Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsProvision a Rails VPS with Ansible by treating the server as a reproducible set of roles, not as a sequence of ad-hoc SSH commands. A conventional single-host production layout is Nginx → Puma → Rails, with PostgreSQL alongside the application and systemd supervising Puma and any workers. Start from a supported Ubuntu LTS image (the documented example uses Ubuntu 22.04 Jammy), create a restricted deployment user, pin the operating-system and application versions, and keep secrets outside Git.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The safest workflow has two separate playbooks or playbook entry points: one for first-boot infrastructure and one for application releases. Provisioning installs users, packages, directories, databases, service units and baseline policy. A release fetches a known revision, installs its dependencies, compiles assets, runs a deliberately controlled migration, restarts or reloads services and verifies health. Separating those concerns makes a replacement VPS predictable and makes rollback decisions explicit.
As an Amazon Associate I earn from qualifying purchases.
What the provisioned Rails server should contain
Ansible describes playbooks as a repeatable, reusable configuration-management and multi-machine deployment system. For a Rails VPS, model that repeatability as a small set of focused roles rather than one giant task file.
| Layer | Responsibility | Typical account or process |
|---|---|---|
| Operating system | Updates, time settings, firewall, locale, build libraries, log retention and monitoring prerequisites | Root during provisioning |
| Ruby | Install the Ruby version required by the Gemfile, Bundler and JavaScript tooling | Deploy user or a version manager such as rbenv |
| Application | Release directories, repository checkout, gems, environment configuration and compiled assets | Unprivileged deploy user |
| Database | PostgreSQL server, database, role, authentication rules, backups and restore procedures | PostgreSQL service account |
| Application server | Puma workers, sockets or ports, environment and restart behavior | systemd unit running as the deploy user |
| Web edge | TLS termination, HTTP handling, static files and proxying to Puma | Nginx, normally bound to ports 80 and 443 |
The request path is Nginx to Puma to Rails. PostgreSQL is reached over a local socket or a private network, not an unrestricted public interface. A worker process, if the application uses one, gets its own systemd unit and resource policy instead of being hidden inside the web process.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Prerequisites and decisions to make before writing tasks
Host access
Use a supported Ubuntu LTS VPS with an SSH key and initial sudo or root access. Record the public address, the SSH user, the private-network address if one exists, and the ports that must remain reachable. The first play should create a named deployment user and then use that account for normal operations.
Pin the versions that define the release
Make these explicit inventory or group variables:
- Ubuntu image or release used to build the host.
- Ruby and Bundler versions accepted by the application Gemfile.
- Rails and other gem versions from the lockfile.
- JavaScript runtime and package-manager versions used to compile assets.
- PostgreSQL major version.
- Nginx, Puma and Ansible versions tested for the release.
Do not silently install the latest package on every run. Update pins deliberately, review the resulting changes and record the complete version set with the release.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose the database boundary
A PostgreSQL instance on the same VPS is simple and has low local latency, but the host, disk, database and application share one failure domain. You own backups, restore testing, upgrades and capacity planning. A managed database moves much of that operational responsibility to the provider and can improve isolation and failover options, but it introduces network latency, recurring service cost and a dependency on private connectivity and provider availability. Decide before writing firewall and connection rules; the rest of the role design depends on that choice.
Choose a deployment model
A Capistrano-style release keeps versioned directories and a current symlink on the VPS. It is straightforward for a single host and supports quick release rollback, but the host still needs Ruby, Node tooling and system packages maintained over time. A container or Kamal-style workflow makes the application image more reproducible and can simplify dependency drift, while adding an image registry, container runtime and another layer of operational troubleshooting. Both models can use Ansible for host provisioning; they should not be mixed accidentally in the same service definition.
Lay out the Ansible repository
A practical repository separates inventory, variables, roles and entry-point playbooks:
ansible/
inventories/production/hosts.yml
group_vars/production.yml
group_vars/production.vault.yml
playbooks/provision.yml
playbooks/release.yml
roles/
common/
ruby/
postgresql/
rails_app/
puma/
nginx/
deploy/
ansible.cfgThe role names are boundaries, not rigid requirements. Keep host-wide concerns in common, language tooling in ruby, database work in postgresql, application files and releases in rails_app, process supervision in puma, and edge configuration in nginx. A separate deploy role can own release hooks and worker units if that is clearer for your team.
Free tools Windows power users keep installed
One-click scans. No signup required.
Inventory and variables
all:
children:
rails:
hosts:
rails-vps:
ansible_host: 203.0.113.10
ansible_user: bootstrap
ansible_become: trueapp_name: example_app
app_user: deploy
app_root: /srv/example_app
rails_env: production
ruby_version: 3.2.4
bundler_version: 2.5.17
postgresql_version: 15
puma_bind: unix:///srv/example_app/shared/tmp/sockets/puma.sock
app_repo: [email protected]:team/example_app.git
app_revision: v2026.10.15Use an encrypted variable file or an external secret store for the database password, Rails master key, provider tokens and any private repository credentials. The ordinary group variable file should contain names and non-sensitive defaults, not secret values. Restrict the mode of any rendered environment file and ensure only the deploy user and the service that needs it can read it.
Make privilege boundaries visible
Bootstrap may require root, but the application should run as an unprivileged user. Grant that user only the narrowly scoped sudo permissions needed for deployment, such as restarting named systemd units. Do not give the application account unrestricted shell access through sudo merely to make a task pass.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Build the provisioning playbook in a safe order
The order below avoids starting a service before its account, directories, configuration and dependencies exist. Put each stage in its role and call the roles from a site playbook.
1. Bootstrap the host and deployment account
- Connect with the initial SSH key and privileged account.
- Create the deploy user with a locked password and the required authorized key.
- Create the application group if your file ownership model needs one.
- Install the deploy user’s SSH configuration or repository deploy key without printing its contents in task output.
- Install a minimal sudoers entry for the specific Puma and worker units, validating it before enabling it.
- Run later plays as the deploy user with privilege escalation only for tasks that need it.
After this stage, test a fresh SSH session as the deploy user before proceeding. Losing the only privileged path is a recovery problem, not an Ansible failure you can safely ignore.
2. Apply common host configuration
The common role should update package indexes, apply approved security updates, set the time zone and time synchronization policy, install build prerequisites, configure log retention and establish the firewall policy. Open only SSH, HTTP and HTTPS on the public interface. If PostgreSQL is remote or a private network is used, allow the database port only on that private source range.
Install compilers and headers required by the locked gems, such as database client development libraries, image-processing libraries and JavaScript build prerequisites. Derive the exact package list from the Gemfile, lockfile and asset toolchain rather than installing an unbounded development image.
Use handlers for changes that require service action. A changed SSH configuration can notify a controlled reload; a changed log-rotation rule can notify its daemon; firewall changes should be applied in a way that preserves the current administrative connection.
3. Install Ruby and JavaScript tooling
The ruby role should install the selected Ruby version using the version-management approach your team supports, set the deploy user’s shell initialization, install the pinned Bundler version and install the exact JavaScript runtime and package manager required by the application. Do not infer the Ruby version from the server’s distribution package when the Gemfile specifies another version.
Expose the selected versions as variables and verify them during the play:
ruby --version
bundle --version
node --version
npm --versionRun these checks as the deploy user, because a system Ruby and a user-managed Ruby can otherwise report different results. Fail early when the reported version does not match the inventory pin.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
4. Install and harden PostgreSQL
The postgresql role installs the chosen major version, starts it, creates the application database and creates a dedicated login role with only the privileges the application requires. Render authentication rules so the database accepts connections from the application host or private network, not from the entire internet. For a local socket, use peer or password authentication according to the chosen account model; for a private connection, require encrypted transport where supported and restrict the source address.
Store the connection string or individual credentials in a protected environment file. Do not put a database password in a repository URL, a task argument that may be logged, or a shell command visible in process listings. Define backup retention, where backups are written, how they are encrypted and who can restore them before calling the database production-ready.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Create release directories and fetch the application
Have rails_app create a stable structure such as /srv/example_app/releases, /srv/example_app/shared, /srv/example_app/shared/log, /srv/example_app/shared/pids and /srv/example_app/shared/tmp/sockets. Make the deploy user the owner and keep shared secrets and uploads outside any individual release directory.
Fetch a known Git revision rather than whatever happens to be at the default branch when the play runs. Install gems with the lockfile enforced, install the pinned JavaScript dependencies, link shared configuration, and compile assets in the environment in which they will be served. Ensure the release has the correct ownership before systemd starts Puma.
When a command is unavoidable, make its state explicit. Use creates for one-time generation, changed_when for commands whose output does not map cleanly to change state, and check_mode handling where a command cannot safely run during a dry run. Prefer Ansible’s package, user, file, template, git and service modules to unguarded shell blocks.
6. Render Puma and worker systemd units
Render a unit that runs as the deploy user, reads a protected environment file, uses the release’s Puma configuration and writes logs to a location covered by rotation. A simplified template might look like this:
Recommended Free Tools
[Unit]
Description=Example Rails Puma
After=network.target postgresql.service
[Service]
Type=simple
User=deploy
WorkingDirectory=/srv/example_app/current
EnvironmentFile=/srv/example_app/shared/.env.production
ExecStart=/home/deploy/.rbenv/shims/bundle exec puma -C /srv/example_app/current/config/puma.rb
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetAdapt the paths to your Ruby installation and release strategy. If you use a Unix socket, make sure its parent directory exists and is writable by the service. Give workers separate units when they have different restart, memory or deployment behavior. Enable the units only after their files and environment are in place.
Use ansible.builtin.systemd_service for systemd management; the fully qualified name avoids collection-name conflicts. The shorter systemd name is a backward-compatible alias, but the qualified module makes the intended collection explicit. If a role must operate across hosts with different init systems, ansible.builtin.service is the portability layer that proxies to the detected service manager.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
7. Configure Nginx as the edge proxy
Render a server block that listens on the required addresses, serves Rails static assets according to the application’s configuration and proxies dynamic requests to Puma. Preserve the forwarding headers Rails needs, set appropriate request-size and timeout limits for the application, and keep the upstream endpoint in a variable so a socket-to-port change does not require rewriting the role.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallserver {
listen 80;
server_name app.example.org;
root /srv/example_app/current/public;
location /assets/ {
try_files $uri =404;
}
location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://unix:/srv/example_app/shared/tmp/sockets/puma.sock:;
}
}Validate the rendered configuration before reloading Nginx. A template change should notify a reload handler, not restart Nginx on every play. Add TLS termination and an automated certificate-renewal process before exposing credentials or user data, then test renewal rather than assuming the timer works.
8. Enable services and perform first health checks
- Run the systemd daemon reload after unit templates change.
- Enable and start PostgreSQL, Puma and any worker units.
- Run
nginx -tand reload Nginx only after validation succeeds. - Check local Rails health endpoints through Puma and through Nginx.
- Check that a Rails console or a controlled application check can connect to PostgreSQL.
- Inspect service status and recent logs for Puma, workers, PostgreSQL and Nginx.
- Verify the external HTTPS endpoint, certificate chain, redirects, static assets and WebSocket or streaming behavior if the application uses them.
Use handlers so changes cause only necessary service actions
A handler gives configuration changes a precise consequence. A changed Puma unit should notify a daemon reload and a Puma restart; a changed Nginx virtual host should notify an Nginx configuration test followed by a reload. Package installation alone should not bounce a healthy application unless the package change requires it.
Keep notifications attached to the task that changed the relevant file. This makes a second identical run quiet and makes the play’s output explain why a process restarted. Test the behavior in check mode and in a disposable host before applying a role to production.
Separate first-boot provisioning from releases
Do not make every application deployment reinstall the operating system stack. The provisioning playbook should be safe to run when rebuilding a host, while the release playbook should be optimized for changing application code.
A controlled release sequence
- Select a Git tag or commit and record it as the release revision.
- Create a new release directory and check out that revision.
- Install locked Ruby and JavaScript dependencies as the deploy user.
- Link the shared environment file, uploads and other persistent data.
- Compile assets using the release’s pinned toolchain.
- Run a pre-migration backup and verify that it is readable.
- Run database migrations as an explicit task, with the migration’s reversibility assessed in advance.
- Switch the
currentsymlink only after the release passes local checks. - Restart or gracefully reload Puma and any workers through their named systemd units.
- Run health checks, inspect logs and retain enough previous releases for the documented rollback procedure.
Migrations can be irreversible. For destructive changes, use an expand-and-contract approach where possible: add compatible structures, deploy code that can use both versions, backfill, and remove old structures only in a later release. If a migration cannot be reversed, the verified backup is the recovery mechanism; a Git rollback alone will not undo a database change.
Rollback choices
If only application code is faulty and the schema remains compatible, point current at the previous release, restart Puma and run the health checks again. If the failed release changed the schema, do not blindly roll back code. Follow the migration’s documented down path only when it is known to be safe, or restore the database to a verified point and coordinate the application version with that restore. Record who can authorize each action.
Design for idempotence and safe reruns
An idempotent role converges the host to the declared state rather than repeating side effects. Use:
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
packagefor packages, with versions pinned where the repository supports it.userandauthorized_keyfor accounts and access.filefor directories, ownership and modes.templatefor systemd, Nginx, PostgreSQL and environment-file layouts.gitfor a specified revision, not a free-running branch.ansible.builtin.systemd_serviceoransible.builtin.servicefor service state.- Handlers for reloads and restarts caused by actual template changes.
When shell or command is unavoidable, define how Ansible knows whether the command changed anything, whether it can run in check mode, and how it behaves after interruption. Avoid tasks that append the same line on every run, initialize a database without a guard, or run migrations merely because a play was re-run. A deployment migration belongs in the release workflow and should have an explicit revision or release gate.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Security and reliability controls that belong in the baseline
- Use SSH keys and disable password login when your recovery process supports it. Keep an out-of-band console or documented break-glass path before changing SSH policy.
- Limit inbound traffic to SSH, HTTP and HTTPS, plus private-network database traffic when required.
- Keep
RAILS_MASTER_KEY, database credentials and provider tokens outside source control. Render them with restrictive ownership and modes. - Run Rails, Puma and workers as the unprivileged application user. Reserve root for host tasks that require it.
- Terminate TLS at Nginx with automated renewal and test the renewal path before relying on it.
- Rotate logs and monitor disk usage; a full disk can stop PostgreSQL, prevent releases and hide the evidence needed to diagnose the failure.
- Back up the database, test restores on a schedule and document where backup encryption keys are held.
- Alert on failed Puma, worker and PostgreSQL units, failed certificate renewal, backup failure and disk-health thresholds.
- Record the operating system, Ruby, Rails, PostgreSQL, Nginx, Puma and Ansible versions for every release.
Operational comparisons for a single VPS
Nginx plus Puma versus Passenger
| Concern | Nginx plus Puma | Passenger-style deployment |
|---|---|---|
| Operational model | Nginx is the edge proxy and Puma is a separately managed Ruby service. | The web-server integration manages Ruby application processes through its own model. |
| Supervision | systemd owns Puma restarts, limits and logs; the unit is explicit in Ansible. | Process lifecycle is more integrated with the web-server configuration. |
| WebSockets and streaming | Configure proxy upgrade headers, timeouts and Puma behavior deliberately for the application’s needs. | Behavior depends on the integration and its supported configuration; validate the exact workload. |
| Memory and tuning | Ruby workers, threads and Nginx are visible as separate processes to measure and tune. | Worker behavior is controlled through the integration’s process settings. |
| Deployment tooling | Works naturally with a systemd unit, Capistrano-style releases or a custom Ansible release role. | Uses the integration’s deployment conventions, which may reduce unit-file work but change team workflows. |
| Team familiarity | Best when the team already operates Nginx, Puma and systemd independently. | Can be attractive when the team prefers an integrated Ruby application server. |
Neither choice removes the need for pinned dependencies, protected secrets, health checks and rollback planning. Choose the model your operators can diagnose at 03:00, not merely the one that has the shortest initial task list.
PostgreSQL on the VPS versus a managed database
| Concern | Same VPS | Managed database |
|---|---|---|
| Backup and restore | Your Ansible and operations process must schedule, protect and verify backups and restores. | The provider may supply automated backups and point-in-time recovery, but you must verify its retention and restore process. |
| Latency | Local socket or private-host traffic is usually simple to configure. | Every query crosses a network boundary; private routing and connection limits matter. |
| Isolation | Application and database share host CPU, memory, disk and failure domain. | Resources and failure handling are separated from the application VPS. |
| Failover | You design replication or accept a manual recovery procedure. | Failover options may be available, subject to the service tier and provider behavior. |
| Cost | Lower incremental service cost, but more operator time and VPS resource pressure. | A separate recurring charge in exchange for managed operations and isolation. |
Troubleshoot by checking the boundary that failed
SSH or privilege failures
Confirm the inventory address, SSH key, bootstrap user and sudo policy. Test the deploy user’s interactive login separately from Ansible’s become path. If a hardening task removed access, use the provider console or the documented break-glass account rather than repeatedly changing the play from a locked-out session.
Puma is inactive or Nginx returns a gateway error
- Run
systemctl status example_app-pumaand inspect the journal for the first error, not only the final exit code. - Confirm the unit’s
WorkingDirectory, Ruby path, Bundler version and environment file. - Check that the current release exists and that the deploy user can read it.
- Check that the socket directory exists, has the expected owner and contains the socket.
- Run the Puma command as the service user in the release directory to distinguish application errors from systemd errors.
- Run
nginx -t, then confirm Nginx’s upstream path exactly matches Puma’s socket or port.
Assets are missing or stale
Verify that the release task installed the locked JavaScript dependencies and completed asset compilation, that Nginx’s document root points to the current release, and that the Rails static-file setting matches the chosen serving strategy. A successful Puma restart does not prove that the asset pipeline produced files in the directory Nginx serves.
Database connection or migration errors
Check the rendered environment file, database hostname, port, role and authentication rules. Test connectivity using the same user and environment that the systemd service uses. Confirm that the expected PostgreSQL major version is running and that the migration is being executed once, from the intended release. Do not solve an authentication error by opening PostgreSQL to the public internet.
A second Ansible run changes everything again
Look for shell commands without guards, templates that contain unstable timestamps, package tasks that request an unpinned latest version, and tasks that notify handlers unconditionally. Run in check mode, inspect the diff, and move release-only actions such as migrations out of the provisioning play.
Pre-production acceptance checklist
- A replacement Ubuntu LTS host can be built from the repository with only the documented bootstrap access and injected secrets.
- The deploy user can log in, but Rails and Puma do not run as root.
- The pinned Ruby, Bundler, JavaScript, PostgreSQL, Nginx, Puma and Ansible versions are recorded.
- An identical provisioning run produces no unexplained changes or service restarts.
- Nginx configuration validates before reload, and TLS renewal has been tested.
- Health checks cover the local Puma endpoint, the Nginx endpoint, static assets, database access and any worker-dependent path.
- Backups have been restored in a test environment, and destructive migrations have a documented recovery path.
- Monitoring alerts on failed services, disk pressure, backup failure and certificate-renewal failure.
- The team knows whether a release rollback is code-only or requires coordinated database recovery.
The result is a Rails VPS that can be rebuilt rather than hand-repaired: explicit inputs define the host, roles converge it to the desired state, handlers limit disruption, and releases remain a separate, auditable operation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
