GuidesDevOps and hosting
Hosting a site or an app on a VPS: the DevOps method
What a VPS gives you, and what it asks
A VPS is a virtual server rented by the month. You install what you want on it: a site, an API, a database, scheduled jobs. The price does not move with traffic.
In exchange, nobody looks after it for you. Updates, security and backups are yours.
Votons runs this way: a site, an API and automatic ingestion jobs on an OVH VPS.
Secure it before installing anything
A new server is scanned by bots within an hour of going online. The first moves:
- SSH by key only. Password login disabled, direct root login disabled.
- A firewall that opens only the useful ports: SSH, 80 and 443.
- Automatic security updates for the system.
- One user per service, without admin rights.
- The database closed to the outside. It listens only on the machine.
The web server: Caddy
Caddy serves files, forwards requests to applications and handles HTTPS by itself. It obtains and renews certificates with no intervention. Its configuration fits in a few lines per site.
Two uses:
- Static site. Caddy serves a folder of files. It is the simplest, fastest and safest case.
- Application. Caddy receives requests and passes them to the application running on a local port.
We add compression, long cache headers for files whose name changes with every version, and security headers.
Deploy without thinking about it
A manual deployment always ends with something forgotten. Write a script, once.
For a static site:
- 1BuildThe site is built.
- 2CopyThe files go to a new folder on the server.
- 3SwitchThe site points to that folder.
- 4Keep the old oneTo roll back in one command.
< 1 minA rollback should take under a minute, and should already have been tried.
For an application, the principle is the same with Docker images: build, push, start the new version, check that it responds, then stop the old one.
The rule: a rollback must take less than a minute, and must already have been tried.
Back up, and test the restore
A backup that has never been restored is a hope. The minimum:
- a daily copy of the database, encrypted, sent off the server;
- several days and several weeks of history;
- files uploaded by users, backed up too;
- a full restore run on another machine, at regular intervals.
Monitor
You want to learn about an outage before your users do.
- An external probe that calls the site every minute and alerts on failure.
- Alerts on disk, memory and certificate expiry dates.
- Application logs kept and searchable.
- Application error tracking, with context.
Moving servers without downtime
A domain moves from one server to another through its DNS. To make the switch invisible:
- 1Day −1Lower the TTLThe time to live of the DNS records.
- 2BeforeTest everythingThe complete site, on the new server, at a temporary address.
- 3Day 0Change the DNSThe record points to the new server.
- 4A few daysKeep the old oneRunning, while all visitors follow.
- 5ThenRaise the TTLThe time to live goes back to normal.
When a VPS is no longer enough
A single VPS lasts a long time. You move on when you need guaranteed availability through hardware failures, or when load varies sharply from one hour to the next. Before that, you can grow the machine, move the database to a managed service, or put a CDN in front of the site.
Frequently asked questions
- VPS or managed platform?
- A managed platform saves time at the start and bills by usage. A VPS costs a fixed price and gives you control over everything, in exchange for administering the server. The choice mostly depends on who will look after the machine.
- Do you need Docker on a VPS?
- Not for a static site. For an application with a database, Docker guarantees that production runs exactly like the development environment, and makes rollbacks easier.
- How do you get HTTPS on a VPS?
- With a web server such as Caddy, which requests and renews Let’s Encrypt certificates on its own. The domain only needs to point to the server, with ports 80 and 443 open.
