Use systemd Host site applications: users, environmental files, restarts and logs

Close SSH The website should continue to run.

Execute at terminal npm start The site may disappear directly when the session is broken, the server restarts or the process collapses.systemd The value is to write how to run into a system that can understand: who to run, where to start, how to handle failure, where to log. Finish before starting New Server Basic Configuration and SSH Firewall security settings. The following myapp and 127.0.0.1:3000 As an example, directories and commands must be replaced with the true value of the item.

Start with the same command with a dedicated user.

Creates a system user that cannot cross login and only has the required directory. Do not write directly unit ; then repeats the permissions; first switch to the user and executes the correct startup command using the production environment variable.

sudo useradd --system --home /opt/myapp --shell /usr/sbin/nologin myapp
sudo chown -R myapp:myapp /opt/myapp
sudo -u myapp -H /usr/bin/node /opt/myapp/server.js

Confirm application of only listening 127.0.0.1:3000♪ And use ♪ curl http://127.0.0.1:3000/health Authentication.Node, pnpm , or other run-time paths to use command -v Absolute path found;systemd You don't automatically load your interactions. shell Configure.

Environmental documents and unit Save separately

Put a private configuration on /etc/myapp/myapp.env Owner root, the group can be a dedicated group, with a limit of 640 or more. The environmental document is not a safe, and the process with access is still visible; the true high-sensitivity value is combined with the specific value. secrets Mechanisms and rotation.

# /etc/systemd/system/myapp.service
[Unit]
Description=My website application
After=network.target

[Service]
Type=simple
User=myapp
Group=myapp
WorkingDirectory=/opt/myapp
EnvironmentFile=/etc/myapp/myapp.env
ExecStart=/usr/bin/node /opt/myapp/server.js
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

Don't be here. ExecStart Write Dependence shell A complex chain command is developed. When you need to build, migrate, and start three phases, you need to put the building in the release process, the database is migrated to separate controls, and the service is responsible only for starting the version that is ready.

Load, start and verify in three steps.

sudo systemd-analyze verify /etc/systemd/system/myapp.service
sudo systemctl daemon-reload
sudo systemctl start myapp
sudo systemctl status myapp --no-pager
curl -fsS http://127.0.0.1:3000/health
sudo systemctl enable myapp

First. start And verify health, again. enable Turn it on.status Display active Only indicates that the process exists and does not represent a page available, so a health end point must be requested.

Restart Not as active as possible.

Restart=on-failure It's for unexpected exit.RestartSec Leaves time to rely on restoration and logs. Do not restart a configuration error at very short intervals, which fills the log and hides the first error.systemd There's a start-up frequency limit. You should check the root after triggering. reset-failed. The application of active normal exit requires a reboot depending on the semantics of the process.

Use journalctl Look at the current round, not the drowning in history.

journalctl -u myapp -n 100 --no-pager
journalctl -u myapp -f
journalctl -u myapp --since '20 minutes ago'

The log should have time, level, and request associated information, but the password and the complete token cannot be printed. journal, also confirm the disk ceiling and retention cycle of the system log.

Completion criteria

Close SSH The application is still in progress. The server is automatically returned after restart. root Environmental file rights can be explained. Health endpoints are successful.journalctl You can find the reasons for a startup and a failure.Caddy Reverse agent for multiple sites and configuration validation.