Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSelf-hosting Node-RED on a VPS is practical when you run it as a persistent Docker service, keep its /data directory on durable storage, and place the editor behind HTTPS or a private VPN. The safest baseline is a private Docker network for Node-RED and MQTT, no public broker port, adminAuth for the editor, and tested backups of the data directory.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a VPS gives your Node-RED project
Node-RED is a flow-based runtime for connecting MQTT devices, HTTP APIs, databases, dashboards and automation logic. A virtual private server supplies an always-on Linux machine in a cloud data centre, so flows continue running when your personal computer is shut down. You administer the server remotely rather than keeping a desktop session open.
As an Amazon Associate I earn from qualifying purchases.
The VPS is only the execution environment. You still have to secure the Node-RED editor, persist its files, control network exposure and maintain the operating system and containers. Node-RED’s cloud deployment guidance covers virtual-machine environments, including common public-cloud VM patterns; the same principles apply to a VPS from another provider.
The official Docker image is nodered/node-red. The container listens on port 1880 and stores user configuration, flows, credentials and installed nodes under /data. If that directory is not mounted outside the container, deleting or replacing the container can delete your project.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Recommended architecture
For most projects, use this layout:
- A supported Linux VPS with current security updates.
- Docker Engine and Docker Compose (the Compose plugin).
- One persistent volume or bind mount for Node-RED’s
/data. - A user-defined Docker network shared by Node-RED and the MQTT broker.
- No public MQTT listener unless outside devices genuinely need one.
- A reverse proxy terminating HTTPS, or a private VPN that keeps the editor off the public internet.
- Node-RED
adminAuth, plus route-specific protection where HTTP endpoints are exposed. - Automated backups and a restore test.
This arrangement separates public access from internal IoT traffic. A browser reaches the HTTPS endpoint; Node-RED reaches the broker by its Docker service name on the private network.
Decide how each layer should be exposed
| Decision | Preferred default | When to choose another option |
|---|---|---|
| Node-RED installation | Docker using nodered/node-red |
Use a native installation only when you need host-level integration, already manage Node.js services, or have a specific operational reason to avoid containers. |
| Editor access | Reverse proxy with HTTPS, or private VPN access | Bind port 1880 directly only for a tightly restricted, temporary administration path. |
| Node-RED storage | Named volume for simple container management | Use a bind mount when your backup, inspection or configuration tools require a normal host directory. |
| MQTT connectivity | Private Docker network and broker hostname such as mqtt |
Publish an MQTT port only when remote devices cannot use a VPN or another private route; then require TLS and broker authentication. |
| Authentication | adminAuth with a bcrypt password hash |
Add httpNodeAuth or httpStaticAuth for exposed HTTP-in routes and static content. |
Prepare the VPS
1. Provision and update the server
Choose a Linux image supported by your VPS provider and create a non-root administrative account. Connect over SSH, apply the distribution’s updates, and enable its host firewall. Allow SSH only from the addresses or VPN range you administer from. Allow TCP 80 and 443 only if a public reverse proxy will serve the site. Do not open TCP 1880 or the MQTT listener to the whole internet as a convenience.
Exact package commands differ by distribution and release, so follow your provider’s current Docker installation instructions for that operating system. Confirm that the Docker daemon starts at boot and that your administrative account can run Docker without routinely logging in as root.
2. Create an application directory
Keep Compose files, proxy configuration and operational notes in a dedicated directory, for example /opt/nodered. Restrict that directory because Compose files can contain broker credentials or other secrets. Do not commit those files, exported flows or credential files to a public repository.
Run Node-RED with Docker
Option A: a named volume
A named volume is managed by Docker and is convenient when the container is disposable. Create a private network and the volume, then start Node-RED:
docker network create iot-net
docker volume create nodered-data
docker run -d
--name nodered
--restart unless-stopped
--network iot-net
-p 127.0.0.1:1880:1880
-v nodered-data:/data
nodered/node-redThe loopback binding means only software on the VPS can reach port 1880. A reverse proxy on the same host can forward to it, while an administrator using a VPN can connect through a private interface. If you deliberately need direct external access, change the port binding only after firewall and authentication controls are in place; direct exposure should not be your security model.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Option B: a bind mount
A bind mount makes the files visible in a host directory and can simplify ordinary filesystem backups:
mkdir -p /opt/nodered/data
docker run -d
--name nodered
--restart unless-stopped
--network iot-net
-p 127.0.0.1:1880:1880
-v /opt/nodered/data:/data
nodered/node-redContainer permissions must be compatible with the directory ownership. If Node-RED cannot write flows or install nodes, inspect docker logs nodered and the host directory permissions before changing them broadly.
