VPS setup, který skutečně funguje: Node.js, PM2, Nginx a deploy bez vypadku | Akousa

javascript

// ecosystem.config.js
module.exports = {
  apps: [
    {
      name: "myapp",
      script: "node_modules/.bin/next",
      args: "start -p 3002",
      cwd: "/var/www/example.com",
      instances: 2,
      exec_mode: "cluster",
      max_memory_restart: "500M",
      env: {
        NODE_ENV: "production",
        PORT: 3002,
      },
      // Elegantni ukonceni
      kill_timeout: 5000,
      listen_timeout: 10000,
      wait_ready: false,
      // Logovani
      log_date_format: "YYYY-MM-DD HH:mm:ss Z",
      error_file: "/var/log/pm2/myapp-error.log",
      out_file: "/var/log/pm2/myapp-out.log",
      merge_logs: true,
      // Automaticky restart pri selhani
      autorestart: true,
      max_restarts: 10,
      min_uptime: "10s",
      // V produkci nesledovat
      watch: false,
    },
  ],
};

nginx

# /etc/nginx/sites-available/example.com
 
upstream node_app {
    server 127.0.0.1:3002;
    keepalive 64;
}
 
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
 
    # Presmerovani veskeho HTTP na HTTPS
    return 301 https://$host$request_uri;
}
 
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;
 
    # SSL (spravovano Certbot — tyto radky se pridaji automaticky)
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
    # Bezpecnostni hlavicky
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
 
    # Gzip komprese
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        application/xml
        image/svg+xml
        application/wasm;
 
    # Nastaveni proxy
    location / {
        proxy_pass http://node_app;
        proxy_http_version 1.1;
 
        # Hlavicky
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
 
        # Podpora WebSocket (pro pripad potreby)
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
 
        # Timeouty — stedre, ale ne nekonecne
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
 
        # Bufferovani — nechte Nginx obslouzit pomale klienty
        proxy_buffering on;
        proxy_buffer_size 16k;
        proxy_buffers 4 32k;
        proxy_busy_buffers_size 64k;
    }
 
    # Staticke assety Next.js — nechte Nginx je servovat primo
    location /_next/static/ {
        alias /var/www/example.com/.next/static/;
        expires 365d;
        access_log off;
        add_header Cache-Control "public, immutable";
    }
 
    # Verejne staticke soubory
    location /static/ {
        alias /var/www/example.com/public/static/;
        expires 30d;
        access_log off;
    }
 
    # Blokovat pristup k dot souboorum
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

bash

#!/bin/bash
# deploy.sh — nasazeni s (temer) nulovym vypadkem
 
set -euo pipefail
 
APP_DIR="/var/www/example.com"
APP_NAME="myapp"
LOG_FILE="/var/log/deploy.log"
HEALTH_URL="http://localhost:3002"
MAX_RETRIES=10
RETRY_INTERVAL=3
 
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}
 
log "=== Deploy zahajen ==="
 
cd "$APP_DIR"
 
# Stazeni nejnovsiho kodu
log "Stahuji posledni zmeny..."
git pull origin main 2>&1 | tee -a "$LOG_FILE"
 
# Instalace zavislosti
log "Instaluji zavislosti..."
npm install --legacy-peer-deps 2>&1 | tee -a "$LOG_FILE"
 
# Build
log "Builduji aplikaci..."
rm -rf .next
npm run build 2>&1 | tee -a "$LOG_FILE"
 
if [ $? -ne 0 ]; then
    log "CHYBA: Build selhal. Prerusuji deploy."
    exit 1
fi
 
# Reload PM2 (bez vypadku v cluster modu)
log "Reloaduji PM2..."
pm2 reload "$APP_NAME" 2>&1 | tee -a "$LOG_FILE"
pm2 save 2>&1 | tee -a "$LOG_FILE"
 
# Health check s opakovani
log "Spoustim health check..."
for i in $(seq 1 $MAX_RETRIES); do
    HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' "$HEALTH_URL" 2>/dev/null || echo "000")
    if [ "$HTTP_CODE" = "200" ]; then
        log "Health check prosel (HTTP $HTTP_CODE)"
        log "=== Deploy uspesne dokoncen ==="
        exit 0
    fi
    log "Pokus health checku $i/$MAX_RETRIES (HTTP $HTTP_CODE). Opakuji za ${RETRY_INTERVAL}s..."
    sleep $RETRY_INTERVAL
done
 
log "CHYBA: Health check selhal po $MAX_RETRIES pokusech"
log "Vracim se k predchozimu stavu PM2..."
pm2 restart "$APP_NAME" 2>&1 | tee -a "$LOG_FILE"
exit 1

VPS setup, který skutečně funguje: Node.js, PM2, Nginx a deploy bez vypadku

Zacnete bezpecnosti, ne kodem

Vytvorte ne-root uzivatele

Nastavte SSH autentifikaci klicem

Firewall s UFW

Fail2Ban

Automatické bezpecnostni aktualizace

Node.js: Pouzijte NVM, ne apt

PM2: Správce procesu, který si zaslouzi sve místo

Instalace a nastaveni

Ecosystem konfigurace

Startovaci skript

Rotace logu

Nginx: Reverse proxy, který umí vic, nez si myslite

Instalace

Konfigurace

SSL za pet minut

Overeni automatickeho obnoveni

Deploy skript

Kdyz se věci rozbiji ve dve ráno

"Web je dole"

"Pamet stale roste"

"SSL certifikat vyprsel"

"Disk je plny"

Prikaz, který spoustim každé ráno

Co vam většina prirucek nerekne

Kompletni checklist

Je toto "enterprise-grade"?

Související články

Monorepos in 2026: Nx, Turborepo, and the Lessons Nobody Shares

YAML Validator Guide: Catch Config Errors Before Deploy