically kinda crazy and boring. I did think about my future ideas, dreams, only good things. Don't think about your past mistakes, bad experience you had and so on. It will make you feel unease and don't help sleeping. If these bad thoughts start to coming to your mind, change the topic immediately, just ignore them and don't think about it.

Environment is another factor to be considered. Personally, I just can't sleep in hot room temperature even in dead cold winter. I sleep better and easily in chill/less-warm room. Also, I eat light 1-3 hours earlier before I go to bed, because I also can't sleep with full stomach so I better sleep hungry rather than full. These are just personal examples, your preferences are probably different so pay attention to them too.

Another most important thing is just stick to it. Do not break your sleeping schedule especially in early weeks no matter what. Don't have meeting with your boss in midnight, don't spend your whole night arguing with flerfs. Just sleep and count sheeps.

Stop judging yourself for everything. Be little more forgiving. If you have weeks long streaks that's awesome always try to achieve that. But, life isn't easy, sometimes you just can't finish your daily goals so when that happens stop judging yourself and think about the present. Last night couldn't sleep earlier? No problem, past doesn't exist, it's gone so think about today.

It took me around 2 weeks to get used to the schedule. It also depends on your body. It may take less or more but you never give up!

Wake up at 6-7 am

Now it's the moment of truth. You wake up early. You have more expectations than your government's promises. But... you.. don't feel good, aren't you? Now you're worse than before. It's part of the process, it should be like that. I remember when I just woke up, only thing I did wish is go back to bed and sleep and I didn't. I felt dizzy, sleepy, lazy, etc... I couldn't work on my projects obviously. In that situations you cannot I repeat YOU CANNOT go back to bed! Try to distract yourself but don't do doom-scrolling nor stress-causing activities. Try doing early light work-out or go out and have some fresh air. If you really really want to sleep and can't stop yourself, try playing games you like in your pc it may help. As I said earlier, it may take a while to get used to it, it took me around 2 weeks.
The result: I wake up at ~6:20 am without any alarm, I just wake up productive, fresh and ready to smash the tasks.

End

I really don't like writing complicated and long articles. I always prefer shorter and simple solutions. Little disclaimer here: None of these are medical advice nor scientific researches but personal experience and personal researches. I don't like including these things to make the article long instead I left these parts to you.
Worth to mention I wrote all of these myself without any AI or third party services that's why there could be grammar mistakes.

How to secure your server. Easy follow-up steps

Manuchehr — Sun, 29 Jun 2025 13:03:46 +0000

Securing the server is crucial. At least these things must be setup in order to make your Ubuntu server more secure.

Updates

First thing you should do when you connect to your fresh new server is update/upgrade packages. Keeping system is up-to-date is probably one of the most important thing.

sudo apt update
sudo apt full-upgrade -y
# Remove unnecessary packages
sudo apt autoremove -y 

# One liner
sudo apt update && sudo apt dist-upgrade -y && sudo apt autoremove -y

No root user!

You really shouldn't use default root user as it's always a bad practice. So let's create a normal user with super user privileges.

Create new user

# adduser <new user username>
adduser ops

Make sure to replace ops with the username you want to create. Then you'll be prompted to create and verify a password for new user:

Output:
Changing the user information for ops
  Enter the new value, or press ENTER for the default

    Full Name []:

    Room Number []:

    Work Phone []:

    Home Phone []:

    Other []:

Is the information correct? [Y/n]

Add the user to the `sudo` group

usermod -aG sudo ops

Again, make sure to replace ops with the username you just created.

You can test new sudo permissions are working with su command to switch to the new user account.

su - ops

As the new user, run any command with sudo:

sudo echo "Test"

For the first time you use sudo in a session, you'll be prompted for the password of that user's account. Enter the password of the user not the root user's password to proceed.

Once you have done all of these above, you can logout/disconnect and be able connect to your server with new user you just created.

