Run Ghost as a local application on your VPS and let Apache act as the public reverse proxy. Point your domain’s DNS records to the server, keep Ghost listening on localhost, configure Apache to preserve the original host and HTTPS information, then use Certbot to obtain a Let’s Encrypt certificate. Ghost must use the final HTTPS address as its canonical URL, or redirects, login links and admin access can fail.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The architecture you are deploying
Ghost is the application process; Apache is the internet-facing web server. Visitors connect to Apache on ports 80 and 443, while Apache forwards requests to Ghost on the VPS’s loopback interface, normally 127.0.0.1:2368. Keeping that application port private prevents users from bypassing TLS and the proxy configuration.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Layer | Responsibility | Publicly reachable? |
|---|---|---|
| DNS | Maps your domain to the VPS address | Yes, through public DNS |
| Apache | Terminates TLS, redirects HTTP, preserves host and forwarding headers, and proxies requests | TCP 80 and 443 |
| Ghost | Serves the publication and admin interface | No; bind it to localhost |
| MySQL | Stores Ghost content and settings | No; keep database access local unless your design specifically requires otherwise |
Ghost’s documentation describes the application as designed to run behind a reverse proxy. Ghost-CLI can automate a production installation, but its generated proxy configuration is for NGINX. Choosing Apache therefore means retaining Ghost’s required proxy behavior while writing and maintaining the Apache virtual hosts yourself.
Prerequisites and decisions
- A fresh, current Ubuntu VPS is the safest baseline for a production installation. Ghost’s hosting guidance says it can be installed and maintained on almost any VPS provider, but package compatibility still matters.
- Root or sudo access, plus a separate non-root deployment user.
- A supported Node.js release and MySQL version accepted by the current Ghost-CLI checks. Do not pin versions from an old tutorial; verify compatibility during installation.
- A domain you control. Decide whether the canonical hostname will be the bare domain, such as
example.com, orwww.example.com. - TCP ports 80 and 443 open in both the VPS operating-system firewall and any provider-level firewall. Keep Ghost’s application port closed to the internet.
- Enough storage for the operating system, Ghost, the database, images and backups. No universal CPU, RAM or requests-per-second figure is established for Apache-backed Ghost deployments, so size the server according to your content and traffic and monitor it after launch.
Use one canonical hostname. If you publish at https://example.com, make any accepted www address redirect to it rather than serving two independent versions of the publication.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
1. Point DNS at the VPS
Create an A record for the IPv4 address assigned to the VPS:
| Name | Type | Value | Use |
|---|---|---|---|
@ or the apex |
A | VPS public IPv4 address | Primary domain |
@ or the apex |
AAAA | VPS public IPv6 address | Only if IPv6 is configured and reachable |
www |
A or CNAME | Your chosen target | Only if you intend to accept and redirect or serve the www hostname |
Do not request a certificate until public DNS resolves to this VPS. Let’s Encrypt validates control of the hostname over the network; a record that still points to an old server will make validation fail or issue a certificate for the wrong machine. Check both the apex and www names if you plan to include both in Apache and Certbot.
Open the firewall before testing:
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enableIf your provider has a separate security-group or firewall panel, allow the same ports there. Do not add a public rule for port 2368.
2. Install Ghost in production mode
Ghost-CLI is Ghost’s supported production installation tool. It checks the operating system, Node.js and database prerequisites, creates the service configuration and installs Ghost in a chosen directory. Run the application under a low-privilege user rather than operating Ghost as root.
After creating and switching to your deployment user, install the CLI and prepare the site directory:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo npm install -g ghost-cli@latest
mkdir -p /var/www/ghost
sudo chown "$USER":"$USER" /var/www/ghost
cd /var/www/ghost
ghost installThe installer asks for the publication URL. Enter the final HTTPS URL, for example https://example.com, even though Apache and the certificate are configured later. Ghost’s production URL is not merely cosmetic: it controls generated links, redirects and admin behavior. Configuration changes take effect after a Ghost restart.
Recommended Free Tools
Ghost-CLI may offer to configure MySQL, NGINX and SSL. Complete the database and service steps required by the installer, but treat the public-proxy steps as an Apache integration:
- Do not expose Ghost directly on a public interface.
- If the installer offers to generate NGINX configuration, skip or adapt that stage rather than putting NGINX in front of Apache. Ghost-CLI’s normal production proxy output targets NGINX.