Option C: Docker Compose
Compose records the service definition so upgrades and restarts are repeatable. This example persists /data, places Node-RED on an internal network and publishes the editor only on loopback:
services:
nodered:
image: nodered/node-red
container_name: nodered
restart: unless-stopped
ports:
- "127.0.0.1:1880:1880"
volumes:
- nodered-data:/data
networks:
- iot-net
volumes:
nodered-data:
networks:
iot-net:
name: iot-netStart it from the directory containing the file with docker compose up -d. Check the result with docker compose ps and docker compose logs -f nodered. Add your MQTT broker as another Compose service on iot-net, or attach an existing broker container to that network. In Node-RED, use the broker’s service or container name (for example, mqtt) rather than an internet address. Docker’s internal name resolution then works without publishing the broker externally.
Recommended Free Tools
Make the editor reachable without making it public
Reverse proxy with HTTPS
Put a reverse proxy in front of Node-RED and forward its upstream connection to 127.0.0.1:1880. The proxy handles the public certificate and redirects HTTP to HTTPS. Preserve WebSocket support because the editor and dashboard can use long-lived connections. Restrict the proxy’s administrative location to your VPN or an allow-list when possible.
Use a DNS name that points to the VPS, obtain a certificate through your proxy’s supported certificate workflow, and verify that the browser shows HTTPS before entering credentials. Do not assume that a login page compensates for unencrypted transport: credentials and flow data can otherwise be intercepted.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Private VPN
A VPN is useful when only you, your team or devices on a private network need the editor. Bind Node-RED to the VPN interface or loopback, allow port 1880 only from the VPN range, and omit a public reverse-proxy route. This reduces the attack surface, but still enable adminAuth; a compromised VPN account should not automatically grant flow-editing access.
Direct port publishing
Publishing 1880 on the VPS’s public interface is the least forgiving option. Use it only when a reverse proxy or VPN is impossible, and then enforce firewall source restrictions, HTTPS configured in Node-RED, strong editor authentication and active monitoring. Never leave the default unsecured editor on a public address. The Node-RED security documentation states: “By default, the Node-RED editor is not secured – anyone who can access its IP address can access the editor and deploy changes.”
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Enable Node-RED security settings
Protect the editor and Admin API with adminAuth
Configure adminAuth in settings.js. Generate a bcrypt password hash with Node-RED’s administrative password-hash utility, then place the resulting hash in the settings file. Bcrypt is the recommended format; the security guide identifies older MD5 hashes as legacy.
adminAuth: {
type: "credentials",
users: [{
username: "admin",
password: "REPLACE_WITH_YOUR_BCRYPT_HASH",
permissions: "*"
}]
}Use a unique password and avoid storing the clear text value in Compose files, shell history or source control. Restart the container after changing settings and test both a failed login and a successful login. The same authentication protects the editor and Admin API, so an exposed API is not an overlooked back door.
Protect HTTP-in routes and static content
adminAuth does not automatically protect every endpoint created by your flows. If you expose HTTP-in routes, configure httpNodeAuth where appropriate. If you serve static files through Node-RED, configure httpStaticAuth when those files are not intended to be public. Decide separately which dashboard pages are public, private to users, or reachable only through the VPN.
Configure HTTPS directly when a proxy is not suitable
Node-RED can serve HTTPS itself through the https setting and certificate key/certificate material. A typical settings fragment is:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
const fs = require("fs");
https: {
key: fs.readFileSync("/data/certs/privkey.pem"),
cert: fs.readFileSync("/data/certs/fullchain.pem")
}Mount the certificate files into the container with permissions that prevent unrelated users from reading the private key. Plan certificate renewal and container restarts before the first certificate expires. If a reverse proxy already terminates HTTPS, do not create a confusing second public TLS endpoint; secure the proxy-to-Node-RED hop according to your trust boundary.
Protect credential encryption
Node-RED stores encrypted node credentials in its data directory. Keep the credential-encryption secret stable and out of public repositories. If you lose that secret or recreate it incorrectly, previously stored credentials may become unusable and nodes will require reconfiguration. Treat /data, settings.js and any secret environment files as sensitive backups.
Connect Node-RED to MQTT securely
Keep the broker private by default
Place the broker and Node-RED on the same user-defined Docker network. In the Node-RED MQTT configuration, set the server host to the broker’s Compose service name, such as mqtt, and use the broker’s internal listener. Do not add a host port mapping for MQTT unless a device outside the Docker network must connect directly.
For devices outside the VPS, prefer a private network or VPN. If public MQTT is unavoidable, expose only the TLS listener, require broker usernames and strong passwords, restrict client permissions by topic, and apply firewall source controls. Disable anonymous access. Node-RED’s broker credentials should be stored in its encrypted credential store rather than in a flow’s plain-text function code.
Use TLS between Node-RED and the broker when required
Configure the MQTT node’s TLS options with the broker’s trusted CA and, when used by the broker, a client certificate and private key. Validate the broker hostname against its certificate and avoid “insecure” certificate-validation switches in production. Keep CA and client-key files in protected mounted storage, and rotate them according to the broker’s certificate policy.
