The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Host each website in its own LXD container, run Nginx inside every website container, and place a separate HAProxy container on the VPS edge. Point every domain’s DNS A record to the VPS. HAProxy listens publicly on ports 80 and 443, chooses a backend by the HTTP host name or TLS SNI, and forwards the request to the matching private container. This gives you one public IP, centralized TLS handling, and independent site environments without exposing every container directly to the internet.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Architecture: one public edge, one container per website
The reference layout uses one Ubuntu VPS with a public IPv4 address and three LXD containers: two website containers and one HAProxy reverse-proxy container. Add another website by creating another LXD instance and another HAProxy backend; the public IP and listening ports do not change.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Internet
|
| TCP 80 / 443
v
HAProxy LXD container
|-- site1 container: private-address:80
|-- site2 container: private-address:80
`-- additional site containers
Each website container:
- runs its own Nginx
- owns its files, logs and application processes
- is reachable from the private LXD bridge, not directly from the internetLXD supplies the isolation and lifecycle layer. Its current documentation describes it as a system-container and virtual-machine manager with a REST API and distribution images. A launch such as lxc launch ubuntu:24.04 first creates and starts a container by default. HAProxy supplies the public routing layer: its frontends bind client-facing addresses and ports, while ACLs select the backend for each hostname.
What you need before installation
- An Ubuntu VPS or server with a public IP address.
- A sudo-capable administrator account. Do not perform routine administration as root.
- One fully qualified domain name per website, with each DNS A record pointing to the VPS public IP.
- Storage for LXD images, container filesystems, access logs, application data, databases and backups. A historical tutorial used 20 GB or more of block storage as an example; it is not a universal capacity requirement.
- A firewall that permits inbound TCP 80 and 443 to the HAProxy container or the host-level forwarding path.
- A plan for certificates, updates, backups and monitoring.
Keep website service ports private on the LXD bridge. Only publish another port when a service genuinely needs direct access; the normal web path should expose 80 and 443 at HAProxy.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prepare DNS, the firewall and the host
Point every name at the VPS
Create an A record for each hostname, for example site1.example.com and site2.example.com. Include every name that appears in an Nginx server_name or HAProxy host ACL, including an optional www alias. DNS changes can be cached, so validate the result from the VPS and from an external network before diagnosing application configuration.
Open only the public edge
Allow inbound TCP 80 and 443. Permit SSH only from your administration network when possible. The LXD bridge should carry traffic between HAProxy and the website containers; it should not become an accidental second public interface. If you use IPv6, apply equivalent rules to the IPv6 listener and records rather than assuming an IPv4-only firewall protects it.
Install and initialize LXD
Install LXD using the package method supported by your Ubuntu release, then initialize a storage pool and managed bridge. The interactive initializer asks where container data is stored and whether to create a network bridge. Select a bridge that provides private addresses and DHCP; LXD managed bridges use dnsmasq for DHCP, IPv6 route announcements and DNS services.
sudo snap install lxd
sudo usermod -aG lxd "$USER"
# Start a new login session, then initialize LXD:
lxd initRecord the bridge name and address range selected during initialization. Do not put the public IP on every website instance. The edge container needs a path to the bridge and a public listening path; the website containers normally need only the bridge.
Create the HAProxy and website containers
Launch the instances
Use an Ubuntu image matching the release you intend to maintain. The following creates the three-instance example:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
lxc launch ubuntu:24.04 haproxy
lxc launch ubuntu:24.04 site1
lxc launch ubuntu:24.04 site2
lxc listlxc list shows each instance’s bridge address. Treat those addresses as implementation details that must remain stable. Reserve DHCP leases, use an LXD profile, or configure static addressing so a container restart does not silently invalidate HAProxy backends. Keep a version-controlled mapping such as site1.example.com → site1 → 10.0.0.11:80.
Install the software in each role
lxc exec haproxy -- bash
apt update
apt install haproxy
exit
lxc exec site1 -- bash
apt update
apt install nginx
mkdir -p /var/www/site1
exit
lxc exec site2 -- bash
apt update
apt install nginx
mkdir -p /var/www/site2
exitUse your distribution’s current security-update policy and restart or reload services only after validating configuration. Application runtimes, databases and queues can live in the same website container for a small deployment or in additional private containers when their lifecycle and resource needs differ.
Configure Nginx inside each website container
Create one server block per domain
Ubuntu’s Nginx layout uses /etc/nginx/sites-available/<your-domain> and a symlink into /etc/nginx/sites-enabled/. Every site must have a unique server_name; otherwise Nginx may serve the wrong default server.
cat > /etc/nginx/sites-available/site1.example.com <<'EOF'
server {
listen 80;
server_name site1.example.com www.site1.example.com;
root /var/www/site1;
index index.html;
access_log /var/log/nginx/site1.access.log;
error_log /var/log/nginx/site1.error.log;
location / {
try_files $uri $uri/ =404;
}
}
EOF
ln -s /etc/nginx/sites-available/site1.example.com
/etc/nginx/sites-enabled/site1.example.com
nginx -t
systemctl reload nginxRepeat the pattern in the site2 container with its own root directory, log files and names. Remove or disable an unused default site so an unmatched host header does not expose an unintended document root. Put only site-specific files in each container and set ownership and permissions for the account that runs the application.
Proxy to an application backend when needed
For a web application, keep Nginx as the container’s local HTTP entry point and proxy to the application process on a private loopback or container port:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}Nginx also supports FastCGI, uWSGI, SCGI and memcached upstream protocols. Choose the protocol your application actually exposes; do not publish the application port on the VPS merely to make Nginx reach it.
Configure HAProxy for host-based routing
Use separate HTTP and HTTPS frontends
Edit /etc/haproxy/haproxy.cfg in the HAProxy container. The example below redirects all HTTP requests to HTTPS and routes two domains after TLS termination.
global
log /dev/log local0
log /dev/log local1 notice
daemon
# Keep the maximum certificate and header settings appropriate for your build.
defaults
log global
mode http
option httplog
timeout connect 5s
timeout client 30s
timeout server 30s
frontend http_in
bind *:80
http-request redirect scheme https code 301
frontend https_in
bind *:443 ssl crt /etc/haproxy/certs/
acl host_site1 hdr(host) -i site1.example.com www.site1.example.com
acl host_site2 hdr(host) -i site2.example.com www.site2.example.com
use_backend site1_backend if host_site1
use_backend site2_backend if host_site2
http-request deny
backend site1_backend
server site1 10.0.0.11:80 check
backend site2_backend
server site2 10.0.0.12:80 checkReplace the private addresses with the values shown by lxc list. The hdr(host) ACL includes the port when a client sends one, so use the hostname form that matches your HAProxy version and test both bare and www names. A default deny prevents an unknown Host header from reaching a website.
Understand why one IP can serve many HTTPS domains
HAProxy’s TLS guide states that SNI allows multiple websites with different domain names to share the same IP address and port. During the TLS handshake, the client sends the requested server name. HAProxy selects a certificate whose common name or Subject Alternative Name matches that domain, then routes the decrypted HTTP request using the host header.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Store one PEM bundle per domain in the certificate directory. A bundle normally contains the private key followed by the certificate chain:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
install -d -m 700 /etc/haproxy/certs
cat fullchain.pem privkey.pem > /etc/haproxy/certs/site1.example.com.pem
chmod 600 /etc/haproxy/certs/site1.example.com.pem
cat fullchain.pem privkey.pem > /etc/haproxy/certs/site2.example.com.pem
chmod 600 /etc/haproxy/certs/site2.example.com.pemCertificate automation must renew these files and trigger a graceful HAProxy reload. Keep private keys readable only by the account and service that require them. Ubuntu’s Nginx guidance treats HTTPS on port 443 with certificate files as the production target; redirecting port 80 avoids serving an accidental plaintext session.
Choose how TLS is handled
Decide this before you automate certificates. The three valid models have different failure domains and operational costs.
| Model | Public listener | Backend connection | Certificate location | Best fit |
|---|---|---|---|---|
| Terminate at HAProxy | HAProxy binds 443 with ssl crt |
HTTP over the private LXD bridge | HAProxy certificate directory | Central renewals, one security policy and simple website containers |
| Re-encrypt to Nginx | HAProxy terminates client TLS | HTTPS from HAProxy to each Nginx backend | HAProxy and each backend, or a trusted internal CA | Encrypted traffic across a bridge you do not fully trust |
| Pass through TLS | HAProxy uses TCP mode on 443 | HTTPS terminates in each Nginx container | Each website container | Distributed certificate ownership or end-to-end TLS termination at Nginx |
Re-encrypt the private hop
For re-encryption, define the backend server with SSL and certificate verification. The CA file must contain the authority that issued the backend certificate:
backend site1_backend
server site1 10.0.0.11:443 ssl verify required
ca-file /etc/haproxy/ca/internal-ca.pem checkConfigure Nginx in the website container to listen on 443 with a certificate whose name matches the address HAProxy verifies. This model adds certificate and trust-store maintenance to every container.
Pass TLS through without decryption
Use mode tcp and inspect the ClientHello SNI to select a backend. Each Nginx container then owns its public certificate. This preserves end-to-end TLS but makes HTTP-layer redirects, headers and centralized policy unavailable at HAProxy. Test clients that omit SNI separately; there is no hostname to route on in that case.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Make LXD networking predictable
Keep backend addresses stable
HAProxy configuration contains concrete backend addresses, so an address change is an outage even if every container is healthy. Reserve a lease for each instance or apply a profile with static networking. After any network change, verify reachability from the HAProxy container:
lxc exec haproxy -- getent hosts site1
lxc exec haproxy -- curl -I http://10.0.0.11/If internal DNS names are not available, use the private addresses and document them. Do not depend on an address displayed once during initial setup.
Use proxy devices only for deliberate publication
When a non-web service must be exposed through the host, an LXD proxy device can forward a host address and port into an instance and supports different protocols. For the normal website path, this is unnecessary: HAProxy already provides the public listener. Extra proxy devices increase the number of places where an incorrect bind or firewall rule can expose a service.
Limit east-west access
Allow the HAProxy container to reach only the ports it needs on each website container. A site container should not automatically be able to connect to every other site’s database or administration interface. Separate databases, credentials and service accounts by site, and treat the private bridge as a network that still requires access control.
Validate the complete request path
- Check DNS: run
dig +short site1.example.comand confirm it returns the VPS address. Repeat for every hostname and wait for stale records to expire before changing unrelated services. - Check listeners: run
ss -ltnpon the host and inside the HAProxy container. The public path should terminate at HAProxy on 80 and 443; website Nginx listeners should be on their private container addresses. - Validate HAProxy syntax: run
haproxy -c -f /etc/haproxy/haproxy.cfg. Fix every reported certificate, ACL, bind or backend error before reloading. - Validate each Nginx configuration: run
nginx -tinside every website container, then usesystemctl reload nginx. A reload preserves existing connections while applying the new configuration. - Test the public response: run
curl -I https://site1.example.comand inspect the status, redirect and server headers. Test the second domain separately; a successful first site does not prove the ACL for another site works. - Inspect SNI and the certificate: run
openssl s_client -connect VPS_IP:443 -servername site1.example.com. Confirm that the certificate subject or SAN covers the requested name and that the chain is complete. - Reload HAProxy gracefully: reload only after the configuration check succeeds, then watch HAProxy and Nginx logs during a real request.
Troubleshoot by layer
| Symptom | Likely layer | Checks and corrective action |
|---|---|---|
| Domain does not resolve | DNS | Run dig +short; correct the A record or wait for cached data to expire. |
| Connection refused on 80 or 443 | Host firewall or listener | Use ss -ltnp on the host and HAProxy container; confirm firewall rules and HAProxy bind addresses. |
| Wrong website appears | Host matching | Check the request’s Host header, every server_name, HAProxy ACL spelling and the default-deny rule. |
| TLS warning or wrong certificate | SNI or certificate bundle | Run openssl s_client with the exact -servername; verify the PEM file, SAN, chain and the crt directory. |
| HAProxy reports a down server | Container reachability or Nginx | From HAProxy, connect to the backend private address and port; inside the website container run ss -ltnp and nginx -t. |
| 502 Bad Gateway | Local application or proxy settings | Read HAProxy and Nginx error logs together, then test the application upstream directly from its Nginx container. |
| Changes vanish after a restart | Unmanaged addressing or storage | Persist the LXD profile, network reservation and configuration files; verify that site data is on the container’s backed-up storage. |
Read HAProxy and Nginx access and error logs with matching timestamps. A missing HAProxy access entry points to DNS, firewall or listener problems; an HAProxy entry with no backend response points to container reachability; an Nginx entry with an application error points farther inside the site.
Recommended Free Tools
Security and operations that prevent avoidable outages
- Apply Ubuntu, LXD, HAProxy, Nginx and application security updates on a schedule. Test reloads after updates rather than assuming syntax compatibility.
- Use separate Unix users, credentials and document roots for each site. Never reuse a database password across containers.
- Protect HAProxy certificate keys and restrict access to configuration backups.
- Keep management interfaces, databases and application ports on the private bridge unless a documented requirement says otherwise.
- Set resource limits where one site could exhaust shared CPU, memory or storage. A container boundary reduces blast radius but does not create unlimited capacity.
- Back up LXD container data, HAProxy configuration, Nginx site files, certificate material and DNS records. Store at least one copy outside the VPS and test restoration rather than merely checking that archive files exist.
- Record the domain-to-container-to-port mapping in version-controlled configuration. Include the TLS model, certificate renewal procedure and the commands required for a rollback.
Capacity, isolation and the trade-off versus one host Nginx
There is no authoritative universal number of websites a VPS can host with this design. Capacity depends on traffic, request complexity, memory, CPU, storage performance, log volume and database use. Benchmark your own workloads and leave headroom for updates, backups and traffic spikes instead of assigning a fixed website count.
| Concern | Containerized HAProxy and LXD design | Single host-level Nginx |
|---|---|---|
| Isolation | Each site has its own filesystem, processes and lifecycle. | Sites share the host operating system and Nginx process environment. |
| Failure blast radius | A broken site container can be isolated; HAProxy remains a shared dependency. | A host or global Nginx error can affect every site. |
| TLS management | Certificates can be centralized at HAProxy or distributed by design. | Certificates and routing are centralized in one Nginx installation. |
| Operational complexity | Requires LXD networking, an extra proxy hop and multiple service configurations. | Fewer moving parts and a shorter request path. |
| Memory overhead | Each container and service consumes additional resources. | Usually lower overhead for small static sites. |
| Backups | Container data and edge configuration form clear backup boundaries. | Host files and one global configuration must be backed up together. |
| Moving one site | Moving a container and its mapping can be simpler than separating shared host state. | Site files, users and configuration may be more tightly coupled to the host. |
The containerized approach is most useful when sites need different packages, release schedules or recovery boundaries. A single Nginx installation is simpler when every site is small, trusted and maintained together. HAProxy does not remove the need to monitor the VPS: it becomes a critical shared edge, so keep a tested configuration and recovery path.
Adding a third site without changing the public IP
- Launch a new LXD instance from the maintained Ubuntu image.
- Install Nginx, create its document root and add a unique server block.
- Assign and record a stable private address.
- Create the domain’s DNS A record pointing to the VPS.
- Add a certificate PEM bundle to HAProxy if HAProxy terminates TLS.
- Add a hostname ACL and a backend server line to
haproxy.cfg. - Run
nginx -tin the new container andhaproxy -c -f /etc/haproxy/haproxy.cfgin the HAProxy container. - Reload Nginx and HAProxy, then test DNS, HTTP redirection, HTTPS, SNI and the site logs independently.
The public listener and VPS address stay the same; only the private container, certificate and routing records change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