- Apache will terminate TLS and provide the reverse proxy, so its virtual hosts must reproduce the forwarding semantics Ghost expects.
If the installer stops because a Node.js or MySQL version is unsupported, follow the current Ghost installation requirements rather than forcing the installation with an unverified package combination.
3. Verify Ghost before adding Apache
Check the service from the VPS itself:
ghost status
curl -I http://127.0.0.1:2368The exact status text varies by Ghost version. You are looking for a running Ghost process and an HTTP response from the loopback address. If the connection is refused, resolve the Ghost service, database or installation error before debugging Apache. A local response proves that the application is available; it does not yet prove that DNS, Apache or HTTPS is correct.
4. Enable Apache’s proxy and TLS modules
On Ubuntu, enable the modules required for HTTP proxying, request headers, rewrites and SSL:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo a2enmod proxy proxy_http headers rewrite ssl
sudo systemctl reload apache2proxy_http forwards HTTP requests to Ghost, headers sets the forwarding metadata, rewrite handles HTTP-to-HTTPS or hostname redirects, and ssl enables the TLS virtual host that Certbot will configure.
5. Create Apache’s HTTP virtual host
Create /etc/apache2/sites-available/ghost.conf. Replace the example names with your domain:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
ProxyPreserveHost On
ProxyPass / http://127.0.0.1:2368/
ProxyPassReverse / http://127.0.0.1:2368/
RequestHeader set X-Forwarded-Proto "http"
RequestHeader set X-Forwarded-Port "80"
RequestHeader set X-Real-IP "%{REMOTE_ADDR}s"
ErrorLog ${APACHE_LOG_DIR}/ghost-error.log
CustomLog ${APACHE_LOG_DIR}/ghost-access.log combined
</VirtualHost>ProxyPreserveHost On keeps the visitor’s original Host header, so Ghost knows which domain was requested. ProxyPassReverse rewrites proxy-generated response headers correctly. The forwarding headers tell Ghost whether the original connection was HTTP or HTTPS and which client address reached Apache.
This file is an Apache adaptation of Ghost’s documented reverse-proxy requirements; Ghost-CLI does not generate this Apache configuration. In particular, an incorrect X-Forwarded-Proto value is a common cause of an HTTPS redirect loop.
Free tools Windows power users keep installed
One-click scans. No signup required.
Enable the site and validate the syntax:
sudo a2ensite ghost.conf
sudo apachectl configtest
sudo systemctl reload apache2Before the certificate exists, an HTTP request should reach Ghost through Apache. If you still see Ubuntu’s default Apache page, the default site may be taking precedence or the request may be reaching a different server.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
6. Obtain and install HTTPS with Certbot
Install Certbot and its Apache integration from Ubuntu’s packages:
sudo apt update
sudo apt install certbot python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.comOmit -d www.example.com if you did not create that DNS record and will not accept the hostname. Certbot’s Apache plugin locates the matching virtual host and adds TLS directives. Live certificates are stored below /etc/letsencrypt/live/<domain>/.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCertbot may add an HTTP redirect automatically. Review the resulting configuration rather than assuming it preserved every proxy directive. The HTTPS virtual host must retain the proxy settings and explicitly identify the original secure connection:
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
ProxyPreserveHost On
ProxyPass / http://127.0.0.1:2368/
ProxyPassReverse / http://127.0.0.1:2368/
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
RequestHeader set X-Real-IP "%{REMOTE_ADDR}s"
ErrorLog ${APACHE_LOG_DIR}/ghost-ssl-error.log
CustomLog ${APACHE_LOG_DIR}/ghost-ssl-access.log combined
</VirtualHost>Use the certificate paths Certbot created for your actual hostname. Do not place the X-Forwarded-Proto "https" directive only in the port-80 virtual host: Apache terminates TLS on port 443, and that secure virtual host is where Ghost must be told that the original request was HTTPS.
Test and reload after reviewing the generated files:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo apachectl configtest
sudo systemctl reload apache2Check renewal automation:
systemctl list-timers | grep certbot
sudo certbot renew --dry-runThe dry run tests the renewal path without replacing a live certificate. Keep port 80 available if your chosen ACME validation method needs it, and investigate any renewal error immediately rather than waiting for the certificate to expire.
7. Set Ghost’s canonical URL and restart
From the Ghost directory, set the same HTTPS hostname used in Apache and the certificate:
ghost config url https://example.com
ghost restartIf you selected www.example.com as canonical, use that exact URL everywhere instead. A publication has one primary domain; configure the other hostname only to redirect consistently. A mismatched URL can produce access-denied messages, links pointing to localhost:2368, unexpected redirects or admin pages that cannot complete login.
