Run Flask behind two separate layers: Gunicorn loads your WSGI application on a private loopback address or Unix socket, while Nginx owns the public HTTP/HTTPS endpoint, TLS termination, request buffering and proxy headers. A systemd unit keeps Gunicorn running across failures and reboots. The sequence below gives you a reproducible Ubuntu deployment, including header trust, HTTPS, socket activation and recovery checks.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the production stack does
Flask’s built-in development server is intended for development, not as the internet-facing edge. Gunicorn is the application server that imports your Flask callable and runs worker processes. Nginx is the reverse proxy that accepts connections from browsers and game clients, serves static content when appropriate, terminates TLS, and forwards dynamic requests to Gunicorn. Gunicorn’s documentation states: “We strongly recommend running Gunicorn behind a proxy server.”
As an Amazon Associate I earn from qualifying purchases.
Keep the application server private. Bind Gunicorn to 127.0.0.1:8000 or a Unix socket, allow Nginx to reach it, and do not expose port 8000 to the internet. Nginx should pass the original host, protocol and client address in forwarded headers; Flask must trust those headers only when requests can arrive through your own proxy.
Prepare Ubuntu and the application
Install the operating-system packages
Use a current supported Ubuntu release and an account with sudo access. Install Python, virtual-environment support, a compiler toolchain for packages that need native builds, and Nginx:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
sudo apt update
sudo apt install python3 python3-venv python3-pip build-essential nginxCreate a dedicated, non-root account for the service. The account should own the application files but should not be used for interactive administration:
sudo adduser --system --group --home /srv/myapp flask
sudo mkdir -p /srv/myapp
sudo chown -R flask:flask /srv/myappIf your distribution already has an application account, use that account consistently in the virtual environment, systemd unit and file permissions. Do not run Gunicorn as root merely to bind a privileged port; Nginx can listen on ports 80 and 443 instead.
Create the virtual environment and install dependencies
sudo -u flask python3 -m venv /srv/myapp/.venv
sudo -u flask /srv/myapp/.venv/bin/pip install --upgrade pip
sudo -u flask /srv/myapp/.venv/bin/pip install flask gunicorn
sudo -u flask /srv/myapp/.venv/bin/pip install -r /srv/myapp/requirements.txtPut production secrets in a root-readable environment file or a secret-management system, not in Git or the application source tree. Restrict an environment file so only root and the service account can read it:
sudo install -o root -g flask -m 0640 /dev/null /etc/myapp.envSet values such as the database URL, signing key and external API credentials there. Keep debug mode disabled in production.
Verify the Flask import target with Gunicorn
Gunicorn needs an import target in the form module:app. If wsgi.py contains app = Flask(__name__), the target is wsgi:app. If your project uses an application factory, use the factory form supported by your Gunicorn version, for example myproject:create_app().
Test on loopback before adding Nginx
cd /srv/myapp
sudo -u flask /srv/myapp/.venv/bin/gunicorn --bind 127.0.0.1:8000 wsgi:appFrom a second shell on the server, request the application:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
curl --fail http://127.0.0.1:8000/A successful response proves that Python can import the target and that the app starts outside Flask’s development server. Stop this foreground process with Ctrl+C after the check. The commonly shown -w 4 option is an example, not a universal worker-size recommendation; choose workers only after considering workload, memory and measured behavior.
Run Gunicorn under systemd
A systemd service supplies a stable working directory, identity, restart policy and boot-time startup. Create /etc/systemd/system/gunicorn.service:
[Unit]
Description=Gunicorn service for my Flask application
After=network.target
[Service]
Type=notify
User=flask
Group=flask
WorkingDirectory=/srv/myapp
EnvironmentFile=-/etc/myapp.env
ExecStart=/srv/myapp/.venv/bin/gunicorn --workers 3 --bind 127.0.0.1:8000 wsgi:app
ExecReload=/bin/kill -s HUP $MAINPID
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetChange the worker count, import target and paths to match your application. Type=notify lets Gunicorn report readiness to systemd; ExecReload performs a graceful configuration or code reload. The service remains unprivileged and listens only on loopback.
Enable, start and inspect the service
sudo systemctl daemon-reload
sudo systemctl enable --now gunicorn.service
sudo systemctl status gunicorn.service
curl --fail http://127.0.0.1:8000/For a failed start, read the journal rather than guessing:
sudo journalctl -u gunicorn.service -n 100 --no-pager
sudo journalctl -u gunicorn.service -fTypical causes are a wrong module:app target, a missing dependency, an unreadable environment file, a port already in use, or a working directory that does not contain the package.
