What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a production web2py service, use Nginx at the edge, uWSGI between Nginx and web2py, and PostgreSQL as a separately protected stateful service. Docker is optional. It improves repeatability when your team already builds and operates containers, but it does not solve database persistence, backups, secrets, upgrades, monitoring, or network security.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
A conventional host installation follows the web2py manual most directly and usually involves fewer moving parts. A containerized deployment is sensible when image builds, Compose, or an orchestrator are already part of your operating model. In either case, keep PostgreSQL data outside disposable application layers, terminate HTTPS at Nginx, and document the exact Python and web2py versions you deploy.
As an Amazon Associate I earn from qualifying purchases.
The production request path
web2py is a WSGI application. Its built-in Rocket server has limited configuration capability, so the official deployment guidance places it behind a production web server such as Nginx. Nginx handles the public connection, TLS and static files; uWSGI passes dynamic requests to web2py using the uwsgi protocol; web2py uses PostgreSQL for application data.
The protocols matter. WSGI is the Python application interface, while uwsgi is the protocol Nginx uses to talk to uWSGI. They are related but not interchangeable: Nginx needs the uWSGI adapter and the matching uwsgi_params settings. A typical flow is:
#1 Best Overall
Client --HTTPS--> Nginx --uwsgi socket--> uWSGI --WSGI--> web2py --TCP/SSL--> PostgreSQLKeeping the database as a separate service makes its lifecycle explicit. It may run on another host, on a managed database platform, or in a dedicated database container, but it should not be treated as an ephemeral part of the web container.
Check the web2py lifecycle before choosing an installation model
The project overview states that web2py 2.27.1 is the last release supporting Python 2.7. web2py 3.x supports Python 3.9 and newer and is in limited maintenance mode; the project recommends moving to its successor, py4web. That status does not prevent an existing web2py application from being deployed, but it changes the risk calculation for a new system.
Before building an image or provisioning servers, record:
- The web2py release and application commit.
- The Python major and minor version.
- The uWSGI and Nginx versions supplied by your operating system or image.
- The PostgreSQL major version and the Python PostgreSQL adapter version.
- Operating-system package versions or immutable image digests.
Pin those choices in the deployment repository. Recheck compatibility before upgrades, especially when a base image or distribution moves to a newer Python release. Limited maintenance also means you should evaluate whether py4web is a better target for a new project rather than assuming a long stream of web2py updates.
Option 1: a conventional host installation
This approach installs Nginx, uWSGI and web2py on the application host and PostgreSQL on a managed disk or separate database host. It follows the official recipe without adding a container runtime or image registry.
1. Install the service components
Use your distribution’s supported packages for Nginx, uWSGI, Python and the PostgreSQL client adapter. Install PostgreSQL from the distribution package or use a separately managed PostgreSQL service. Package names and uWSGI plugin names differ by distribution, so verify that the installed uWSGI build includes the Python version your web2py release requires.
Rank #2
2. Create the database and least-privilege account
Create a database owned by an application-specific role rather than using a superuser. The web2py manual uses port 5432 as PostgreSQL’s conventional port and illustrates a DAL connection like this:
db = DAL("postgres://myuser:mypassword@localhost:5432/mydb")In production, do not commit a real password in source code. Supply credentials through a protected environment mechanism or a secret store, restrict the role’s privileges to the required database, and use TLS when the database is reached over a network. If PostgreSQL is on another host, replace localhost with an internal name or address and enforce a database firewall policy that admits only the application tier.
3. Configure PostgreSQL maintenance
Enable PostgreSQL’s autovacuum. It reclaims obsolete row versions and helps tables and indexes remain usable as data changes. Set retention and backup policies separately; autovacuum is not a backup.
4. Run web2py through uWSGI
Configure uWSGI to load the web2py WSGI application and listen on a Unix socket. A Unix socket keeps the application protocol off the public network and lets Nginx hand requests to a local endpoint. Set process counts, timeouts, user permissions and log destinations according to your workload and operating-system service manager. Ensure the socket directory is writable by uWSGI and readable by the Nginx worker user; a permission mismatch produces immediate gateway errors.
Recommended Free Tools
5. Add the Nginx server block
The English web2py Nginx example creates /etc/nginx/sites-available/web2py. Its pattern is:
- Define a server block for the public hostname.
- Serve web2py application static files directly from Nginx.
- Include
uwsgi_paramsfor dynamic requests. - Pass dynamic traffic to
unix:///tmp/web2py.socket(or the socket path you configured in uWSGI).
Keep static-file locations ahead of the dynamic catch-all so assets do not consume Python workers. Test the configuration with your distribution’s Nginx validation command before reloading. If Nginx reports a missing socket, check that uWSGI started successfully and that both services agree on the exact path.
6. Terminate HTTPS at Nginx
Add the TLS server block shown by the manual’s pattern, supplying the certificate and private-key paths issued for your hostname. Redirect clear-text HTTP to HTTPS, restrict access to administrative endpoints, and never expose web2py’s admin or appadmin interfaces without HTTPS. Keep the private key readable only by the account that needs it and renew certificates before expiry.
7. Separate service lifecycles
Run Nginx, uWSGI and PostgreSQL as independently supervised services. This lets you restart the application without restarting the database, inspect each log stream, and roll back one component when an upgrade fails. The manual advises placing the web server and database on different machines when practical, connected by a secure internal network or SSL tunnel.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Option 2: Dockerizing the stack
Docker is a packaging and process-isolation choice, not a deployment architecture by itself. A sensible container design keeps the concerns visible:
- Nginx container: public ports, TLS certificates, static files and reverse-proxy configuration.