8. Validate the finished deployment from outside the VPS
Run these checks from another machine or network:
curl -I http://example.com
curl -I https://example.com
curl -I https://example.com/ghost/
openssl s_client -connect example.com:443 -servername example.com </dev/null- The HTTP request should redirect once to the HTTPS canonical URL, not bounce repeatedly between schemes or hostnames.
- The HTTPS response should present a certificate whose names include the hostname you requested.
- The homepage should load through Apache, and
/ghost/should reach Ghost’s admin login. - Apache’s access and error logs should show proxied requests without repeated upstream connection failures.
- Upload an image in the admin area and confirm it is not rejected by an unrelated Apache request-size or permissions rule.
Use browser developer tools or curl -I to inspect the final Location header when a redirect behaves unexpectedly. The first redirect should normally be the only scheme change.
Troubleshooting Apache-backed Ghost
| Symptom | Likely cause | What to check |
|---|---|---|
| Infinite HTTP/HTTPS redirect loop | Apache tells Ghost that the request was HTTP after TLS termination | In the *:443 virtual host, set RequestHeader set X-Forwarded-Proto "https" and X-Forwarded-Port "443". Confirm ProxyPreserveHost On. |
| 502 Bad Gateway | Ghost is stopped, listening on another port, or Apache cannot reach it | Run ghost status, then curl -I http://127.0.0.1:2368. Check the Apache error log and the Ghost service log. |
| Default Apache page | The default site is enabled, the ServerName does not match, or DNS points elsewhere |
Disable the default site if appropriate, verify apachectl -S, check DNS, and reload Apache after correcting the virtual host. |
| Ghost generates localhost links | The canonical URL is wrong or the original host was not preserved | Run ghost config url https://example.com, keep ProxyPreserveHost On, and restart Ghost. |
| Admin access denied or redirects to the wrong host | Ghost’s configured URL and the requested hostname differ | Choose one canonical hostname, use it in Ghost and Apache, and redirect the alternate hostname. |
| Certificate issuance fails | DNS has not reached this VPS, port 80 is blocked, or the requested name is absent from the virtual host | Verify public A/AAAA records, provider and OS firewalls, and the exact names passed to Certbot. |
| Certificate renewal fails | Validation can no longer reach the server or the Apache configuration changed | Run sudo certbot renew --dry-run, inspect the renewal error, and ensure the validation path and virtual host remain available. |
| Uploads are rejected | An Apache request-size restriction, filesystem permission problem or proxy rule interferes | Inspect the browser response and Apache logs before changing limits. Confirm the Ghost content directory is writable by the Ghost service user. |
When diagnosing, test in layers: first the local Ghost URL, then Apache over HTTP, then Apache over HTTPS, and finally the public hostname. This isolates an application problem from a proxy, DNS or certificate problem.
Operational practices after launch
- Keep Ghost, Ghost-CLI, Ubuntu packages, Node.js and MySQL within the versions supported by current Ghost documentation. Test upgrades in a copy of the site when possible.
- Back up the MySQL database and Ghost content, especially uploaded images. A certificate backup is not a substitute for a publication backup.
- Watch both
ghost-error.log/ghost-ssl-error.logand Ghost’s own logs for upstream failures, authentication errors and storage problems. - Restrict SSH access, apply security updates, and expose only the ports the publication needs. Ghost should remain bound to localhost.
- Re-run Apache’s configuration test after every virtual-host edit and reload only after it passes.
- Keep the certificate renewal timer enabled and test it periodically with Certbot’s dry-run mode.
When Apache is the right choice
Apache works when you need its existing modules, conventions or a server already standardized on Apache. The trade-off is manual integration: Ghost-CLI’s supported production automation is centered on NGINX, while the Apache virtual host, forwarding headers, TLS settings and redirects are your responsibility. There is no authoritative benchmark establishing a universal performance difference between Apache and NGINX for Ghost on a VPS, so choose based on operational familiarity and the rest of your server stack rather than an assumed speed advantage.
The essential contract is simple: DNS reaches the VPS, Apache terminates HTTPS and forwards the original host and scheme, and Ghost knows its final HTTPS URL. If those three layers agree, Ghost can run privately on the VPS while Apache presents a normal secure publication to visitors.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