SSH & SSHD

Using passwords to connect/login server is vulnerable. We should connect server without passwords with ssh signing keys. First we need to generate ssh key from our local computer:

ssh-keygen -t ed25519

then you'll be prompted with following question:

Where to save ssh key: You may want to provide specific path
Passphrase: You can just skip this step

Output:
> Generating public/private ed25519 key pair.
> Enter file in which to save the key (/Users/<username>/.ssh/id_ed25519):
> Enter passphrase for "/Users/<usernam>/.ssh/id_ed25519" (empty for no passphrase):
> Enter same passphrase again:

Once you've completed all steps, there will be two ssh keys generated public (id_ed25519.pub) & private (id_ed25519). You should copy public <ssh_file_name>.pub file content and add that to ~/.ssh/authorized_keys file in server (create if it doesn't exist). Once you've added public key to server authorized_keys, you may want to reload sshd service:

sudo service sshd reload

To connect server using ssh file:

ssh -i ~/.ssh/id_ed25519 ops@123.12.1.123
# ssh -i <path_to_ssh_private_file> <USER>@<IP>

Now, we're going to change default SSH port (22) to something else, 714 for example. First of all, let's backup current sshd config file:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Before editing configuration file, let's review current options are ok:

sudo ssh -T

Now let's open sshd configuration file:

# Open with nano or vim
sudo nano /etc/ssh/sshd_config
# Edit with vim
# sudo vi /etc/ssh/sshd_config

When editing your configuration file, some options may be commented out by default using a single hash character (#) at the start of the line. In order to edit these options, or have the commented option be recognized, you’ll need to uncomment them by removing the hash.

As mentioned above firstly change default ssh port:

Port 714

You don't have to use this (714) specific port number. You may want to pick something else.

Save the file, reload sshd:

sudo service sshd reload

Once you reload sshd, you should be disconnected from server since we've changed default ssh port from 22 to 714. Reconnect server with new ssh port:

ssh -p 714 -i ~/.ssh/id_ed25519 ops@123.12.1.123
# ssh -p <PORT> -i <path_to_ssh_private_file> <USER>@<IP>

Now, let's back to sshd config and change followings:

PermitRootLogin no
MaxAuthTries 3
LoginGraceTime 20
PasswordAuthentication no
PermitEmptyPasswords no

ChallengeResponseAuthentication no
KerberosAuthentication no
GSSAPIAuthentication no
X11Forwarding no
PermitUserEnvironment no
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no
DebianBanner no

You can find detailed explanation for each of these in DigitalOcean's article.

Now validate config file & restart sshd:

sudo sshd -T
sudo service sshd reload

If you want to implement IP address allowlist, you can checkout DigitalOcean's article.

UFW (Firewall)

UFW is Ubuntu's default firewall which is really useful. But it's usually disabled by default. We're going to setup firewall for our server.

Enable IPV6

By default in most recent ubuntu servers, IPV6 is enabled. To enable this you need to open /etc/default/ufw and search/add IPV6=yes and save the file.

Setup default poicies

First of all we need to deny all incoming traffic while allowing all outgoing traffic.

sudo ufw default deny incoming
sudo ufw default allow outgoing

We need to enable OpenSSH to being able to connect server using ssh:

sudo ufw allow OpenSSH

Output:
OutputRule added
Rule added (v6)

then we need to disallow 22 ssh port and allow 714 (that we've changed earlier):

sudo ufw allow 714
sudo ufw allow 714/tcp

sudo ufw deny 22

⚠️ Be careful with these ports. You may loose being able to connect server if you specify wrong ports.

Allowing other connections

You may want to enable other connections (Nginx, Apache, etc...):

sudo ufw allow http - Allows http (unencrypted) connections
sudo ufw allow https - Allows https connection
sudo ufw allow 'Nginx Full' - Nginx with both http and https
sudo ufw allow 'Apache Full' - Apache with both http and https

You can check available application profiles with following command:

sudo ufw app list

If you want to allow specific port ranges you can use following commands:

sudo ufw allow 3000:3005/tcp
sudo ufw allow 3000:3005/udp

Also you can allow specific IP Addresses:

sudo ufw allow from 203.0.113.4

You can read more about UFW Setup in DigitalOcean's article

Enable UFW

Before enabling firewall, verify which rules were added so far:

sudo ufw show added

and to enable firewall run the following command:

sudo ufw enable

sometimes firewall doesn't "enable" (take effect). You may just reboot the server and you're good to go.