- web2py/uWSGI container: the pinned Python runtime, application code and uWSGI configuration.
- PostgreSQL service: a managed database or a dedicated database container with durable storage and a tested backup process.
A Docker Hub listing demonstrates a minimal image that combines Nginx and web2py for production, but the available material does not establish a maintained tag, security policy, Compose file, PostgreSQL compatibility matrix or health checks. Treat such an image as an example to inspect, not as an automatic production dependency. Prefer a reproducible Dockerfile that pins a base image digest, installs only required packages, runs as a non-root user where feasible, and records the source commit.
What Docker improves
- Repeatability: the same image can be tested and promoted through environments.
- Isolation: application dependencies are separated from host packages.
- Rollback: a previously built image can be redeployed if the new release fails.
- Team consistency: Compose or an orchestrator can describe networks, environment variables and service dependencies.
What Docker does not remove
- PostgreSQL data must live on a durable volume or external service, never only in a disposable container layer.
- Backups still need scheduling, retention, encryption and restore drills.
- Secrets still need controlled injection and rotation; putting passwords in an image or committed Compose file is unsafe.
- Health checks, startup ordering, resource limits, log retention and alerting still need explicit configuration.
- Nginx, uWSGI, Python and PostgreSQL upgrades still require compatibility testing.
If you cannot answer where the database volume resides, how it is restored to a clean environment, and how a failed image is rolled back, the container design is not production-ready.
Docker versus host installation
| Decision area | Conventional host | Docker-based deployment |
|---|---|---|
| Repeatability | Achieved through package and configuration management; drift must be controlled. | Image builds capture dependencies; image tags or digests must be pinned. |
| Database state | Managed disk or dedicated database host is straightforward. | Requires an explicitly durable volume or external PostgreSQL service. |
| Operations | Uses the operating system’s service manager, logs and monitoring. | Requires container health checks, orchestration, log collection and resource limits. |
| Security boundary | Host firewall and filesystem permissions are familiar but must be maintained. | Networks and secrets are declarative, but a misconfigured published port can expose services. |
| Upgrades and rollback | Package upgrades can affect shared host libraries. | Image replacement is clean, provided database migrations and rollback plans are compatible. |
| Best fit | Teams wanting the official recipe and simple service topology. | Teams already operating CI image builds, Compose or an orchestrator. |
Neither column is inherently safer. The safer choice is the one your team can patch, observe, back up and restore reliably.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsNetwork and security controls
- Public edge: expose only Nginx’s HTTPS listener. Keep uWSGI sockets and PostgreSQL off public interfaces.
- Administrative access: put web2py administrative endpoints behind HTTPS and an additional network or identity control where possible.
- Database authentication: use a dedicated role, a strong secret and encrypted transport for remote connections. Do not copy illustrative
trustauthentication settings into an internet-facing deployment without reviewing them. - Least privilege: grant the application only the database permissions it needs; reserve schema changes and superuser operations for controlled deployment jobs.
- Secrets: keep TLS keys, database passwords and signing material outside source control and container layers.
- Updates: track security updates for the operating system, Python runtime, Nginx, uWSGI and PostgreSQL, while checking web2py compatibility.
Backups, recovery and observability
Schedule PostgreSQL logical backups with pg_dump and practice restores with pg_restore. A successful backup job is not proof of recoverability: periodically restore to an isolated PostgreSQL instance, verify schema and representative application data, and record the elapsed recovery time.
Monitor the boundaries where failures appear:
- Nginx HTTP status rates, TLS expiry and request latency.
- uWSGI worker health, queue depth, timeouts and restart counts.
- PostgreSQL connection exhaustion, disk growth, replication or managed-service alerts, and autovacuum activity.
- Filesystem or volume capacity for uploads, logs and database data.
Define log retention before traffic arrives. In containers, send logs to the platform’s collector rather than allowing an unbounded JSON log file to fill the host.
Troubleshooting by symptom
502 Bad Gateway from Nginx
Confirm that uWSGI is running, the socket path exactly matches the Nginx uwsgi_pass value, and filesystem permissions allow Nginx to connect. Then inspect the uWSGI log for import errors or a Python-version mismatch.
Static files return 404 while dynamic pages work
Check the Nginx static alias or root path, file ownership and the URL prefix used by the web2py application. Test a known asset directly; do not route every asset through Python as a first workaround.
web2py cannot connect to PostgreSQL
Verify hostname, port 5432 (unless intentionally changed), database name, role credentials and PostgreSQL’s network access rules. From the application environment, test DNS and TCP reachability, then inspect PostgreSQL authentication logs. For a remote database, confirm that TLS requirements and certificate trust settings agree on both sides.
Container starts, then exits
Read the container’s first error rather than repeatedly restarting it. Common causes are a missing secret, an invalid uWSGI module path, a migration failure or a dependency built for a different Python version. Add a health check that tests the actual application path and database readiness, not merely that a process exists.
A practical decision rule
Choose the host installation when you want the shortest path from the web2py manual, have administrators comfortable with system packages, and can manage configuration and backups centrally. Choose Docker when your existing delivery pipeline already produces pinned images, your operators understand persistent volumes and health checks, and you need repeatable promotion or rollback across environments.
For either choice, start with a small staging deployment that mirrors production networking. Exercise HTTPS, static files, admin restrictions, database migrations, backup restoration and a failed application restart before accepting public traffic. Keep the architecture boring: Nginx at the edge, uWSGI for the WSGI handoff, private PostgreSQL, explicit secrets and documented recovery steps.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
