The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Pointing api.example.com at a Node.js app requires two separate configurations: DNS sends the hostname to your VPS, and a reverse proxy such as NGINX forwards web requests from ports 80 and 443 to the Node.js process on its private port, commonly 127.0.0.1:3000. DNS alone cannot specify a port, so both layers must be configured and tested.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The two layers behind a working subdomain
A browser first resolves the subdomain through DNS. An A record returns an IPv4 address, an AAAA record returns an IPv6 address, and a CNAME returns another hostname. The browser then connects to the standard web ports: 80 for HTTP or 443 for HTTPS.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
DNS does not carry a value such as :3000. Your Node.js server can listen on port 3000 internally, but public requests still need a web server listening on 80 and 443. NGINX matches the requested hostname with server_name, terminates TLS when HTTPS is used, and proxies the request to the local Node.js port.
This arrangement keeps the application port off the public internet, gives you one place to manage certificates and redirects, and lets you add other applications or upstream servers later.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
What you need before changing DNS
- A registered domain and permission to edit its authoritative DNS zone.
- A VPS with a stable public IPv4 address. Add a public IPv6 address only when IPv6 is configured and reachable on the server.
- A Node.js application that starts successfully and a known listening port, such as
3000. - Administrative access to the VPS, including permission to install and configure NGINX.
- Firewall rules that allow TCP ports 80 and 443. The application port should normally remain restricted to localhost.
- An ACME-compatible certificate client if you want HTTPS from a publicly trusted certificate authority.
Use the exact hostname you intend to publish throughout the setup. In the examples below, the subdomain is api.example.com, the application listens on 127.0.0.1:3000, and the VPS IPv4 address is represented as 203.0.113.10. Replace every example value with your own.
Choose the correct DNS record
| Record | Use it when | Value | Important behavior |
|---|---|---|---|
| A | The VPS has a public IPv4 address | The VPS IPv4 address | Maps the subdomain directly to IPv4 |
| AAAA | The VPS has working public IPv6 | The VPS IPv6 address | Clients may prefer IPv6; a broken IPv6 path can make an otherwise healthy site appear down |
| CNAME | Your provider gives a stable hostname instead of an address, or you want an alias to another hostname | The provider hostname, ending with a dot where the DNS interface requires it | It aliases a hostname; it is not an IP address and normally cannot be used at a zone apex |
For a typical VPS, create an A record named api with the VPS IPv4 address. If the server has correctly configured IPv6, add an AAAA record for the same name. If your VPS provider supplies a stable hostname as the target, use a CNAME instead of guessing an address.
Free tools Windows power users keep installed
One-click scans. No signup required.
Create the record in your DNS dashboard
- Open the DNS management page for
example.com. - Add an A record with the name or host field set to
apiand the value set to the VPS IPv4 address. - Add an AAAA record only if the VPS firewall, operating system, and provider networking all accept IPv6 traffic on ports 80 and 443.
- If using a CNAME, set the name to
apiand the target to the provider hostname. Do not puthttp://, a path, or a port in the target. - Save the records and note any proxy setting offered by the DNS provider. A DNS-only mode returns the VPS address directly; a proxied mode puts the provider in front of the VPS and changes which address clients see.
DNS changes are not instantaneous. Resolver caches honor the record’s TTL, and an existing cached answer can remain visible until that TTL expires. Check the authoritative answer rather than relying only on the result from one local resolver.
Verify DNS before touching NGINX
From a machine with DNS utilities installed, query both record families:
dig +short A api.example.com
dig +short AAAA api.example.comThe A query should return the VPS IPv4 address. The AAAA query should return the intended IPv6 address or no result if you did not create an AAAA record. A stale address, an unexpected CNAME target, or an NXDOMAIN response must be fixed at the DNS layer before you debug the application.
Make Node.js listen on a private interface
Configure the application to bind to the local interface and the port NGINX will use as its upstream. A common setting is:
Recommended Free Tools
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
HOST=127.0.0.1
PORT=3000The exact environment-variable names depend on the framework. Some applications use 0.0.0.0 by default; that makes the process reachable on every interface and is unnecessary when NGINX is on the same VPS. Binding to 127.0.0.1 prevents direct external connections to the application port while still allowing NGINX to connect locally.
Start the app using the command you use in production, then confirm the listening socket:
ss -ltnp | grep 3000
curl -i http://127.0.0.1:3000/The first command should show a Node.js process bound to the expected address and port. The second should return your application response. If it fails, do not continue to NGINX: correct the application start command, environment, migration state, or port conflict first.
Keep the process running
Use the process supervisor already supported by your VPS deployment, such as a system service or a Node.js process manager. Configure it to restart the app after a crash and start it after a reboot. Supervisor commands vary by distribution and deployment method, so do not copy a command intended for a different supervisor. The key operational checks are that the process is running, it restarts successfully, and it still listens on the same local port after a reboot.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInstall and configure NGINX
Install NGINX through your operating system’s package manager, then create a virtual host for the subdomain. On distributions that separate available and enabled configurations, place the file in the available directory and create the corresponding enabled link. Other distributions use a single configuration directory. The location is distribution-specific; inspect the existing NGINX layout rather than assuming a path.
Start with an HTTP reverse-proxy server block
This minimal server block accepts requests for the subdomain and forwards them to the local Node.js service:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
server {
listen 80;
server_name api.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}server_name is decisive: NGINX chooses among virtual hosts using the hostname supplied by the client. proxy_pass identifies the backend address. The forwarded headers preserve the original host, client address chain, and HTTP/HTTPS scheme so frameworks can build correct absolute URLs, log the real client, and enforce secure cookies.
Do not put a trailing path on proxy_pass unless you intentionally want NGINX to rewrite the URI. The form shown above passes the incoming request path to Node.js unchanged.
Test and enable the configuration safely
- Save the server block in the configuration location used by your distribution.
- Enable it using that distribution’s normal mechanism. On systems with separate directories, this commonly means linking the file into the enabled directory.
- Disable or remove an unwanted default site if it could match requests before your new block. Keep it temporarily if you need it for diagnostics, but ensure the requested hostname has an exact matching block.
- Run the NGINX syntax test:
nginx -t- Reload NGINX only when the test reports that the configuration is valid:
systemctl reload nginxA reload applies the new configuration without dropping existing connections. If the syntax test fails, read the file and line number in the error, fix that issue, and test again. Never use a reload as a substitute for a successful configuration test.
Confirm hostname matching before involving public DNS
Once NGINX is reloaded, send a request to the VPS address with the intended Host header:
curl -i -H 'Host: api.example.com' http://203.0.113.10/This bypasses DNS and verifies that NGINX selects the correct server block and reaches Node.js. If the response is the NGINX welcome page, the request reached NGINX but did not match the intended server_name block, or the block is disabled or shadowed by another configuration.
Obtain a TLS certificate
Use an ACME client after the hostname resolves publicly and port 80 or the required DNS API is available. The certificate paths printed by the client depend on the operating system and client; copy those reported paths into NGINX instead of assuming a fixed directory.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
HTTP-01 validation
With HTTP-01, the certificate authority requests a token at a URL under http://api.example.com/.well-known/acme-challenge/. The ACME client must make the token available to the public web server. Port 80 must be reachable, and an access rule, application redirect, or authentication layer must not block the challenge request.
This method is convenient when the VPS serves the hostname directly. During issuance, verify that the challenge path can be fetched from outside the VPS and that NGINX is serving the challenge location selected by the ACME client.
DNS-01 validation
With DNS-01, the client proves control by publishing a TXT record below _acme-challenge.api.example.com. It can issue wildcard certificates, but the DNS API credentials must be protected carefully and the TXT record must propagate. Let’s Encrypt notes that DNS propagation can take as much as an hour depending on the provider.
| Validation method | Best fit | Required access | Common failure |
|---|---|---|---|
| HTTP-01 | A directly reachable web server on port 80 | Public HTTP access and challenge-file serving | Port 80, redirects, or access rules prevent retrieval |
| DNS-01 | Wildcard certificates or environments where HTTP cannot reach the server | Ability to create the required TXT record | Incorrect TXT value or incomplete DNS propagation |
Serve HTTPS and redirect HTTP
After the ACME client successfully installs the certificate, use two server blocks: one on port 80 that redirects, and one on port 443 that terminates TLS and proxies to Node.js.
server {
listen 80;
server_name api.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name api.example.com;
ssl_certificate /path/printed-by-your-acme-client/fullchain.pem;
ssl_certificate_key /path/printed-by-your-acme-client/privkey.pem;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Replace both certificate paths with the paths supplied by your ACME client. Test and reload again:
nginx -t
systemctl reload nginxThen test both stages:
curl -I http://api.example.com/
curl -Iv https://api.example.com/The HTTP request should return a permanent redirect to the HTTPS hostname. The HTTPS request should complete certificate verification and return the Node.js application’s response. A certificate for example.com does not automatically cover api.example.com; the subdomain must be included in the certificate’s names.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Proxy WebSockets when the application uses them
Ordinary HTTP proxying does not automatically carry a WebSocket upgrade. Add the upgrade headers in the location that handles the WebSocket endpoint:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →location /socket/ {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}Use the actual WebSocket path used by your application. If both ordinary requests and WebSockets share one location, include the upgrade directives there, then test a real client connection rather than relying on an HTTP status code.
Optional: distribute traffic across multiple Node.js processes
When more than one backend instance is listening, define an upstream group and reference it from proxy_pass:
upstream node_app {
server 127.0.0.1:3000;
server 127.0.0.1:3001;
}
server {
listen 443 ssl;
server_name api.example.com;
ssl_certificate /path/printed-by-your-acme-client/fullchain.pem;
ssl_certificate_key /path/printed-by-your-acme-client/privkey.pem;
location / {
proxy_pass http://node_app;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Each listed process must be healthy and serve the same application behavior. Shared sessions, uploads, background jobs, and WebSocket state require an application design that supports multiple instances; adding an upstream entry does not solve those concerns automatically.
End-to-end verification checklist
- DNS: authoritative A, AAAA, or CNAME answers point to the intended VPS or target hostname.
- Application: the Node.js process is running and responds on
127.0.0.1:3000(or your chosen port). - Firewall: TCP 80 and 443 are permitted; the internal application port is not unnecessarily exposed.
- NGINX syntax:
nginx -tsucceeds before every reload. - Host routing: a request with the
api.example.comHost header returns the application, not the default NGINX page. - Redirect: HTTP returns a 301 to the HTTPS URL after certificate installation.
- Certificate: the HTTPS certificate contains the subdomain and is accepted by a normal client.
- Challenge: HTTP-01 can retrieve its token, or the DNS-01 TXT record is visible at the authoritative servers.
- WebSockets: a real upgrade request remains connected when the application needs WebSocket traffic.
Troubleshoot by layer
| Symptom | Likely layer | What to check |
|---|---|---|
| NXDOMAIN | DNS | Create the missing A, AAAA, or CNAME record and wait for authoritative publication and resolver caches to update. |
| Old IP address | DNS caching or an old record | Query authoritative DNS, remove conflicting records, and account for the record TTL. |
| Default NGINX page | Virtual-host selection | Confirm the exact server_name, enable the file, remove a conflicting default block, reload after nginx -t, and test with an explicit Host header. |
| 502 Bad Gateway | NGINX-to-Node connection | Check that Node.js is running, the port and bind address exactly match proxy_pass, and local firewall rules permit the connection. |
| Connection refused on the local curl test | Node.js process | Inspect the process supervisor, application logs, environment variables, and port conflicts. |
| HTTPS certificate challenge fails | ACME validation | For HTTP-01, make the challenge URL publicly reachable on port 80. For DNS-01, verify the exact TXT value and wait for propagation. |
| HTTPS works but the app generates HTTP links | Forwarded scheme handling | Keep proxy_set_header X-Forwarded-Proto $scheme; and configure the Node.js framework to trust the reverse proxy where required. |
| WebSocket disconnects immediately | Upgrade proxying | Use HTTP/1.1 and the Upgrade and Connection headers in the WebSocket location. |
| Only IPv6 clients fail | AAAA record or IPv6 networking | Remove an incorrect AAAA record or fix the VPS route, firewall, NGINX listener, and application path for IPv6. |
Operational choices that prevent recurring outages
DNS-only versus proxied DNS
DNS-only delivery lets clients resolve directly to the VPS and makes troubleshooting straightforward. A DNS provider’s proxy can add an intermediary, but it changes the source addresses seen by the VPS and may impose supported ports, caching, or WebSocket requirements. Choose one mode deliberately and verify that its TLS mode and origin settings match your NGINX configuration.
One backend versus several
A single local process is the simplest arrangement and is usually the right starting point. Multiple upstreams can improve process-level availability, but they require consistent application state and more involved health, logging, and deployment procedures.
Keep certificates renewable
ACME certificates are short-lived by design. Leave the certificate client’s renewal automation enabled, ensure it can still complete HTTP-01 or DNS-01 validation, and reload NGINX after a successful renewal. Test renewal in the client’s supported dry-run mode and monitor for failures rather than waiting for an expired certificate to reveal the problem.
Quick Recap
Why the common shortcuts fail
- Putting
:3000in DNS: DNS records contain names and addresses, not transport ports. Use NGINX or another reverse proxy to translate public web traffic to the internal port. - Opening port 3000 publicly instead of configuring a proxy: This bypasses hostname routing, standard HTTPS handling, and the forwarded headers many frameworks need.
- Changing DNS but leaving the default virtual host enabled: DNS can be correct while NGINX still serves its default page because no matching
server_nameis active. - Reloading after an untested edit: A syntax error can prevent the new configuration from loading. Run
nginx -tfirst. - Requesting a certificate before public DNS works: The certificate authority cannot validate a hostname that still resolves to the wrong address or has not propagated.
- Adding an AAAA record without working IPv6: Some clients will select IPv6 and fail before trying IPv4.
Complete deployment sequence
- Choose the subdomain and confirm the VPS’s public IPv4 address, and its IPv6 address if applicable.
- Create the A, AAAA, or CNAME record for the subdomain.
- Verify the authoritative DNS answer and wait for caches to update.
- Configure Node.js to listen on a local port and confirm it responds locally.
- Install NGINX and create a server block with the exact
server_name. - Proxy requests to the local Node.js port, preserving the Host and forwarded headers.
- Enable the configuration, run
nginx -t, and reload NGINX. - Test with the hostname or an explicit Host header and resolve any default-page or 502 error before adding TLS.
- Use HTTP-01 or DNS-01 to issue the certificate after DNS is publicly correct.
- Configure the port-443 server block with the certificate paths reported by the ACME client.
- Redirect port 80 to HTTPS, test both protocols, and add WebSocket headers if the application needs upgrades.
- Verify renewal, reboot persistence, logs, and firewall behavior before treating the deployment as finished.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