Bonus

If you use nginx you may want to make it safer too. You can use DigitalOcean's handy tool here: https://www.digitalocean.com/community/tools/nginx

If you use docker, you always don't need to expose services (postgres, redis) to outside of server. Not exposing these outside of server is recommended.

Thanks for your attention. I'd be happy if this helps you somehow 😊

Written by manuchehr.me

Minio integration with nestjs | file upload & retrieve

Manuchehr — Fri, 29 Nov 2024 08:40:32 +0000

What is minio? Minio is *free, open-source, scalable S3 compatible object storage.

First of all, let's setup minio in docker container. I use bitnami's minio package. Add minio service to your docker-compose.yaml:

services:
  minio:
    image: bitnami/minio:2024.11.7
    restart: always
    ports:
      - ${MINIO_PORT}:${MINIO_PORT}
      - ${MINIO_CONSOLE_PORT}:${MINIO_CONSOLE_PORT}
    environment:
      MINIO_ROOT_USER: ${MINIO_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_PASSWORD}
      MINIO_DEFAULT_BUCKETS: ${MINIO_BUCKET}
      MINIO_API_PORT_NUMBER: ${MINIO_PORT}
      MINIO_CONSOLE_PORT_NUMBER: ${MINIO_CONSOLE_PORT}
    volumes:
      - minio-data:/bitnami/minio/data

volumes:
  minio-data:
    driver: local

Let me explain this quickly:

ports: MINIO_PORT is minio's port for API requests, while as the name says MINIO_CONSOLE_PORT is minio's dashboard port:
MINIO_ROOT_USER & MINIO_ROOT_PASSWORD are for login credentials to login minio console dashboard.

For more information about env variables of minio docker image, visit bitnami's minion docker image

Add these variables to your .env file:

MINIO_PORT=9000
MINIO_CONSOLE_PORT=8000
MINIO_USER="admin"
MINIO_PASSWORD="veryhardpassword"
MINIO_BUCKET="main"
MINIO_ENDPOINT="localhost"
MINIO_ACCESS_KEY=""
MINIO_SECRET_KEY=""

To obtain access and secret keys:

Go to minio console (it's http://localhost:8000 in our example) & sign in.
Go Access Keys & Create access key
Copy & add access/secret keys to .env

Setup minio client in nestjs

Install npm minio package

pnpm add minio

Create minio/minio.decorator.ts & minio/minio.module.ts

import { Inject } from '@nestjs/common';

export const MINIO_TOKEN = 'MINIO_INJECT_TOKEN';

export function InjectMinio(): ParameterDecorator {
  return Inject(MINIO_TOKEN);
}

import { Global, Module } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { MINIO_TOKEN } from './minio.decorator';
import * as Minio from 'minio';

@Global()
@Module({
  exports: [MINIO_TOKEN],
  providers: [
    {
      inject: [ConfigService],
      provide: MINIO_TOKEN,
      useFactory: async (
        configService: ConfigService,
      ): Promise<Minio.Client> => {
        const client = new Minio.Client({
          endPoint: configService.getOrThrow("MINIO_ENDPOINT"),
          port: +configService.getOrThrow("MINIO_PORT"),
          accessKey: configService.getOrThrow("MINIO_ACCESS_KEY"),
          secretKey: configService.getOrThrow("MINIO_SECRET_KEY"),
          useSSL: false,
        });
        return client;
      },
    },
  ],
})
export class MinioModule {}

If you want to use minio in only one module (files module for example) you can remove @Global() decorator.

