Run NGINX as the only public web server on ports 80 and 443. Bind Apache to a private address such as 127.0.0.1:8080, run Node.js on another private port such as 127.0.0.1:3000, and let NGINX route each hostname or path to the correct backend. This avoids port conflicts while keeping Apache available for PHP and phpMyAdmin.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The working architecture
A single IP address and port can have only one listening process. NGINX and Apache therefore cannot both listen on 0.0.0.0:80 (or the same address and port) at the same time. The reliable arrangement is to expose only NGINX to the internet and move the other services behind it:
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteInternet client
|
NGINX :80/:443
/
Node.js :3000 Apache :8080
|
PHP + phpMyAdminNGINX acts as a reverse proxy: it accepts the browser connection, sends the request to a selected upstream, receives the response, and returns it to the client. Apache can also operate as a reverse-proxy gateway, but in this design it remains the PHP-serving backend while NGINX owns the public edge.
What each listener does
| Service | Recommended bind | Role | Publicly reachable? |
|---|---|---|---|
| NGINX | 0.0.0.0:80 and 0.0.0.0:443 |
TLS termination, redirects, hostname/path routing | Yes |
| Node.js | 127.0.0.1:3000 |
Application HTTP server | No |
| Apache | 127.0.0.1:8080 |
PHP runtime and phpMyAdmin | No |
Use different private ports if those numbers are already occupied. The important properties are that the ports are unused, the backends bind only to a private interface, and NGINX is the sole public listener.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Choose hostnames or a path before configuring anything
There are two practical routing models. Separate hostnames are normally easier to operate; a single hostname with a phpMyAdmin subdirectory can be useful when DNS or certificate constraints require it.
| Design | Example | Cookie and redirect reliability | Configuration complexity | Troubleshooting |
|---|---|---|---|---|
| Separate hostnames | app.example.com to Node.js; db.example.com to Apache/phpMyAdmin |
Usually strongest because each application has its own host and root path | Lower; each server block has one upstream | Clear upstream boundaries and logs |
| One hostname with a path | example.com/ to Node.js; example.com/phpmyadmin/ to Apache |
More sensitive to cookie paths, trailing slashes, redirects, and absolute URLs | Higher; path matching and rewrite behavior must agree | Failures can look like application bugs or missing files |
If you control DNS, use separate hostnames. A path deployment is valid, but plan explicit tests for login cookies, form submissions, links that begin with a slash, and redirects generated by both applications.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Prepare the server and verify current listeners
Before editing configuration, identify what owns the public ports. On Linux, run:
sudo ss -ltnpLook for listeners on ports 80 and 443 and record the process names and addresses. Also check the intended private ports:
sudo ss -ltnp | grep -E ':80|:443|:3000|:8080'Stop or reconfigure any existing service that claims a port you need. Do not start both web servers with competing default configurations and hope that one will select another port automatically; the failure is deterministic and usually appears as “address already in use.”
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Firewall policy
Allow inbound TCP 80 and 443 to NGINX. Do not open 3000 or 8080 to the internet when the applications run on the same machine. A local firewall rule should reject those backend ports from external interfaces, and binding to 127.0.0.1 provides an additional restriction. If a container or separate host is involved, permit Apache only from the NGINX host or private network segment.
Move Apache to a private listener
Apache must listen on an address and port that NGINX can reach but that is not publicly exposed. The exact file name varies by distribution, but the settings are the same.
- Change the global listener. Replace a public directive such as
Listen 80withListen 127.0.0.1:8080. On systems that use an address-specific ports file, edit that file rather than adding a second conflicting line. - Change every matching virtual host. Use
<VirtualHost 127.0.0.1:8080>for the PHP site and set itsServerNameto the hostname NGINX will send in theHostheader. - Check for duplicate listeners. Search the Apache configuration for other
Listen 80,Listen 443, or<VirtualHost *:80>entries that are still enabled. - Validate before restarting. Run the distribution’s Apache configuration test, commonly
sudo apachectl configtestorsudo apache2ctl configtest. Continue only when it reports a successful syntax check. - Reload Apache and inspect its log. A reload applies the listener change without unnecessarily terminating active requests. If the reload fails, read the Apache error log and correct the first reported error.
Test the backend directly from the server before involving NGINX:
curl -I http://127.0.0.1:8080/The response should come from the intended Apache virtual host. If you receive the wrong site, check the Host header and Apache’s name-based virtual-host order:
curl -I -H 'Host: db.example.com' http://127.0.0.1:8080/Run Node.js as a private upstream
Configure the Node.js application to listen on 127.0.0.1:3000 (or another unused local port), not on a public interface unless direct access is a deliberate requirement. Most frameworks accept a host and port through environment variables. For applications that read PORT and HOST, the effective settings are equivalent to:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
HOST=127.0.0.1
PORT=3000Start the application using its normal production command, then verify it independently:
curl -i http://127.0.0.1:3000/Keep the process under a supervisor such as a system service, a process manager, or a container orchestrator so it restarts after failure. The supervisor should write an application log and expose a health endpoint if the application supports one. NGINX cannot distinguish a crashed process from an application that returns an error unless you monitor both the upstream connection and the response status.
Configure NGINX for separate hostnames
Create one NGINX server block for the Node.js hostname and another for Apache/phpMyAdmin. Keep the public listeners on NGINX and forward requests with proxy_pass.
Node.js server block
server {
listen 80;
listen [::]:80;
server_name app.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}Host preserves the requested hostname. X-Real-IP and X-Forwarded-For let the application and its logs identify the original client instead of only seeing NGINX. X-Forwarded-Proto tells the application whether the browser used HTTP or HTTPS, which is essential when it creates absolute redirects or secure cookies.
Apache/phpMyAdmin server block
server {
listen 80;
listen [::]:80;
server_name db.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:8080;
}
}Using the same forwarded-header policy for both upstreams avoids a class of inconsistent redirect and logging bugs. Apache receives the original host and can select the correct virtual host even though the TCP connection arrives from NGINX.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
WebSocket support for Node.js
If the Node.js application uses WebSockets, add an HTTP/1.1 upstream connection and the upgrade headers required by the application. A common pattern is:
location /socket.io/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}Use the path your application actually upgrades; do not add a broad upgrade rule if the application does not use WebSockets. Confirm the upgrade in the browser’s network tools and in the Node.js log.
Add HTTPS at NGINX
Terminate TLS at NGINX unless you have a specific reason to encrypt the second hop as well. Install the certificate and private key in the NGINX HTTPS server blocks, then redirect HTTP requests:
Recommended Free Tools
server {
listen 80;
listen [::]:80;
server_name app.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name app.example.com;
ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/private.key;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}Create an equivalent HTTPS block for db.example.com that proxies to port 8080. With this arrangement, the upstream sees X-Forwarded-Proto: https, while the local hop remains ordinary HTTP. If your security policy requires end-to-end TLS, configure Apache or the Node.js application for a private HTTPS listener and change the upstream URL accordingly.
After editing, run sudo nginx -t. Reload only after the test succeeds:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo systemctl reload nginxServe phpMyAdmin through Apache
Apache can serve a PHP installation of phpMyAdmin directly, or NGINX can proxy to an official phpMyAdmin container whose internal web server is Apache. In either case, keep the Apache listener private and let NGINX publish the external URL.
Direct Apache installation
Install PHP and phpMyAdmin using your operating system’s supported packages or the phpMyAdmin installation procedure. Enable the PHP handler in Apache, make the phpMyAdmin directory available under the intended virtual host, and confirm that the application works at the private URL first:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
curl -I -H 'Host: db.example.com' http://127.0.0.1:8080/phpmyadmin/Use the trailing slash in the public path. It allows Apache and phpMyAdmin to resolve relative resources consistently and makes redirects predictable.
Containerized phpMyAdmin
The official container supports mapping a host port to its internal port 80 and provides an APACHE_PORT setting when the Apache listener inside the image must change. Map the host side to a private address or an isolated container network rather than publishing it on every interface. For example, the conceptual mapping is host loopback port 8080 to the container’s HTTP port.
When the container sits behind a reverse proxy, set PMA_ABSOLUTE_URI to the complete URL users open, including the final slash, such as https://db.example.com/ or https://example.com/phpmyadmin/. The value must match the externally visible scheme, host, and path. An incorrect value can produce broken links, failed cookie login, repeated authentication prompts, or a 404 after submitting a form.
Publish phpMyAdmin under one hostname and a path
If you choose example.com/phpmyadmin/, put the more specific location before the general Node.js location:
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/private.key;
location = /phpmyadmin {
return 301 /phpmyadmin/;
}
location /phpmyadmin/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:8080/;
}
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}The trailing slash on the proxy_pass URL changes how NGINX replaces the matched prefix. Test whether your Apache/phpMyAdmin installation expects requests with or without the /phpmyadmin prefix; adjust the upstream path and application base URL together. Do not assume that a page loading proves the path is correct. Login, CSS and JavaScript assets, redirects, cookies, table browsing, and form submissions all need verification.
Validate each layer in order
- Check listeners. Run
ss -ltnp. Only NGINX should be externally bound to 80 and 443; Node.js and Apache should appear on their planned private ports. - Test Node.js directly. Run
curl -i http://127.0.0.1:3000/and confirm the expected application response. - Test Apache directly. Run
curl -i -H 'Host: db.example.com' http://127.0.0.1:8080/. Confirm the correct virtual host and PHP response. - Test each public hostname. Use
curl -i https://app.example.com/andcurl -i https://db.example.com/. Verify status codes, redirects, and the response body. - Check forwarded values. Inspect application and Apache logs for the original host, client address, and HTTPS scheme. A redirect to HTTP usually means the upstream did not receive the forwarded protocol or is not configured to trust it.
- Exercise phpMyAdmin. Log in, reload, browse a table, and perform a harmless state-changing action. Repeated login prompts point to cookie or public-URL handling; a 404 after submission commonly indicates a path or absolute-URI mismatch.
- Review logs after every reload. Inspect NGINX’s error log, Apache’s error log, and the Node.js log separately. The first upstream error is usually more useful than the final browser message.
Troubleshooting common failures
| Symptom | Likely cause | Fix |
|---|---|---|
| NGINX fails with “address already in use” | Apache or another process still owns 80/443, or duplicate NGINX listeners exist | Use ss -ltnp, stop the competing service, and remove duplicate listen directives |
| 502 Bad Gateway for Node.js | Node.js is stopped, listening on another address/port, or blocked by a local policy | Curl port 3000 locally, verify the application bind settings, then inspect NGINX’s error log |
| 502 Bad Gateway for phpMyAdmin | Apache/container is down or NGINX targets the wrong private port | Curl port 8080 with the correct Host header and verify the container host-to-container map |
| Wrong Apache site appears | The forwarded Host does not match the Apache virtual host |
Set proxy_set_header Host $host and test the private listener with an explicit Host header |
| HTTPS redirects back to HTTP | The application believes the original request was HTTP | Forward X-Forwarded-Proto and configure the application or framework to trust the proxy |
| phpMyAdmin repeatedly asks for login | Cookie path, scheme, host, or absolute URL is wrong | Set the full external URL with a trailing slash, check secure-cookie settings, and retest through the public address |
| 404 after a phpMyAdmin form submission | Path prefix rewriting and phpMyAdmin’s externally visible URL disagree | Compare the browser request path, NGINX proxy_pass slash, Apache path, and PMA_ABSOLUTE_URI |
| WebSocket connection closes | Upgrade headers or HTTP/1.1 were not passed | Add the application-specific upgrade location and verify the handshake in browser tools and Node.js logs |
Operational and security practices
- Keep Apache and Node.js bound to loopback or a private network interface. Do not expose backend ports merely because NGINX is working.
- Use separate service accounts and least-privilege file permissions for the Node.js process, Apache, and phpMyAdmin configuration.
- Keep TLS certificates, HTTP-to-HTTPS redirects, and public security headers at NGINX, while preserving any application headers required by the upstream.
- Back up NGINX, Apache, PHP, and application configuration before changing listeners or proxy paths.
- Reload one service at a time and run its syntax check first: Apache’s configuration test, then
nginx -t, then the reload. - Monitor all three logs and alert on repeated 5xx responses, failed process restarts, and authentication anomalies in phpMyAdmin.
- Restrict phpMyAdmin by hostname, VPN, administrator allowlist, or an additional authentication layer when possible. A working reverse proxy does not make a database administration interface safe to expose without access control.
When to choose each design
Choose separate hostnames when
- You can create DNS records and certificates for both services.
- You want the simplest cookie and redirect behavior.
- Different teams or access policies apply to the application and database administration interface.
- You want logs and monitoring to identify the upstream from the hostname alone.
Choose a path-based deployment when
- A single public hostname is mandatory.
- You are prepared to test prefix rewriting, trailing slashes, cookies, redirects, and absolute links after every upgrade.
- The Node.js application and phpMyAdmin can coexist without conflicting assumptions about root-relative URLs.
In both models, the fundamental rule remains unchanged: NGINX owns the public ports, Apache and Node.js use distinct private listeners, and every upstream must know the URL and protocol that users actually see.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
