Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To proxy a Node.js application through VestaCP, keep Node.js listening on a local TCP port, point your domain to the VestaCP server, and assign an Nginx template that forwards the domain’s requests to that port. Put the proxy directives in a VestaCP template or supported per-domain customization—not in a generated server file—then rebuild the web configuration and reload Nginx. Verify the listener, DNS, HTTP, HTTPS, and logs in that order. This arrangement leaves Nginx as the public entry point while Node.js remains private on localhost, which is safer and makes TLS, host routing, and multiple applications easier to manage.
What does a VestaCP-to-Node.js reverse proxy do?
A reverse proxy accepts the browser’s request on the public domain and relays it to a backend process. In this setup, Nginx listens on the server’s HTTP and HTTPS ports, while Node.js listens on an internal port such as 3000 or 8000. The browser never needs to know that backend port.
Free tools Windows power users keep installed
One-click scans. No signup required.
As an Amazon Associate I earn from qualifying purchases.
Node’s HTTP API starts a listener with server.listen(8000); that call makes the application accept connections on the selected port. Nginx’s proxy_pass directive then sends requests from a location to that address, and proxy_set_header preserves the original host and client information. VestaCP supplies the layer that generates and maintains the Nginx server configuration.
Request path
- The domain’s A or AAAA record resolves to the VestaCP server.
- Nginx receives the request for that domain on port 80 or 443.
- The selected VestaCP template matches the domain and proxies the request to
127.0.0.1:<app-port>. - Node.js returns the response to Nginx, which sends it back to the client.
What must be ready before configuring the proxy?
Complete these checks first. A proxy cannot fix a stopped application, incorrect DNS, or a domain using the wrong VestaCP template.
Popular on Amazon
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- A running Node.js service: Start the app and confirm that it is listening on the exact local port you intend to use.
- DNS pointing to this server: Set the domain’s A record, and its AAAA record if you use IPv6, to the VestaCP server’s addresses. Allow time for resolver caches to expire.
- The intended VestaCP domain: Create or select the web domain in VestaCP so the incoming Host header reaches the correct account and configuration.
- A proxy-capable template: Identify the template assigned to the domain, or prepare a custom copy. Template names and available stack modes differ between VestaCP releases and forks.
- Certificate materials for HTTPS: Obtain a certificate covering the exact hostname and use an SSL-capable version of the template before enabling the HTTPS domain.
- Administrative access: You need permission to edit templates, rebuild user configuration, test Nginx, and reload the web service.
Choose a private application port
Use an unoccupied high port, commonly 3000 or 8000, and bind the app to localhost when it does not need direct public access. Check the application’s actual bind address and port rather than assuming the value in a development guide. If the process binds only to an IPv6 address, a proxy target of 127.0.0.1 will not reach it; use a matching address or bind Node to both families according to your server’s policy.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Where should the Nginx proxy configuration go in VestaCP?
VestaCP stores web templates under /usr/local/vesta/data/templates/. Its supported model is to copy or modify a template there, assign that template to the domain, and rebuild the generated user configuration. Editing a generated Nginx file can appear to work, but a domain edit, package change, or panel update may overwrite it.
Use a custom template rather than an unmanaged generated file
- Inspect the template currently used by the domain and choose the matching stack mode (Nginx-only or Nginx in front of Apache).
- Copy the closest built-in template to a distinct custom name under
/usr/local/vesta/data/templates/. Preserve the template’s required placeholders and file permissions. - Add the Node proxy location to the custom copy, replacing the example port and domain values with your application’s values.
- Use VestaCP’s documented web-domain proxy-template operation to assign the custom template to the domain or its package/user.
- Rebuild the user’s web configuration using the panel’s supported rebuild operation, then test and reload Nginx.
Template syntax and filenames are release-dependent. A template supplied by a myVesta fork may contain placeholders or directives that do not exist in your VestaCP installation, so treat fork-specific examples as illustrations and compare them with the template shipped on your server.
What proxy block should I use for a Node.js app?
Place this location inside the domain’s server block or the equivalent section of your custom VestaCP template. Replace 3000 with the port on which Node.js is actually listening.
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}What each directive changes
proxy_passdefines the backend address. With no URI suffix, Nginx forwards the request URI received at the location.proxy_http_version 1.1keeps HTTP/1.1 semantics for applications that need persistent connections or upgrades.Hostpasses the requested hostname so Node can select the correct virtual host or generate absolute URLs.X-Real-IPandX-Forwarded-Forcarry the client address through the proxy chain. Configure your framework to trust these headers only from your Nginx proxy.X-Forwarded-Prototells the application whether the original request was HTTP or HTTPS, which prevents incorrect secure-cookie and redirect behavior when TLS terminates at Nginx.