Import it to app.module.ts:

@Module({
  imports: [
    ...
    MinioModule,
  ],
})
export class AppModule {}

Now let's test it out. Inject minio to your server (files.service.ts for example)

import { Injectable } from '@nestjs/common';
import { randomUUID } from 'crypto';
import * as Minio from 'minio';
import { InjectMinio } from 'src/minio/minio.decorator';

@Injectable()
export class FilesService {
  protected _bucketName = 'main';

  constructor(@InjectMinio() private readonly minioService: Minio.Client) {}

  async bucketsList() {
    return await this.minioService.listBuckets();
  }

  async getFile(filename: string) {
    return await this.minioService.presignedUrl(
      'GET',
      this._bucketName,
      filename,
    );
  }

  uploadFile(file: Express.Multer.File) {
    return new Promise((resolve, reject) => {
      const filename = `${randomUUID().toString()}-${file.originalname}`;
      this.minioService.putObject(
        this._bucketName,
        filename,
        file.buffer,
        file.size,
        (error, objInfo) => {
          if (error) {
            reject(error);
          } else {
            resolve(objInfo);
          }
        },
      );
    });
  }
}

and it's my files.controller.ts

import { Body, Controller, Get, Param, Post, UploadedFile, UseInterceptors } from '@nestjs/common';
import { FilesService } from './files.service';
import { FileInterceptor } from '@nestjs/platform-express';

@Controller('files')
export class FilesController {
  constructor(readonly service: FilesService) {}

  @Get('buckets')
  bucketsList() {
    return this.service.bucketsList();
  }

  @Get('file-url/:name')
  getFile(@Param('name') name: string) {
    return this.service.getFile(name);
  }

  @Post('upload')
  @UseInterceptors(FileInterceptor('file'))
  uploadFile(
    @UploadedFile('file') file: Express.Multer.File,
  ) {
    payload.file = file;
    return this.service.uploadFile(file);
  }
}

Send a file to POST /files/upload endpoint. It should return this response:

Let's visit minio console and go main bucket to check if file was uploaded

It's uploaded 🥳

Now let's test generating file URL for uploaded file (retrieve file) GET /files/file-url/<file_name>. It should return URL to retrieve file something like this:
http://localhost:8000/main/2254a964-28dd-4c35-8494-5e767693cd26-iOS%2BSyllabus.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=m0iWmenUgJi2xBcFNNPF%2F20241129%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241129T065735Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=a052b98dcfa95a4d1cdb1c9b0b91d1263440adf184aab5238e6d572c0f42e7c5
If you visit this URL you can retrieve that file.

You can find all minio methods with this link

*free - MinIO is free for self-hosted use under the GNU AGPLv3 license, which allows you to run and modify the software as long as any modifications you make are also made available under the same license. This license ensures freedom to use, study, share, and modify the software.

That's all. Thanks for reading I hope it's beneficial for you. If you find any mistake or issue in this post, feel free to comment or let me know.

Dockerize Secure Nestjs app with Postgres & Redis

Manuchehr — Mon, 25 Nov 2024 04:50:48 +0000

I wrote about this exact topic earlier:

Dockerize Nestjs app with Postgres + Redis + Prisma ORM

Manuchehr ・ Dec 28 '23

#docker #nestjs #devops #prisma

So why again? First of all, my previous post was more about Nestjs + prisma and basic Dockerfile, in this post I'm going to cover secure general Dockerization for Nestjs.

Let's create a `Dockerfile`

# Stage 1: Build the app
FROM node:22-alpine AS builder

WORKDIR /usr/src/app

COPY package*.json ./
COPY entrypoint.sh ./
COPY .env ./

RUN yarn install --omit=dev

COPY . .

RUN yarn build

# Stage 2: Setup prod
FROM node:22-alpine

WORKDIR /usr/src/app

COPY --from=builder /usr/src/app/dist ./dist
COPY --from=builder /usr/src/app/entrypoint.sh ./
COPY --from=builder /usr/src/app/package*.json ./
COPY --from=builder /usr/src/app/.env ./

ENV NODE_ENV production

RUN chmod +x ./entrypoint.sh

USER node

ENTRYPOINT ["./entrypoint.sh"]
CMD ["node", "dist/main.js"]

As you can see, Dockerfile consists of two stages: Build & Prod. We need this to minimize build size by only copying essential files or directories (dist) to the final stage. I'm not going deep into Dockerfile in this post, but I'll explain some of the lines:

RUN yarn install --omit=dev: Install only production dependencies possible. Read here
entrypoint.sh it's a bash file containing commands run before our Nestjs application. For example, you may have to run db migrations before Nestjs starts check my previous post.

