October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
VGSources
Blog

How to Set Up a Serf Cluster on Multiple Ubuntu VPS Servers

Install one Serf agent per Ubuntu VPS, open TCP and UDP 7946, use the WAN profile for Internet links, share one encryption key, and configure retry joins and snapshots for resilient membership.
Length10 min Posted Quest giverVGSources Team

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

To build a Serf cluster across Ubuntu VPS servers, run one Serf agent per server, give every agent a unique node name, allow both TCP and UDP traffic on gossip port 7946, and start each new agent with at least one existing member address. Use the wan timing profile for servers separated by the public Internet, protect the cluster with one shared encryption key, and configure snapshots plus retry joins so membership survives restarts.

The procedure below starts with a single seed node, adds additional VPS instances, verifies membership, and then hardens the deployment for reboots, network failures, event automation, and key management.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What the cluster looks like

Serf is a decentralized, masterless membership and event system. It can provide service discovery, failure detection, deployment events, configuration propagation, and DNS-update triggers without electing a membership leader. Every Ubuntu VPS runs an agent, and the agents exchange membership state through gossip.

A seed agent can start by itself. A joining agent must be given the address of at least one member that is already running. After a successful contact, Serf performs a full state synchronization with that member over TCP and then disseminates membership changes through UDP gossip. The result is a cluster in which no single server is required for ordinary membership operation.

#1 Best Overall
Sale
Gaoye Blue Light Blocking Glasses
  • BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
  • EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
  • COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
  • LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
  • WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.

Minimum topology

Use three or more VPS servers when you need a meaningful failure-tolerant deployment. Each server should have:

  • A stable hostname and a unique Serf node name.
  • A private address when the hosting environment provides one.
  • A public, routable address when members communicate across providers or isolated networks.
  • The same Serf version and compatible protocol settings.
  • A writable directory for configuration, logs, and snapshots.
  • Cloud security-group rules and host-firewall rules that permit TCP and UDP on the selected gossip port between members.
  • A securely delivered copy of the cluster encryption key.

Ubuntu release availability, package names, and support windows change over time. Treat the Ubuntu Server documentation for your chosen release as the platform reference rather than assuming a particular Serf package is available through apt.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Plan addresses, names, and ports before installing

Choose names that remain unique if a machine is rebuilt. For example, use serf-ubuntu-1, serf-ubuntu-2, and serf-ubuntu-3. The node name is Serf identity; changing it after a replacement creates a new member from Serf’s perspective.

Traffic Default endpoint Why it is needed
Gossip and state transfer TCP 7946 TCP state synchronization and reliable cluster communication
Gossip dissemination UDP 7946 Membership and event gossip between agents
Local RPC 127.0.0.1:7373 Local administration and CLI queries

Serf uses the same configured gossip port for TCP and UDP. Opening only TCP 7946 is incomplete. If you select another gossip port, substitute that port consistently in both protocols, the agent flags, firewall rules, and join addresses.

Bind versus advertise

-bind is the local interface and port on which the agent listens. -advertise is the address and port that peers should use. A common VPS mistake is binding to a private interface while advertising that same private address to peers on another provider. If peers cannot route to the private address, set -advertise to the reachable public address and port while retaining the appropriate local bind address.

Keep the RPC listener on loopback unless remote administration is explicitly required. The documented default is 127.0.0.1:7373; exposing it publicly adds an unnecessary administration surface.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)
  • WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
  • AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
  • PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
  • ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
  • COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed

Install Serf on every Ubuntu VPS

Obtain the Linux release binary from Serf’s current release channel, verify it using the release instructions for that version, and place it in a directory on PATH on every server. The available official installation guidance describes either downloading a pre-built binary or compiling with Go. It does not establish a current Ubuntu apt package name, so do not treat an unverified package command as the canonical installation method.

After installation, check the executable on each server and record the version. Keep the versions aligned before attempting to form the cluster; version or protocol differences can produce confusing join and authentication failures.

command -v serf
serf version

Create the service account, configuration location, log location, and snapshot directory according to your operating policy. Ensure the account that will run Serf can read its configuration and key material and can write snapshots and logs.

Generate and distribute the encryption key

Serf’s security model uses a symmetric shared secret to provide confidentiality, integrity, and authentication. Generate one key for the cluster with the Serf key-generation command, then deliver the resulting base64 value through a secret-management channel rather than copying it through chat, shell history, or an unprotected ticket.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
serf keygen

Store the key in an environment file or another protected secret mechanism readable only by the Serf service account. Every member must use exactly the same key with -encrypt. A mismatched, truncated, or incorrectly copied key causes immediate authentication or decryption errors.