Choose a Gunicorn transport: loopback TCP or Unix socket
| Transport | Configuration | Operational trade-off |
|---|---|---|
| Loopback TCP | 127.0.0.1:8000 in Gunicorn and proxy_pass http://127.0.0.1:8000 in Nginx |
Simplest to understand and debug; the kernel protects it from remote clients when bound to loopback. |
| Unix socket | A path such as /run/gunicorn.sock in both services |
Avoids a TCP port and is efficient locally, but requires correct socket ownership and filesystem permissions. |
Use loopback TCP for the first deployment unless you specifically need a socket. A socket is useful when you want systemd socket activation or prefer filesystem access control.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Optional: systemd socket activation
Socket activation lets systemd create the listening socket at boot and start Gunicorn when the socket is used. Create /etc/systemd/system/gunicorn.socket:
[Unit]
Description=Gunicorn socket
[Socket]
ListenStream=/run/gunicorn.sock
SocketUser=flask
SocketGroup=www-data
SocketMode=0660
[Install]
WantedBy=sockets.targetUse a matching service whose command binds the inherited socket path:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
[Unit]
Description=Gunicorn service for my Flask application
Requires=gunicorn.socket
After=network.target
[Service]
Type=notify
User=flask
Group=flask
WorkingDirectory=/srv/myapp
EnvironmentFile=-/etc/myapp.env
ExecStart=/srv/myapp/.venv/bin/gunicorn --workers 3 --bind unix:/run/gunicorn.sock wsgi:app
ExecReload=/bin/kill -s HUP $MAINPID
Restart=on-failure
[Install]
WantedBy=multi-user.targetThe Nginx worker must be able to open the socket. Because the socket above belongs to group www-data with mode 0660, add Nginx’s account to the appropriate group only if your Ubuntu layout requires it, then restart the affected service.
sudo systemctl daemon-reload
sudo systemctl enable --now gunicorn.socket
sudo systemctl status gunicorn.socket
gcurl='curl --unix-socket /run/gunicorn.sock http://localhost/'Run the request directly with curl --unix-socket /run/gunicorn.sock http://localhost/; the assignment above is only a shell variable example and is not required. If the socket is absent, inspect systemctl status gunicorn.socket and verify the /run path, ownership and service dependency.
Configure Nginx as the reverse proxy
HTTP server block for loopback TCP
Create a site file such as /etc/nginx/sites-available/myapp. Replace the example domain with the hostname users will actually request:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location / {
proxy_pass http://127.0.0.1:8000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_read_timeout 60s;
}
}The trailing slash behavior of proxy_pass matters when a URI is supplied. The form above forwards the original request path unchanged. If you use a Unix socket instead, change only the upstream line to proxy_pass http://unix:/run/gunicorn.sock: and retain the headers.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Enable and validate the site
sudo ln -s /etc/nginx/sites-available/myapp /etc/nginx/sites-enabled/myapp
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx
curl --head http://example.com/Always run nginx -t before a reload. A syntax error leaves the current configuration in place; a successful test followed by reload applies the new server block without dropping existing connections. If the default page appears, check the symlink, server_name, DNS and whether another server block is matching first.
Preserve the real host, protocol and client IP safely
Nginx changes the network peer seen by Flask, so the application otherwise sees Nginx’s address rather than the original client. The forwarded headers communicate the original request context:
Hostsupports correct host-based routing and URL generation.X-Forwarded-Prototells Flask whether the public request was HTTP or HTTPS.X-Forwarded-Forcarries the client address through the proxy chain.X-Real-IPis a commonly used single-address equivalent for application logging.
Do not trust these headers from arbitrary internet traffic. Gunicorn must be unreachable except through Nginx, and Flask should apply proxy-header middleware with a trust count that matches your topology. For a single Nginx hop, a typical configuration is:
from werkzeug.middleware.proxy_fix import ProxyFix
app.wsgi_app = ProxyFix(
app.wsgi_app,
x_for=1,
x_proto=1,
x_host=1,
x_port=1,
x_prefix=1,
)Use only the header fields your proxy sets and only the number of trusted hops that actually exist. If clients can connect directly to Gunicorn, they can forge these values and influence secure-URL generation, redirects, logging or access controls. Restrict the bind address, firewall rules and any cloud security group so that the trust assumption remains true.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Add DNS and HTTPS at Nginx
Point the domain to the Ubuntu host
Create the required DNS records for the real hostname and wait for them to resolve to the server’s public address. Test from the server and an external network:
getent hosts example.com
curl --head http://example.com/Do not publish the private Gunicorn port in DNS. Public traffic should terminate at Nginx on ports 80 and 443.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Install a certificate and split HTTP from HTTPS
Use a current ACME client or certificate provider appropriate for your domain. Keep the certificate and private key readable only by the accounts that need them. Once certificates exist, add a TLS server block on port 443 and redirect the clear-text block:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Use the paths issued by your certificate client. Reload only after nginx -t succeeds. With X-Forwarded-Proto and the Flask proxy configuration aligned, redirects and generated links use HTTPS instead of incorrectly downgrading to HTTP.