⚠️ REMEMBER: If you use dev commands in entrypoint.sh file, make sure to install dev dependencies by removing --omit=dev flag from yarn install. Also you need to copy node_modules to final stage.

ENV NODE_ENV production: Always run your Nestjs app on production environment. When you build your Node.js Docker image for production, you want to ensure that all frameworks and libraries are using the optimal settings for performance and security. Read here
USER node: Use node user node:22-alpine image provides. Because you really don't want to run your app as root user. Read here
CMD ["node", "dist/main.js"]: It's good way to run your node/nestjs application with directly node command instead of npm run start:prod (don't do that like I did in my prev post :D). Read here

Bonus

Docker services (Postgres & Redis) setup

Create docker-compose.yaml file:

services:
  app:
    container_name: 'nestjs-app'
    restart: always
    build:
      context: .
      dockerfile: Dockerfile
    environment:
      REDIS_HOST: redis
      DB_HOST: postgres
      PORT: ${PORT}
    ports:
      - ${PORT}:${PORT}
    networks:
      - nestjs-net
    depends_on:
      redis:
        condition: service_healthy
        restart: true
      postgres:
        condition: service_healthy
        restart: true

  redis:
    container_name: 'nestjs-redis'
    image: bitnami/redis:7.4
    restart: always
    ports:
      - ${REDIS_PORT}:${REDIS_PORT}
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      REDIS_PORT_NUMBER: ${REDIS_PORT}
      REDIS_DB: ${REDIS_DB}
      REDIS_IO_THREADS: 4
      REDIS_IO_THREADS_DO_READS: yes
      REDIS_DISABLE_COMMANDS: FLUSHDB,FLUSHALL
    healthcheck:
      test: ['CMD', 'redis-cli', '--raw', 'incr', 'ping']
      interval: 5s
      timeout: 5s
      retries: 5
    volumes:
      - nestjs-redis-data:/bitnami/redis/data
    networks:
      - nestjs-net

  postgres:
    container_name: 'nestjs-postgres'
    image: bitnami/postgresql:17
    restart: always
    environment:
      POSTGRESQL_PORT_NUMBER: ${DB_PORT}
      POSTGRESQL_USERNAME: ${DB_USER}
      POSTGRESQL_PASSWORD: ${DB_PASSWORD}
      POSTGRESQL_DATABASE: ${DB_NAME}
      POSTGRESQL_TIMEZONE: 'Asia/Tashkent' // Set your timezone
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 5s
      retries: 5
    ports:
      - ${DB_PORT}:${DB_PORT}
    volumes:
      - nestjs-postgres-data:/bitnami/postgresql
    networks:
      - nestjs-net

volumes:
  nestjs-redis-data:
    driver: local
  nestjs-postgres-data:
    driver: local

networks:
  nestjs-net:
    driver: bridge

Example .env file:

PORT=9000
# Redis
REDIS_PASSWORD=
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_DB=0
# Postgres
DB_USER=
DB_PASSWORD=
DB_NAME=
DB_PORT=5432
DB_HOST=localhost

That's it! Thanks for reading. I don't say it's 100% secure Docker image because you can always implement something better. If you find any mistake please leave a comment. For more visit: OWASP Node.js Docker Cheat Sheet

Arc Browser is a game changer!

Manuchehr — Mon, 06 May 2024 17:01:32 +0000

Why Arc?

After using Chrome for around 8 years I switched to Arc browser & I love it! Arc browser is based on Chromium which means you can use Chrome's extensions in Arc without a problem. Currently, it's available for Mac & Windows 11 (hot released).
It's faster, more beautiful, and user-friendly & also if you're new to Arc it's easy to migrate to Arc from other browsers such as Chrome with just one click.

I love vertical tabs 'cause it's so comfortable compared to horizontal tabs. Also, it's highly customizable, you can customize your own Arc. If you have multiple devices Arc has a sync feature & you can have Arc profiles.

As a full-stack web developer, I really hate Apple's Safari browser, probably every web developer hates it :P, so we have Chrome which is famous for "eating" RAM

and Internet explorer of course (R.I.P).

Firefox? Are you Linux user? You can say "I use Arc btw" after using Arc (browser)...