When rotating keys, use Serf’s documented keyring-file mechanism and follow a staged rotation procedure appropriate to the release you installed. Do not replace the key independently on one node and expect that node to remain connected.

Rank #3
Sale
LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men
  • Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
  • Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
  • Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
  • ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
  • Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)

Open the network path in both directions

Configure the cloud security group or provider firewall and the operating-system firewall on every VPS. Permit TCP 7946 and UDP 7946 only between the addresses that should be Serf members. If nodes use public addresses, restrict the source ranges to the other members’ public addresses instead of opening the port to the entire Internet.

A simple host-firewall policy should include two separate rules, one for each transport. For systems using UFW, the pattern is:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo ufw allow from MEMBER_SOURCE_CIDR to any port 7946 proto tcp
sudo ufw allow from MEMBER_SOURCE_CIDR to any port 7946 proto udp

Replace MEMBER_SOURCE_CIDR with the actual private or public source range and mirror the policy on each member. Apply equivalent rules in your provider’s security-group interface. Test reachability in both directions from every server before diagnosing Serf itself; a one-way rule or a stale security-group attachment can look like a membership failure.

Start the first (seed) agent

The first agent can start without a join target. It becomes the initial member that later agents contact. For Internet-spanning VPS instances, use the WAN timing profile. LAN timing assumes faster, more stable paths and can mark healthy Internet peers as failed during normal latency or packet loss.

serf agent -node=serf-ubuntu-1 -bind=10.0.0.11:7946 -advertise=203.0.113.11:7946 -profile=wan -encrypt=$SERF_ENCRYPT_KEY -rpc-addr=127.0.0.1:7373 -snapshot=/var/lib/serf/snapshot

Replace the example private and public addresses with the real addresses for the first VPS. The SERF_ENCRYPT_KEY environment variable must contain the protected key. Create the snapshot directory first and make it writable by the service account.

If all members share a private network with predictable, low-latency links, a LAN profile may be appropriate. For nodes distributed across providers or regions, the explicit wan profile is the safer choice.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack
  • Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
  • Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
  • 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
  • Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
  • USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC

Join the remaining VPS servers

Each additional agent needs a unique node name, its own bind and advertise addresses, the same gossip port, the same encryption key, and at least one seed address. Use multiple retry targets where possible so a single unavailable seed does not become a permanent bootstrap dependency.

serf agent -node=serf-ubuntu-2 -bind=10.0.0.12:7946 -advertise=203.0.113.12:7946 -profile=wan -encrypt=$SERF_ENCRYPT_KEY -retry-join=203.0.113.11:7946 -retry-join=203.0.113.13:7946 -retry-max=0 -rpc-addr=127.0.0.1:7373 -snapshot=/var/lib/serf/snapshot

Run an equivalent command on the third VPS, changing the node name, bind address, advertise address, and retry targets. -retry-join keeps attempting to contact a seed after a temporary outage. -retry-max=0 means keep retrying rather than stopping after a finite number of attempts.

Do not list an address that is not routable from the joining VPS. If a seed is reachable only through a private network, use its private address; if the members cross provider boundaries, use the appropriate public address and permit it through both layers of firewall.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Run Serf under systemd for reboot persistence

Interactive shell sessions are useful for the first test but are not a production process supervisor. Run the agent under systemd or another service manager with a dedicated unprivileged account. Configure restart-on-failure and make the service wait for network readiness.

A practical arrangement has three files:

  • An environment file containing the encryption key, readable only by the Serf service account.
  • A systemd unit whose ExecStart contains the agent flags and whose Restart policy restarts an unexpectedly terminated process.
  • A writable snapshot directory owned by the service account.

The unit should express an ordering dependency on network readiness, start after the network is considered online, and stop cleanly through the service manager. Keep the exact unit implementation aligned with your distribution’s systemd conventions; Serf documents the agent flags, not one canonical Ubuntu unit file.

Use -snapshot to retain recovery information across restarts. Add -rejoin when a node should attempt to return after a previous leave state rather than remaining absent. Configure leave_on_terminate where graceful service-manager shutdown is desirable. Snapshot and tag files contain cluster recovery state, not application data; back them up only when your operational policy requires it.

Best Value
Sale
HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs
  • Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
  • Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
  • Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
  • Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
  • Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Verify membership before adding automation

Query the local agent on each VPS before configuring event handlers or application changes:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
serf members
serf info
serf monitor -log-level=info

The expected membership output contains one alive entry for every intended member, with the address and port you expect. The monitor output should show join activity without recurring authentication, transport, or failure messages.

  1. Run serf members on every node and compare the names, states, addresses, and ports.
  2. Use serf info to inspect local agent and protocol information.
  3. Run serf monitor -log-level=info while starting a joining node to observe the join event.
  4. If a member remains failed or never appears, inspect the Serf log, cloud security-group logs, and host-firewall logs.
  5. Confirm the same encryption key, gossip port, profile, and protocol-compatible version on every server.

Do not automate deployments, failover actions, or service reconfiguration until the membership view is stable and matches the addresses you intended to advertise.

Add tags and event handlers safely

Tags publish metadata that other agents can use to select nodes. You can set tags such as -tag role=web and -tag role=db, or manage them through a tags file. Tags are disseminated by gossip and can be changed on reload.

Event handlers can react to member joins, leaves, failures, and user events. Filter each handler by event type and role. For example, a handler intended to update web backends should not run database maintenance on a node merely because both roles are present in the same cluster. Treat handlers as distributed code: make them idempotent, log their decisions, and tolerate duplicate or delayed notifications.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

User-event size and delivery

Serf user events travel through the gossip layer over UDP. The documented hard limit for the complete user-event framing is 9 KB. Keep payloads comfortably below that limit and send large data through an authenticated external system instead of embedding it in the event.

Gossip is eventually consistent, not a transactional queue. A handler may receive an event later than another member, may see duplicates, or may miss an action during a prolonged outage. Design the handler so that reapplying the same event is safe and so that the resulting state can be reconciled from an authoritative system.

Troubleshoot common failures

Symptom Checks Correction
No members appear Verify the seed process, both TCP and UDP 7946, advertised addresses, cloud rules, and host-firewall rules. Correct the route or firewall in both directions, then restart or retry the joining agent.
Immediate authentication or decryption errors Compare the key source, byte-for-byte value, and environment-file permissions on every node. Regenerate or securely recopy one shared key and restart all affected agents using that key.
Nodes repeatedly change to failed and alive Check whether members are separated by public Internet links while using LAN timing. Set -profile=wan consistently for the Internet-spanning cluster and observe logs again.
A rebooted node stays absent Check that the snapshot path is writable, the service starts after network readiness, and a seed is available. Use -retry-join, retain the snapshot, and add -rejoin when prior leave state should not block re-entry.
Handlers run on the wrong machines Inspect role tags and event-handler filters. Use explicit tags and narrow handlers by event and role.
Events fail or disappear Check the complete event framing size and remember that transport is UDP gossip. Keep the payload below the 9 KB hard limit, make handlers idempotent, and move large content to an authenticated external service.

Address advertisement errors

If logs show that a node joins but peers cannot contact it afterward, inspect the address printed by serf members. An advertised private address that is unreachable from another provider is the usual cause. Correct -advertise to the routable interface and ensure the corresponding public port is allowed by both firewall layers.

Operational checklist

  • Every agent has a distinct, stable node name.
  • All members run a compatible Serf version and use the same gossip port.
  • TCP and UDP 7946 are allowed between the actual member addresses.
  • Bind addresses match local interfaces, while advertise addresses are routable by peers.
  • Internet-spanning members use the wan profile.
  • The same encryption key is delivered as a protected secret to every service account.
  • RPC remains on loopback unless remote administration is intentional and separately protected.
  • Snapshots and tags are stored in writable, service-owned paths.
  • Joining agents have at least one seed and preferably multiple -retry-join targets.
  • Systemd or another service manager starts Serf after network readiness and restarts it after failure.
  • Membership is verified with serf members, serf info, and agent logs before automation is enabled.
  • Event handlers are filtered by role and event, tolerate duplicates, and keep user-event payloads below 9 KB.

Result

A reliable multi-VPS Serf deployment is mostly disciplined identity, routing, and lifecycle management: one agent per server, a reachable TCP-and-UDP gossip path, WAN-aware failure timing, one protected shared key, and retry-plus-snapshot settings for restarts. Once every node reports the expected alive membership and the logs show stable joins, you can safely build discovery and event-driven automation on top of the cluster.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More quests from Patch Notes

  1. How to Set Up a RedM (RDR2) Server in 2026: License Key, txAdmin and server.cfg, Step by StepBlog11min
  2. Best RedM (RDR2) Server Hosting in 2026: Comparing Four Hosts on Slots, Memory and PriceBlog10min
  3. How to Host a Mindustry Server in 2026: server-release.jar, Port 6567 and the Commands That MatterBlog7min
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.