If the application serves a subpath rather than the site root, URI handling becomes significant: a trailing path on proxy_pass can replace part of the request URI. Test the exact paths your application expects before adding one.
Also popular on Amazon
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
How do I assign the template and rebuild VestaCP configuration?
Use VestaCP’s documented controls for changing a web domain’s proxy template and restarting or rebuilding web configuration. The exact command names vary by release, so verify them in the CLI help for the installed version instead of copying a command from an unrelated fork.
- Open the domain’s web settings and note the current proxy template and whether SSL is enabled.
- Select the custom template, or assign it at the package/user level if that is how your installation manages templates.
- Save the domain. Run the supported rebuild operation so VestaCP regenerates the domain’s Nginx configuration from the template.
- Run an Nginx syntax check before reloading:
nginx -t- If the test reports success, reload Nginx through the service manager supported by your host. A reload applies the new configuration without unnecessarily dropping existing connections; use a full restart only when your service procedure requires it.
- Inspect the generated server block to confirm that the expected
proxy_passtarget survived the rebuild. Do not make that generated file your permanent edit location.
How do I configure HTTPS without breaking the proxy?
HTTPS requires both a valid certificate and a template that defines the SSL server. VestaCP’s documented workflow uses a custom Nginx template, assigns it to the relevant package or user, and then adds the SSL domain. Install or issue the certificate for the exact hostname before testing the secure URL.
Recommended HTTPS sequence
- Confirm the HTTP domain resolves to this server and that the certificate authority can reach the required validation endpoint.
- Assign the SSL-capable custom template that contains the proxy location, not only the non-SSL template.
- Add the SSL domain or enable SSL in VestaCP, then rebuild the configuration.
- Test with
nginx -tand reload Nginx. - Request the HTTPS URL and inspect the certificate name, validity dates, and chain. Confirm that the application sees
X-Forwarded-Proto: https. - Only after HTTPS works should you enforce an HTTP-to-HTTPS redirect. A redirect loop usually means the app does not trust the forwarded protocol or the redirect is duplicated in both Nginx and Node.
How do Nginx-only and Nginx-plus-Apache VestaCP setups differ?
The proxy concept is the same, but the place where you add the location differs.
| Stack choice | Request path | Where the Node proxy belongs | Operational trade-off |
|---|---|---|---|
| Nginx only | Nginx → Node.js | The Nginx server template for the domain | Fewer layers and less overhead; static-file and rewrite behavior must be handled in Nginx or Node. |
| Nginx plus Apache | Nginx → Apache or Node.js, depending on the template | The template’s public Nginx location, before any Apache handoff | Preserves Apache-based sites, but adds another configuration layer and more places for redirects or headers to conflict. |
Do not paste an Nginx-only template into an Apache-backed installation. Start from the template matching the domain’s existing mode and retain its required VestaCP placeholders.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow can one server proxy several Node.js apps?
Give each application a distinct local port and route by hostname or path. Separate subdomains are usually clearer because each server block can have its own certificate, logs, and deployment lifecycle.
Also popular on Amazon
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
| Routing method | Example | Best fit | Watch for |
|---|---|---|---|
| Subdomains | api.example.com → 3000; admin.example.com → 3001 |
Independent services or teams | Separate DNS records and certificate names. |
| Path prefixes | example.com/api → 3000; example.com/shop → 3001 |
Related services under one hostname | Base-path, cookie, and URI-rewrite support in each app. |
| One port, internal router | Nginx → one Node process that routes internally | Applications designed as one service | A failure in the single process affects every route. |
Never assign the same port to two listeners. Record the mapping in deployment documentation so a later template change does not silently send a domain to the wrong application.
How do I keep Node.js running after logout or reboot?
Nginx only proxies to a process that is alive. Use a system service or a process manager appropriate to your distribution so Node starts at boot, restarts after a crash, and writes logs that can be correlated with Nginx access logs. VestaCP controls the web configuration; it does not, by itself, guarantee that your application process remains running.
- Define the production start command and working directory explicitly.
- Set environment variables, including the port, in the service definition rather than relying on an interactive shell.
- Configure restart behavior with a limit that prevents a crash loop from consuming resources.
- Make the service depend on networking being available before it starts.
- After a reboot, verify both the process and its listener before testing the public domain.
Keep the process bound to localhost unless another trusted service must reach it. If external access is required, restrict the firewall to approved source addresses rather than exposing the application port broadly.
How do I verify the proxy from the server outward?
Test each dependency separately; this identifies the failing layer faster than repeatedly refreshing a browser.
- Call the backend directly from the server:
curl -i http://127.0.0.1:3000/Expect the response status and body produced by Node. A connection refusal means the process is stopped, on another port, or bound to a different address.
