Free tools Windows power users keep installed
One-click scans. No signup required.
Deploy a Falcon application on Ubuntu by running its WSGI callable with Gunicorn under systemd, exposing Gunicorn through a protected Unix socket, and letting Nginx handle the public HTTP connection, static files, and TLS. This guide covers the complete path from a fresh server to a maintainable, non-root deployment.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the finished deployment looks like
The browser connects to Nginx on the server’s public interface. Nginx serves static assets directly and forwards dynamic requests through /run/gunicorn.sock. Gunicorn receives those requests and imports the Falcon callable from your project’s wsgi.py. systemd starts the socket and supervises the Gunicorn service.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Layer | Responsibility | Recommended exposure |
|---|---|---|
| Falcon | Routes, resources, middleware, and application behavior | Only through Gunicorn |
| Gunicorn | WSGI server and worker processes | Unix socket in /run |
| systemd | Startup, restart, readiness, and logging integration | Local service manager |
| Nginx | Public HTTP/TLS endpoint, proxying, and optional static files | Ports 80 and 443 |
Falcon 4.4.0 supports CPython 3.9 and newer and installs with pip install falcon. Falcon conforms to WSGI, so a WSGI server such as Gunicorn can load it. The configuration below is a strong starting point, not a complete hardened production environment; adapt it to your application, traffic, and operational requirements.
Prerequisites and naming used in this guide
- An Ubuntu server with administrative access through
sudo. - A DNS name pointed at the server if the application will be public.
- Python 3.9 or newer, plus the Ubuntu package that supplies virtual-environment support.
- A project directory at
/srv/myprojectand a virtual environment at/srv/myproject/venv. - The examples use
falconrunas the runtime account,webas a shared socket group, andwww-dataas Ubuntu’s usual Nginx account. Substitute your own names consistently.
Keep the account that deploys source code separate from the account that executes the service. The runtime account should be able to read the application but not write its source, templates, or installed code. If an upload or restart path is compromised, denying source write access limits the attacker’s ability to alter what will run next.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
1. Create users and lay out the project
Create a deployment account if you do not already have one, a dedicated service account, and a group used only for the Gunicorn socket. Do not give the service account an interactive shell unless you have a specific operational reason.
sudo adduser --disabled-password --gecos "" deployer
sudo addgroup --system web
sudo adduser --system --ingroup web --home /srv/myproject --shell /usr/sbin/nologin falconrun
sudo usermod -aG web www-data
sudo mkdir -p /srv/myproject
sudo chown -R deployer:deployer /srv/myproject
sudo chmod 0755 /srv/myprojectUpload or check out the project as deployer, not as falconrun. The runtime account needs read and directory-traverse permission. After deployment, verify that no source directory is group- or world-writable:
sudo find /srv/myproject -type d -exec chmod 0755 {} ;
sudo find /srv/myproject -type f -exec chmod 0644 {} ;Use more restrictive modes for secrets and private configuration. Do not place credentials in a file that Nginx can serve as a static asset.
2. Install Python dependencies in a virtual environment
Install the Ubuntu packages needed to create the environment, then install the application’s pinned dependencies. Installing into a virtual environment makes the Gunicorn executable and Python modules unambiguous when systemd starts the service.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo apt update
sudo apt install python3 python3-venv python3-pip nginx
sudo -u deployer python3 -m venv /srv/myproject/venv
sudo -u deployer /srv/myproject/venv/bin/python -m pip install --upgrade pip
sudo -u deployer /srv/myproject/venv/bin/pip install falcon gunicorn
sudo -u deployer /srv/myproject/venv/bin/pip install -r /srv/myproject/requirements.txtIf requirements.txt already lists Falcon or Gunicorn, install it once rather than maintaining conflicting versions manually. Confirm the versions from the environment that systemd will use:
/srv/myproject/venv/bin/python --version
/srv/myproject/venv/bin/gunicorn --version
/srv/myproject/venv/bin/python -c "import falcon; print(falcon.__version__)"3. Expose an importable Falcon WSGI callable
Gunicorn’s target has the form module:callable. With a file named wsgi.py and a variable named application, the target is wsgi:application. The callable must be importable from the project’s working directory or Python path.
import falcon
class HealthResource:
def on_get(self, req, resp):
resp.media = {"status": "ok"}
application = falcon.App()
application.add_route("/health", HealthResource())Your real application will normally register resources, middleware, error handlers, and configuration in this module or in modules it imports. Keep import-time work predictable: a missing environment variable, database connection failure, or syntax error will prevent every worker from starting.