Dockerize Nestjs app with Postgres + Redis + Prisma ORM

Manuchehr — Thu, 28 Dec 2023 13:04:26 +0000

We're about to embark on an epic journey into the world of containerization. In this guide, we'll be turning a regular NestJS app into a Dockerized powerhouse, complete with PostgreSQL, Redis, and the magic touch of Prisma ORM.

First of all we should create `Dockerfile`:

FROM node:18-alpine  

WORKDIR /usr/src/app  

COPY package*.json ./  
COPY entrypoint.sh ./  

RUN npm install  

COPY . .

RUN chmod +x /usr/src/app
RUN chmod +x /usr/src/app/entrypoint.sh

RUN npx prisma generate --schema=/usr/src/app/src/database/schema.prisma  

RUN npm run build

ENTRYPOINT ["/usr/src/app/entrypoint.sh", "npm", "run", "start:prod"]  

CMD ["npm", "run", "start:prod"]

FROM node:18-alpine - This line sets the base image for the Docker image. It specifies that the image should be based on the official Node.js 18 Alpine image. Alpine is a lightweight Linux distribution, making the resulting Docker image smaller.
WORKDIR /usr/src/app - This line sets the working directory inside the container to /usr/src/app. Subsequent commands will be executed from this directory.
COPY package*.json ./ - Copies the package.json and package-lock.json files from the host machine to the /usr/src/app directory inside the container. This allows for efficient installation of Node.js dependencies.
COPY entrypoint.sh ./ - Copies the entrypoint.sh script from the host machine to the /usr/src/app directory inside the container. This script might be used to perform additional setup or configuration before starting the application.
RUN npm install - Executes the npm install command inside the container, installing the Node.js dependencies specified in the package.json file. This step is crucial for setting up the application environment.
COPY . ./ - Copies the entire application source code from the host machine to the /usr/src/app directory inside the container. This includes all the application files, not just the package.json and package-lock.json files.
RUN npx prisma generate --schema=/usr/src/app/src/database/schema.prisma - Executes the Prisma CLI command to generate Prisma client code based on the schema defined in /usr/src/app/src/database/schema.prisma. This step is specific to Prisma and is part of the database setup.
RUN npm run build - Executes the npm run build command inside the container. This command is often used to compile TypeScript code or perform other build-related tasks for the Node.js application.
ENTRYPOINT ["/usr/src/app/entrypoint.sh", "npm", "run", "start:prod"] - Specifies the default command to run when the container starts. In this case, it uses the entrypoint.sh script followed by the command npm run start:prod. The entrypoint.sh script handles additional setup before running the application.
CMD ["npm", "run", "start:prod"] - Provides a default command to run when the container starts if no other command is specified. This is overridden by the ENTRYPOINT command. Here, it's set to run npm run start:prod.

by following .dockerignore file:

Dockerfile  
.dockerignore  
node_modules  
npm-debug.log  
dist

You should also create entrypoint.sh this file is executed once docker image is started to make prisma migrations:

#!/bin/sh  

# Apply Prisma migrations and start the application  
npx prisma migrate deploy --schema=/usr/src/app/src/database/schema.prisma  
npx prisma generate --schema=/usr/src/app/src/database/schema.prisma  

# Run database migrations  
npx prisma migrate dev --name init --schema=/usr/src/app/src/database/schema.prisma

# Run the main container command  
exec "$@"

Attention! You should specify the path of your prisma.schema file.

Create a `docker-compose.yml` file:

version: "3"  

services:  
  app:    
    container_name: "myapp_web_app"  
    restart: unless-stopped  
    build:  
      context: .  
      dockerfile: Dockerfile  
    environment:  
      PORT: ${PORT}  
      POSTGRES_HOST: postgres_db # localhost doesn't work in docker container, hence you should use postgres container name instead of localhost
      REDIS_HOST: redis # the same for redis. Use redis container name instead of localhost
    ports:
      - ${PORT}:${PORT}  
    depends_on:  
      - postgres_db  
      - redis  
    networks:  
      myapp_net:

  postgres_db:    
    image: bitnami/postgresql:15  
    container_name: "myapp_postgres_db"  
    restart: unless-stopped  
    environment:  
      POSTGRESQL_USERNAME: ${POSTGRES_USER}  
      POSTGRESQL_PASSWORD: ${POSTGRES_PASSWORD}  
      POSTGRESQL_DATABASE: ${POSTGRES_DB}  
      POSTGRESQL_TIMEZONE: "Asia/Tashkent" # This is optional
    ports:
      - ${POSTGRES_PORT}:5432  
    volumes:  
      - "postgres_data:/bitnami/postgresql"  
    networks:  
      myapp_net:  
  redis:    
    image: "bitnami/redis:7.2"  
    container_name: "myapp_redis"  
    restart: unless-stopped  
    ports:  
      - ${REDIS_PORT}:${REDIS_PORT}  
    volumes:  
      - "redis_data:/bitnami/redis/data"  
    environment:  
      REDIS_PASSWORD: ${REDIS_PASSWORD}  
      REDIS_PORT: ${REDIS_PORT}  
      REDIS_DB: ${REDIS_DB}  
      REDIS_IO_THREADS: 4  
      REDIS_IO_THREADS_DO_READS: yes  
      REDIS_DISABLE_COMMANDS: FLUSHDB,FLUSHALL  
    networks:  
      myapp_net: 

volumes:  
  postgres_data:  
  redis_data:  

networks:  
  myapp_net:

This is my .env file:

PORT=9000
# Postgres
POSTGRES_DB=sampledb  
POSTGRES_HOST=localhost  
POSTGRES_PORT=5432  
POSTGRES_USER=username  
POSTGRES_PASSWORD=password  
DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}?schema=public
# Redis
REDIS_HOST=localhost  
REDIS_PORT=6379  
REDIS_PASSWORD=veryhardpassword  
REDIS_DB=0

Run docker compose

sudo docker compose up -d --build

For windows users:

docker-compose up -d --build

That’s all! I apologize for any mistake I made. If you find any mistake, please let me know.
I hope it’s helpful

Deploying Nestjs app to VPS with nginx, postgres, redis

Manuchehr — Wed, 13 Dec 2023 13:51:39 +0000

Let’s deploy nestjs + postgres + redis + docker app to VPS. Everything is from scratch, hopefully understandable for beginners.

Written by Full stack developer (not a master devops :)

Setting up a basic nginx is not hard. Just a few things you should do:

Install nginx to Linux (ubuntu 20.04)
Create Nginx config file + proxy server
Generate an SSL certificate for your domain name (if you have one)
That’s all. Don’t worry we’ll cover all of these.

Starting nestjs app

First of all, clone your project to the server via git. After that, you run your project. First of all, you need nodejs to run nestjs application. If you use Docker, you can skip these steps & run the Dockerfile.

I recommend to install nvm (Node Version Manager):

curl https://raw.githubusercontent.com/creationix/nvm/master/install.sh | bash
source ~/.bashrc

Once you’ve installed nvm, you need to install node (v18):

nvm i 18

If you use yarn, install it too:

npm i -g yarn

Then go to your project dir, and install packages via npm or yarn, then build your app. After that, install pm2 to run your app (forever):

npm i -g pm2

Once you have installed pm2, check if it’s working:

pm2

If so, you can run your app by following the command. If there is postgres or redis, you need to run them first then run your app (see 2)

pm2 start ./dist/main.js --name my-nestjs-app
# pm2 start <script_file_path.js> --name <name_optional>

If you use Postgres or Redis, I recommend using a Docker Compose for these. This is my sample docker-compose.yml file for Postgres and Redis:

version: "3"
services:
  postgres:
    image: postgres
    restart: always
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    ports:
      - '5432:5432'
    volumes:
      - my-nestjs-app:/var/lib/postgresql/data
  redis:
    image: "bitnami/redis:7.2"
    restart: unless-stopped
    ports:
      - "6379:6379"
#    volumes:
#      - "redis_data:/bitnami/redis/data"
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      REDIS_PORT: ${REDIS_PORT}
      REDIS_DB: ${REDIS_DB}
      REDIS_IO_THREADS: 4
      REDIS_IO_THREADS_DO_READS: yes
      REDIS_DISABLE_COMMANDS: FLUSHDB,FLUSHALL

volumes:
  my-nestjs-app:

To run docker compose you need to have docker. Complete guide to install docker on ubuntu. Once you have installed docker, run docker-compose:

sudo docker compose up -d

Setup nginx

So let’s set up nginx for nestjs app. Before installing nginx, update your existing list of packages:

sudo apt update

Then install nginx:

sudo apt install nginx

Check nginx if it is working:

sudo systemctl status nginx

You will get:

Create an nginx configuration file in /etc/nginx/sites-available/my-nestjs-app

sudo vim /etc/nginx/sites-available/my-nestjs-app

Then copy/paste this configuration:

server {
    server_name domain.com;
    client_max_body_size 300M;

    # add_header 'Access-Control-Allow-Origin' '*';

    location = /favicon.ico { access_log off; log_not_found off; }

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_pass http://127.0.0.1:3000;
    }
}

Let’s understand this configuration:

server_name — According to nginx docs: it is used for a given request. They may be defined using exact names, wildcard names (like domain.com sub.dobmain.com), or regular expressions.
client_max_body_size — the maximum size of a client request body. If this size is exceeded, nginx returns a 413 status code error. If you don’t want that just comment it.
location / — means if the request matches this “/” or the value of location then nginx runs “the code inside of its block”. We used proxy_set_header and proxy_pass directives. proxy_set_header sets the header for the defined request. proxy_pass kinda forwards requests to the given URL or path. We set localhost 3000 so, every request in server_name and location forwards to location 3000 (domain.com/ -> localhost:3000/)

After that, save the file (in vim type :wq) and test the conf file with nginx command:

sudo nginx -t

If you make a syntax error, it will be shown. If everything is ok, create a link:

sudo ln -s /etc/nginx/sites-available/my-nestjs-app /etc/nginx/sites-enabled/my-nestjs-app

then test nginx & restart nginx:

sudo systemctl restart nginx

Setup domain name

First of all, you need to forward the domain name to your VPS. Go to your domain provider dashboard > DNS Records > create a record with A name, and put the IP address of your VPS in the “name” field (example). Then check it’s forwarded to your IP address ($ hostname -I to see IP):

ping domain.com

If these IP addresses are not the same as the IP address of your VPS, you should wait to be the same (it might take minutes to days depending on your domain registrar), otherwise you will face problems.

You need to add an SSL certificate to your domain. It’s easy with certbot, so install cerbot:

sudo apt update
sudo apt install certbot python3-certbot-nginx

After that run this command to generate SSL certificates for your domain:

sudo certbot --nginx -d example.com

After that test the nginx conf file:

sudo nginx -t

If it’s ok, restart nginx:

sudo systemctl restart nginx

That’s all! I apologize for any mistake I made. If you find any mistake, please let me know.
I hope it’s helpful

DEV Community: Manuchehr

Fixing my sleep schedule fixed my year

New sleeping schedule

Go to bed at 10 pm no matter what

Wake up at 6-7 am

End

How to secure your server. Easy follow-up steps

Updates

No root user!

Create new user

Add the user to the sudo group

SSH & SSHD

UFW (Firewall)

Enable IPV6

Setup default poicies

Allowing other connections

Enable UFW

Bonus

Minio integration with nestjs | file upload & retrieve

Setup minio client in nestjs

Dockerize Secure Nestjs app with Postgres & Redis

Dockerize Nestjs app with Postgres + Redis + Prisma ORM

Manuchehr ・ Dec 28 '23

Let's create a Dockerfile

Bonus

Docker services (Postgres & Redis) setup

Arc Browser is a game changer!

Why Arc?

Dockerize Nestjs app with Postgres + Redis + Prisma ORM

First of all we should create Dockerfile:

Create a docker-compose.yml file:

Run docker compose

Deploying Nestjs app to VPS with nginx, postgres, redis

Starting nestjs app

Setup nginx

Setup domain name

Add the user to the `sudo` group

Let's create a `Dockerfile`

First of all we should create `Dockerfile`:

Create a `docker-compose.yml` file: