진짜 작동하는 VPS 설정: Node.js, PM2, Nginx, 그리고 무중단 배포

ssh-copy-id deploy@your-server-ip

sudo nano /etc/ssh/sshd_config

PasswordAuthentication no
PermitRootLogin no

sudo systemctl restart sshd

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
source ~/.bashrc
nvm install --lts
nvm alias default lts/*

node -v  # v22.x.x 또는 현재 LTS 버전
npm -v

nvm alias default 22

npm install -g pm2

// ecosystem.config.js
module.exports = {
  apps: [
    {
      name: "myapp",
      script: "node_modules/.bin/next",
      args: "start -p 3002",
      cwd: "/var/www/example.com",
      instances: 2,
      exec_mode: "cluster",
      max_memory_restart: "500M",
      env: {
        NODE_ENV: "production",
        PORT: 3002,
      },
      // 그레이스풀 셧다운
      kill_timeout: 5000,
      listen_timeout: 10000,
      wait_ready: false,
      // 로깅
      log_date_format: "YYYY-MM-DD HH:mm:ss Z",
      error_file: "/var/log/pm2/myapp-error.log",
      out_file: "/var/log/pm2/myapp-out.log",
      merge_logs: true,
      // 실패 시 자동 재시작
      autorestart: true,
      max_restarts: 10,
      min_uptime: "10s",
      // 프로덕션에서는 watch 하지 마세요
      watch: false,
    },
  ],
};

pm2 startup systemd
# 출력되는 명령을 복사해서 실행
pm2 save

pm2 install pm2-logrotate
pm2 set pm2-logrotate:max_size 50M
pm2 set pm2-logrotate:retain 7
pm2 set pm2-logrotate:compress true

sudo apt install nginx -y

# /etc/nginx/sites-available/example.com
 
upstream node_app {
    server 127.0.0.1:3002;
    keepalive 64;
}
 
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
 
    # 모든 HTTP를 HTTPS로 리다이렉트
    return 301 https://$host$request_uri;
}
 
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;
 
    # SSL (Certbot이 관리 — 이 줄들은 자동으로 추가됨)
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
    # 보안 헤더
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
 
    # Gzip 압축
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        application/xml
        image/svg+xml
        application/wasm;
 
    # 프록시 설정
    location / {
        proxy_pass http://node_app;
        proxy_http_version 1.1;
 
        # 헤더
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
 
        # WebSocket 지원 (필요한 경우를 위해)
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
 
        # 타임아웃 — 넉넉하지만 무한하지 않게
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
 
        # 버퍼링 — Nginx가 느린 클라이언트를 처리하게
        proxy_buffering on;
        proxy_buffer_size 16k;
        proxy_buffers 4 32k;
        proxy_busy_buffers_size 64k;
    }
 
    # Next.js 정적 에셋 — Nginx가 직접 서빙
    location /_next/static/ {
        alias /var/www/example.com/.next/static/;
        expires 365d;
        access_log off;
        add_header Cache-Control "public, immutable";
    }
 
    # 퍼블릭 정적 파일
    location /static/ {
        alias /var/www/example.com/public/static/;
        expires 30d;
        access_log off;
    }
 
    # dot 파일 접근 차단
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.com

sudo systemctl list-timers | grep certbot

sudo certbot renew --dry-run

#!/bin/bash
# deploy.sh — 거의 무중단 배포
 
set -euo pipefail
 
APP_DIR="/var/www/example.com"
APP_NAME="myapp"
LOG_FILE="/var/log/deploy.log"
HEALTH_URL="http://localhost:3002"
MAX_RETRIES=10
RETRY_INTERVAL=3
 
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}
 
log "=== 배포 시작 ==="
 
cd "$APP_DIR"
 
# 최신 코드 가져오기
log "최신 변경사항 가져오는 중..."
git pull origin main 2>&1 | tee -a "$LOG_FILE"
 
# 의존성 설치
log "의존성 설치 중..."
npm install --legacy-peer-deps 2>&1 | tee -a "$LOG_FILE"
 
# 빌드
log "애플리케이션 빌드 중..."
rm -rf .next
npm run build 2>&1 | tee -a "$LOG_FILE"
 
if [ $? -ne 0 ]; then
    log "에러: 빌드 실패. 배포 중단."
    exit 1
fi
 
# PM2 리로드 (클러스터 모드에서 무중단)
log "PM2 리로드 중..."
pm2 reload "$APP_NAME" 2>&1 | tee -a "$LOG_FILE"
pm2 save 2>&1 | tee -a "$LOG_FILE"
 
# 재시도가 있는 헬스 체크
log "헬스 체크 실행 중..."
for i in $(seq 1 $MAX_RETRIES); do
    HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' "$HEALTH_URL" 2>/dev/null || echo "000")
    if [ "$HTTP_CODE" = "200" ]; then
        log "헬스 체크 통과 (HTTP $HTTP_CODE)"
        log "=== 배포 성공적으로 완료 ==="
        exit 0
    fi
    log "헬스 체크 시도 $i/$MAX_RETRIES (HTTP $HTTP_CODE). ${RETRY_INTERVAL}초 후 재시도..."
    sleep $RETRY_INTERVAL
done
 
log "에러: $MAX_RETRIES번 시도 후 헬스 체크 실패"
log "이전 PM2 상태로 롤백 중..."
pm2 restart "$APP_NAME" 2>&1 | tee -a "$LOG_FILE"
exit 1

chmod +x deploy.sh

ssh root@your-server-ip "bash /var/www/example.com/deploy.sh"

pm2 status
pm2 logs myapp --lines 50
sudo systemctl status nginx
sudo tail -50 /var/log/nginx/error.log

pm2 monit

pm2 describe myapp

sudo certbot certificates

sudo certbot renew --force-renewal
sudo systemctl reload nginx

df -h
du -sh /var/log/*
pm2 flush

ssh deploy@example.com "pm2 status && df -h / && uptime"

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

# ~/.ssh/config
Host myapp
    HostName YOUR_SERVER_IP
    User deploy
    IdentityFile ~/.ssh/id_ed25519