Set ownership after creating the file and test the import directly:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo chown deployer:deployer /srv/myproject/wsgi.py
cd /srv/myproject
/srv/myproject/venv/bin/python -c "import wsgi; print(wsgi.application)"4. Smoke-test Gunicorn before adding Nginx
Run Gunicorn manually with the virtual-environment executable. Binding to 127.0.0.1:8000 keeps the test server on loopback rather than exposing it to the internet.
cd /srv/myproject
/srv/myproject/venv/bin/gunicorn --bind 127.0.0.1:8000 wsgi:applicationFrom a second shell on the server, request the health endpoint:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →curl --fail http://127.0.0.1:8000/healthStop the foreground process with Ctrl+C after the response succeeds. If Gunicorn reports ModuleNotFoundError, check the current directory, the module filename, and the callable name. If Falcon raises an exception while importing, fix that application error before introducing systemd or Nginx.
5. Create the systemd service and socket
Use a socket unit so the Unix socket is created with predictable ownership and permissions. The service uses Type=notify, which allows Gunicorn to report readiness to systemd instead of being treated as ready merely because its process exists.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Gunicorn service unit
Create /etc/systemd/system/gunicorn.service:
[Unit]
Description=Gunicorn daemon for Falcon application
Requires=gunicorn.socket
After=network.target
[Service]
Type=notify
User=falconrun
Group=web
WorkingDirectory=/srv/myproject
ExecStart=/srv/myproject/venv/bin/gunicorn --workers 3 --bind unix:/run/gunicorn.sock --access-logfile - wsgi:application
ExecReload=/bin/kill -s HUP $MAINPID
Restart=on-failure
PrivateTmp=true
[Install]
WantedBy=multi-user.targetThe worker count shown here is an example configuration value, not a universal performance recommendation. Worker needs depend on request time, memory, blocking operations, and concurrency. Measure your workload and watch latency, memory, and error rates before changing it. Add application-specific Gunicorn options, such as timeouts, only when you understand their effect.
Gunicorn socket unit
Create /etc/systemd/system/gunicorn.socket:
[Unit]
Description=Gunicorn socket for Falcon application
[Socket]
ListenStream=/run/gunicorn.sock
SocketUser=www-data
SocketGroup=web
SocketMode=0660
[Install]
WantedBy=sockets.targetThe socket mode allows Nginx, through www-data and the web group, to connect while keeping other users out. Ensure the service account and Nginx account retain the required group membership after any account changes.
Load, enable, and inspect the units
sudo systemctl daemon-reload
sudo systemctl enable --now gunicorn.socket
sudo systemctl enable gunicorn.service
sudo systemctl start gunicorn.service
sudo systemctl status gunicorn.socket gunicorn.service
sudo journalctl -u gunicorn.service -e
sudo ls -l /run/gunicorn.sockStart the socket before the service so systemd creates the path. Do not proceed to public traffic until the service is active, the socket exists, and the journal shows that workers started without import or permission errors.
6. Configure Nginx as the reverse proxy
Create a site configuration such as /etc/nginx/sites-available/myproject. Replace the example hostname with the domain you control. The static-file block is optional; remove it if your application has no static directory.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location /static/ {
alias /srv/myproject/static/;
try_files $uri =404;
}
location / {
proxy_pass http://unix:/run/gunicorn.sock;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Give Nginx read and traverse permission on the static directory, but do not make the entire project tree publicly readable through an overly broad document root. Enable the site and validate the syntax:
sudo ln -s /etc/nginx/sites-available/myproject /etc/nginx/sites-enabled/myproject
sudo nginx -t
sudo systemctl enable --now nginx
curl --fail -H 'Host: example.com' http://127.0.0.1/healthThe final request tests the Nginx-to-Gunicorn path locally. Test the public DNS name separately once DNS has propagated. Inspect both logs when a request fails:
sudo journalctl -u nginx -e
sudo journalctl -u gunicorn.service -e7. Add HTTPS and production controls
Do not treat the basic proxy configuration as a finished security design. Before handling real users or credentials:
- Obtain a certificate from a trusted certificate authority and configure Nginx on port 443. Redirect plain HTTP to HTTPS after validating the secure virtual host.
- Allow only required ports in the firewall, normally SSH plus HTTP and HTTPS. Never expose Gunicorn’s loopback test port or Unix socket as a public endpoint.
- Store secrets outside source control, restrict secret-file permissions, and inject only the values the service needs.
- Configure log retention and rotation for Nginx, Gunicorn, and application logs. Monitor restart loops, response errors, latency, disk use, and memory exhaustion.
- Back up application data and configuration, and document how to restore a known-good release.
- Use a release directory or another reversible deployment method so a failed update can be rolled back without editing files while the service is running.
- Review request limits, proxy timeouts, trusted proxy headers, and Falcon middleware for your threat model. Defaults suitable for a test server are not automatically suitable for an internet-facing service.
Updating the application without losing control
Deploy a new release as the deployment account, install its dependencies into the intended virtual environment, and run the import and health checks before switching traffic. A simple restart sequence is:
sudo systemctl restart gunicorn.service
sudo systemctl status gunicorn.service
curl --fail -H 'Host: example.com' http://127.0.0.1/healthFor a larger application, keep each release in its own directory and point a stable path such as /srv/myproject/current at the selected release. Update the symlink atomically, restart Gunicorn, and revert the symlink if health checks or logs show a regression. Keep the previous virtual environment available until the new release is proven.
Common failures and exact checks
| Symptom | Likely cause | Checks and fix |
|---|---|---|
| Nginx returns 502 Bad Gateway | Gunicorn is stopped, the socket is absent, or Nginx cannot access it | Run systemctl status gunicorn.service gunicorn.socket, inspect journalctl -u gunicorn.service, then check ls -l /run/gunicorn.sock and group membership. |
| Gunicorn exits immediately | Import error, missing dependency, invalid environment, or incorrect callable | Run the same absolute ExecStart command from /srv/myproject as falconrun; correct wsgi:application, install the missing dependency, or fix the application exception. |
| Permission denied reading source | The runtime account cannot traverse a parent directory or read a file | Use namei -l /srv/myproject/wsgi.py and adjust directory execute and file read permissions without granting source write access. |
| Permission denied on the socket | Nginx is not in the socket group or the socket mode is too restrictive | Check stat /run/gunicorn.sock, verify www-data belongs to web, then restart Nginx so it receives the updated group membership. |
| Static files return 404 or 403 | The alias path is wrong or Nginx cannot traverse the directory |
Confirm the file exists beneath the exact alias path, run nginx -t, and inspect Nginx’s error log. |
| systemd reports a readiness or timeout problem | The service type, executable, or startup behavior does not match the unit | Confirm the absolute virtual-environment Gunicorn path, retain Type=notify for a Gunicorn build that supports it, and read the complete service journal before changing timeouts. |
Choosing between deployment variants
| Decision | Option A | Option B | When it matters |
|---|---|---|---|
| Python interface | WSGI with Falcon and Gunicorn | ASGI with an ASGI server | Use the interface your framework and middleware actually expose; this guide is for Falcon’s WSGI callable. |
| Gunicorn endpoint | Loopback TCP such as 127.0.0.1:8000 |
Unix socket | Loopback is useful for smoke tests; a socket keeps the production hop local without opening another listening port. |
| Process supervision | Manual shell process | systemd service and socket | Manual execution is useful for diagnosis; systemd supplies startup ordering, restarts, readiness, and logs. |
| Edge responsibilities | Application server handles more of the edge | Nginx handles TLS, static files, and proxying | Nginx is usually the clearer boundary for a single Ubuntu host. |
| Scale | One host | Architecture prepared for horizontal scaling | Start simply, but keep configuration, secrets, health checks, and release procedures portable if availability requirements grow. |
There is no authoritative universal throughput or worker-count figure for this exact Falcon, Gunicorn, Nginx, and Ubuntu combination. Benchmark with representative requests, data, concurrency, and failure conditions instead of copying a number from another application.
Quick Recap
Deployment checklist
- Falcon’s callable imports successfully from the project directory.
- All dependencies are installed in the virtual environment referenced by
ExecStart. - The service runs as a dedicated non-root account that cannot write application source.
gunicorn.socketis enabled and creates/run/gunicorn.sockwith Nginx-readable permissions.- Gunicorn is active and its journal contains no import or worker-start errors.
nginx -tsucceeds before every Nginx reload.- Nginx can reach the health endpoint through the Unix socket.
- HTTPS, firewall rules, secret handling, log rotation, monitoring, backups, and rollback are documented before production launch.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