Also popular on Amazon
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
- Confirm the live listener with the socket tool installed on your system, for example:
ss -ltnp | grep 3000- Validate the generated Nginx configuration:
nginx -t- Request the domain locally while supplying its Host header if DNS has not propagated:
curl -i -H 'Host: example.com' http://127.0.0.1/- Resolve the domain from an external network and request it over HTTP. This confirms DNS and the public firewall path.
- After certificate issuance, request HTTPS and inspect the certificate hostname and chain.
- Watch Nginx’s error/access logs and the Node.js logs during a request. Match timestamps to distinguish connection refusal, timeout, host-header, and TLS failures.
Why does VestaCP return a 502 Bad Gateway?
A 502 means Nginx could not obtain a valid response from the upstream. Compare the configured target with the live listener before changing unrelated settings.
- Node is stopped: Restart the application service and verify its listener.
- Port mismatch: Compare the port in
proxy_passwith the application’s runtime environment and the output ofss -ltnp. - Wrong bind address: If Node listens on a different interface or IPv6 only, change the bind address or the proxy target consistently.
- Firewall policy: Localhost traffic is normally allowed, but a host firewall or container boundary can still block the selected address.
- Timeout: A slow or deadlocked upstream may need application-level diagnosis; increasing Nginx timeouts does not repair a crashed process.
Why do I see the wrong site or a 404 response?
Usually the request reached a different server block or the application does not recognize the forwarded host/path. Verify the public DNS answer, the requested hostname, and the domain’s active VestaCP template.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Check A and AAAA records; an old AAAA record can send IPv6 clients to another server while IPv4 appears correct.
- Confirm the browser URL exactly matches the certificate and VestaCP domain, including the
wwwvariant. - Use a Host-header curl test against the server to prove which Nginx block answers locally.
- Check whether a path-prefix deployment requires a rewrite or an application base-path setting.
What should I do when WebSockets or long-lived requests fail?
Ordinary HTTP proxying does not automatically provide every upgrade and timeout setting required by WebSockets. Use a template that includes the application’s required upgrade and connection handling, or add the equivalent directives to your custom template after confirming they match your VestaCP version.
Fork-specific myVesta examples include a WebSocket variant, as well as templates that pass HTTPS information to the app or serve static files through Node. Those examples are not universal: copy the structure only after checking the placeholders and directives in your installed template. Test a real WebSocket handshake and a long-lived request, not just a normal page load.
Why do my proxy edits disappear?
VestaCP regenerates web configuration from templates. If you edited a generated domain file, a panel operation can replace it. Move the change into a custom template under /usr/local/vesta/data/templates/, assign that template through VestaCP, rebuild the user configuration, and reload Nginx. Keep a backup of the custom template and record which VestaCP release it targets so upgrades can be reviewed deliberately.
Also popular on Amazon
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Which deployment choices should I make?
| Decision | Use this when | Main consequence |
|---|---|---|
| Panel-managed custom template | You want VestaCP to regenerate domains consistently | Changes must survive rebuilds and follow the panel’s placeholders. |
| Manually maintained server block | Your installation explicitly supports unmanaged Nginx configuration | You control every directive, but panel operations may conflict with it. |
| HTTP only | Private testing on a controlled network | No transport encryption; unsuitable for public credentials or sessions. |
| HTTPS with SSL template | Any public application handling logins, cookies, or user data | Requires certificate lifecycle management and correct forwarded-protocol handling. |
| One app port | A single Node service owns the domain | Simpler routing and fewer failure points. |
| Multiple ports/subdomains | Several independent services share the server | Requires explicit DNS, certificate, port, and process mapping. |
The exact options depend on the VestaCP release or fork and on whether Apache is enabled behind Nginx. Keep the public proxy configuration and the Node process configuration as separate, documented concerns.
Frequently Asked Questions
Should Node.js listen on 0.0.0.0 or 127.0.0.1 behind Nginx?
Bind to 127.0.0.1 when Nginx is on the same host and no outside service needs the port. Binding to 0.0.0.0 exposes the listener on every interface, so use it only when required and protect the port with firewall rules.
How do I preserve the real client IP in my Node framework?
Nginx forwards the address in X-Real-IP and X-Forwarded-For. Enable your framework’s trusted-proxy setting for the Nginx hop only; trusting arbitrary forwarded headers lets clients spoof their address.
Can I deploy a new Node.js version without changing the VestaCP template?
Yes. Keep the domain’s proxy target stable and run the replacement process on a second local port. After testing it, switch the template’s port and rebuild, or use a local process manager that performs the handoff, then reload Nginx.
What health endpoint should I test through the proxy?
Expose a lightweight authenticated or non-sensitive endpoint such as /healthz that checks process readiness without dumping configuration or database secrets. Test it locally on the Node port and through both the domain’s HTTP and HTTPS routes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