Free tools Windows power users keep installed
One-click scans. No signup required.
Firewall and security checklist
- Allow inbound TCP 80 and 443 if you need HTTP redirection and HTTPS.
- Do not allow inbound TCP 8000; Gunicorn is bound to loopback for this reason.
- Run the service as the dedicated application account, never root.
- Keep secrets outside source control and restrict their file permissions.
- Disable Flask debug mode and interactive debugger exposure.
- Use a narrow proxy-header trust configuration that reflects the actual number of trusted proxies.
- Keep Ubuntu, Python dependencies, Nginx and Gunicorn patched, with a rollback path for application releases.
Validate the complete request path
- Check the application directly:
curl --fail http://127.0.0.1:8000/, or use the Unix-socket curl command if you selected socket activation. - Check Gunicorn supervision:
systemctl is-active gunicorn.serviceandjournalctl -u gunicorn.service -n 100 --no-pager. - Check Nginx syntax:
sudo nginx -t. - Reload Nginx and request the public hostname with
curl -I http://example.com/orcurl -I https://example.com/. - Inspect Nginx’s error log and the Gunicorn journal together when a request returns 502, 504 or 500.
- Confirm that application logs record the expected client address and scheme only after proxy trust has been configured.
Diagnose common failures
| Symptom | Likely cause | Check |
|---|---|---|
| 502 Bad Gateway | Gunicorn stopped, wrong bind, wrong socket permissions or mismatched proxy_pass |
systemctl status gunicorn, the Gunicorn journal, and ss -ltnp or ls -l /run/gunicorn.sock |
| 502 after switching to a socket | Nginx cannot read the socket | Compare socket owner, group and mode with the Nginx worker account. |
| 404 or a default Nginx page | Wrong server_name, disabled site or DNS still points elsewhere |
nginx -T, enabled-site symlinks and DNS resolution. |
| Redirect loop or HTTP links on HTTPS | Missing or untrusted X-Forwarded-Proto |
Verify Nginx sets the header and Flask trusts exactly one known proxy hop. |
| Gunicorn exits immediately | Import error, missing package, invalid environment or permission problem | Run the same ExecStart command as the service user and read journalctl. |
| Real client IP is always Nginx | Forwarded headers are absent or Flask is not applying proxy middleware | Inspect Nginx configuration and the Flask WSGI middleware settings. |
One service or socket activation?
A single enabled Gunicorn service is the operationally simplest choice: it starts at boot, owns its loopback listener and is easy to inspect with one unit. Socket activation adds a second unit and permission surface but gives systemd ownership of the listening endpoint and can start the service on demand. Choose socket activation when that lifecycle behavior is valuable; otherwise, the ordinary service is easier to maintain.
Self-managed Ubuntu or a hosted platform?
Running Ubuntu yourself gives control over Nginx, networking, packages, deployment hooks and background workers, but you must maintain operating-system updates, firewall rules, DNS, certificates, monitoring and recovery. A hosted Python platform can remove much of that server and network work at the cost of provider-specific limits and less low-level control. Flask’s deployment guidance names PythonAnywhere, Google App Engine, Google Cloud Run, AWS Elastic Beanstalk and Microsoft Azure as examples of hosted alternatives. The same Flask application can often be adapted to those services, but their build, logging, TLS and scaling procedures are different from the systemd-and-Nginx process described here.
Release and maintenance workflow
- Deploy code and dependency changes into a new release directory or controlled working tree.
- Install dependencies into the virtual environment and run migrations or smoke tests using the service account.
- Run Gunicorn manually against the new import target before switching traffic.
- Update the systemd service only when paths, environment values and permissions are correct.
- Use
systemctl reload gunicornfor a graceful Gunicorn reload when supported by your release process; restart when a full process replacement is required. - Run
nginx -tbefore every Nginx reload and keep the previous configuration available for rollback. - After deployment, test both the public HTTPS URL and a representative authenticated or API endpoint, then inspect service and proxy logs.
This arrangement keeps the public edge, TLS policy and client metadata in Nginx while Gunicorn concentrates on executing Flask code under a supervised, least-privileged account.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