Test the path before building automations
- Confirm both containers are attached to the same Docker network.
- From the Node-RED MQTT configuration, use the broker service name, not
localhost. Inside the Node-RED container,localhostrefers to Node-RED itself. - Deploy a small test flow that subscribes to one non-critical topic and displays the most recent message.
- Publish a test message from an authorized client and verify that it arrives.
- Stop the broker and confirm that Node-RED reports a disconnect; restart it and verify reconnection without duplicating unsafe actions.
Persist, back up and restore the project
Node-RED’s Docker documentation describes /data as the directory that stores user configuration data. Mounting it is therefore mandatory for a disposable-container design. Back up the complete mounted directory, not just an exported flow: installed nodes, settings, credential metadata and project files may all matter.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Bind-mount backup
For a bind mount, stop Node-RED briefly for a consistent file-level archive, then create an encrypted backup with your normal backup system:
docker stop nodered
tar -czf /secure-backups/nodered-data-$(date +%F).tar.gz -C /opt/nodered data
docker start noderedProtect the archive because it can contain credentials and private automation details. Copy backups off the VPS and retain several restore points.
Named-volume backup
For a named volume, create a temporary container that mounts the volume and writes an archive to a host directory. The exact command should match your backup storage and permissions; verify that the archive contains files under /data, not an empty mount created by a typo.
Test restoration
- Provision a disposable Docker host or an isolated directory.
- Restore the archive into a new volume or bind mount.
- Start the same Node-RED image and mount the restored data at
/data. - Check that flows, installed nodes, settings and encrypted credentials load.
- Verify MQTT connectivity with a harmless test topic.
- Record the image version, settings changes and any manual steps needed for a real outage.
Updating and operating the service
Pin an image tag or document the tag you deployed rather than changing versions accidentally during an unrelated restart. Before an upgrade, back up /data, read the Node-RED and installed-node compatibility notes, then pull the new image and recreate the container:
docker pull nodered/node-red
docker compose up -dWith Compose, inspect the rendered configuration and container status after recreation. Review logs for failed node loads, permission errors, credential warnings and MQTT reconnect loops. Keep the previous image available until the restored service has passed its smoke tests.
Free tools Windows power users keep installed
One-click scans. No signup required.
Monitor disk usage, memory pressure, container restarts and certificate expiry. Set log rotation so a noisy device or reconnect loop cannot fill the VPS filesystem. Apply operating-system security updates on a schedule and restrict SSH keys and administrative access.
Common failure modes and fixes
| Symptom | Likely cause | Action |
|---|---|---|
| Flows disappear after recreation | /data was not mounted, or the mount path changed. |
Stop the container, inspect its mounts, restore the correct named volume or host directory, and recreate only after verifying the data. |
| Editor works locally but not through the domain | Proxy upstream, firewall, DNS or WebSocket configuration is wrong. | Test curl against loopback, inspect proxy logs, confirm DNS points to the VPS, and enable WebSocket forwarding. |
| Anyone can edit flows | adminAuth is absent or settings were not loaded. |
Check the mounted settings.js, container logs and restart result; keep port 1880 private until authentication is confirmed. |
MQTT node cannot connect to localhost |
Inside a container, localhost is the Node-RED container. |
Use the broker’s Docker service name and ensure both services share a user-defined network. |
| MQTT is reachable from the internet unexpectedly | A broker port was published or a firewall rule is too broad. | Remove the host port mapping, close the firewall port, and use a VPN or TLS listener only when external access is necessary. |
| Node-RED cannot write files | Host-directory ownership or permissions do not match the container process. | Inspect the error and directory ownership; grant only the required access rather than making the directory world-writable. |
| Credentials fail after migration | The data directory or credential-encryption secret was not preserved. | Restore the original complete /data and stable secret, then re-enter credentials only if recovery is impossible. |
Docker versus native installation
Docker makes replacement, rollback and network isolation straightforward. The trade-off is another layer to monitor: Docker storage, image updates, container permissions and Compose configuration. A native Node.js installation removes the container layer and can integrate directly with host services, but you must manage Node.js versions, process supervision, package upgrades and filesystem permissions yourself. For a new VPS deployment with an MQTT broker, Docker is usually the easier boundary to reproduce and back up.
Quick Recap
A pre-launch checklist
- Linux updates and firewall rules are applied.
- Node-RED runs from
nodered/node-redwith/datapersisted. - The container restarts after a reboot.
- Port 1880 is loopback-only or restricted to a private VPN.
- HTTPS is verified at the domain, or Node-RED HTTPS is configured with protected certificate files.
adminAuthuses a bcrypt hash and a unique password.- Exposed HTTP-in and static routes have their own controls.
- MQTT uses a private Docker network, TLS where required and authenticated clients.
- Secrets are absent from public repositories and plain-text flow code.
- Backups are encrypted, stored off the VPS and restored successfully in a test.
- Logs, disk space, restarts and certificate expiry are monitored.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
