Deploying Next.js to a VPS: Self-hosting with Docker and Nginx

User → Domain → DNS → Nginx (Port 80/443)
                        ↓
                   Docker Network
                        ↓
              ┌─────────┴─────────┐
              ↓                   ↓
         Next.js App         PostgreSQL DB
        (Port 3000)         (Port 5432)

ssh root@your_server_ip
# or if you use a non-root user
ssh user@your_server_ip

sudo apt update && sudo apt upgrade -y

sudo apt install -y curl wget git build-essential

# Remove old versions
for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt-get remove $pkg; done

# Add Docker's official GPG key:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

# Install latest version
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Start Docker service
sudo systemctl status docker
sudo systemctl start docker

# Verify installation
docker --version

sudo usermod -aG docker $USER
newgrp docker

# Update package index
sudo apt update

# Install Nginx
sudo apt install nginx

# Verify installation
nginx -v

# Check firewall status
sudo ufw status

# If the firewall is not active, enable it
sudo ufw enable

# Allow OpenSSH (important – otherwise you may lock yourself out)
sudo ufw allow 'OpenSSH'

# Allow Nginx traffic
sudo ufw allow 'Nginx Full'
# Or allow HTTP/HTTPS separately:
# sudo ufw allow 'Nginx HTTP'
# sudo ufw allow 'Nginx HTTPS'

# Or allow by port:
# sudo ufw allow 80/tcp
# sudo ufw allow 443/tcp

# Verify firewall rules
sudo ufw status

# Check Nginx status
sudo systemctl status nginx

# If it's not running, start Nginx
sudo systemctl start nginx

# Enable Nginx to start automatically on reboot
sudo systemctl enable nginx

# Create a config file for your domain
sudo nano /etc/nginx/sites-available/your-domain.com

server {
    listen 80;
    listen [::]:80;

    server_name your-domain.com www.your-domain.com;

    # Logging
    access_log /var/log/nginx/your-domain.access.log;
    error_log /var/log/nginx/your-domain.error.log;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

# Create a symbolic link to enable the site
sudo ln -s /etc/nginx/sites-available/your-domain.com /etc/nginx/sites-enabled/

# Test Nginx config (important – check syntax)
sudo nginx -t

# If the test passes, reload Nginx
sudo systemctl reload nginx

# Remove default site (optional)
sudo rm /etc/nginx/sites-enabled/default

# Test configuration (always run before reload – very important)
sudo nginx -t

# If there are errors, check the error log
sudo tail -f /var/log/nginx/error.log

# View access log
sudo tail -f /var/log/nginx/access.log

git clone https://github.com/leerob/next-self-host.git
cd next-self-host

next-self-host/
├── app/                   # Next.js app directory
├── public/                # Static files
├── Dockerfile             # Container definition
├── docker-compose.yml     # Multi-container setup
├── deploy.sh              # Deployment script
├── update.sh              # Update script
├── next.config.ts         # Next.js configuration
├── package.json           # Dependencies
└── .env                   # Environment variables

FROM oven/bun:alpine AS base

# Stage 1: Install dependencies
FROM base AS deps
WORKDIR /app
COPY package.json bun.lockb ./
RUN bun install --frozen-lockfile

# Stage 2: Build the application
FROM base AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN bun run build

# Stage 3: Production server
FROM base AS runner
WORKDIR /app
ENV NODE_ENV=production
COPY --from=builder /app/public ./public
COPY --from=builder /app/.next/standalone ./
COPY --from=builder /app/.next/static ./.next/static

EXPOSE 3000
CMD ["bun", "run", "server.js"]

services:
    web:
        build: .
        ports:
            - "3000:3000"
        environment:
            - NODE_ENV=production
        depends_on:
            - db
        networks:
            - my_network

    db:
        image: postgres:latest
        environment:
            POSTGRES_USER: ${POSTGRES_USER}
            POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
            POSTGRES_DB: ${POSTGRES_DB}
        ports:
            - "5432:5432"
        volumes:
            - postgres_data:/var/lib/postgresql/data
        networks:
            - my_network

    cron:
        image: alpine/curl
        command: >
            sh -c "
              echo '*/10 * * * * curl -X POST http://web:3000/db/clear' > /etc/crontabs/root && \
              crond -f -l 2
            "
        depends_on:
            - web
        networks:
            - my_network

volumes:
    postgres_data:

networks:
    my_network:
        name: my_network
        driver: bridge

# Enter the PostgreSQL container
docker exec -it myapp-db-1 sh

# Install PostgreSQL client
apk add --no-cache postgresql-client

# Connect to the database
psql -U myuser -d mydatabase

# Create a table (example)
CREATE TABLE IF NOT EXISTS "todos" (
  "id" serial PRIMARY KEY NOT NULL,
  "content" varchar(255) NOT NULL,
  "completed" boolean DEFAULT false,
  "created_at" timestamp DEFAULT now()
);

# Install dependencies
npm install

# Run migrations
npm run db:migrate

# Or use Drizzle Studio
npm run db:studio

# Download the script
curl -o ~/deploy.sh https://raw.githubusercontent.com/leerob/next-self-host/main/deploy.sh

# Edit variables
nano ~/deploy.sh
# Change: EMAIL, DOMAIN_NAME

# Run the script
chmod +x ~/deploy.sh
./deploy.sh

#!/bin/bash

set -e

# Configuration
EMAIL="your-email@example.com"
DOMAIN="your-domain.com"
PROJECT_DIR="/opt/nextjs-app"

echo "Starting deployment..."

# Update system
apt update && apt upgrade -y

# Install Docker
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh

# Install Docker Compose
curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

# Install Nginx
apt install -y nginx

# Clone repository
git clone https://github.com/leerob/next-self-host.git $PROJECT_DIR
cd $PROJECT_DIR

# Generate SSL certificate
apt install -y certbot python3-certbot-nginx
certbot --nginx -d $DOMAIN --non-interactive --agree-tos -m $EMAIL

# Build and start containers
docker-compose build
docker-compose up -d

echo "Deployment completed!"

sudo apt install -y certbot python3-certbot-nginx

# Automatic configuration with Nginx
sudo certbot --nginx -d your-domain.com

# Or only generate the certificate
sudo certbot certonly --nginx -d your-domain.com

# Test renewal
sudo certbot renew --dry-run

# Check renewal status
sudo systemctl status certbot.timer

# /etc/nginx/nginx.conf
http {
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

    server {
        location /api {
            limit_req zone=api_limit burst=20 nodelay;
            proxy_pass http://localhost:3000;
        }
    }
}

server {
    # SSL configuration
    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Proxy settings
    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

# Install UFW (if not installed)
sudo apt install -y ufw

# Allow SSH
sudo ufw allow 22/tcp

# Allow HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable firewall
sudo ufw enable

# Check status
sudo ufw status

#!/bin/bash

set -e

cd /opt/nextjs-app

# Pull latest code
git pull origin main

# Rebuild containers
docker-compose build

# Restart services
docker-compose up -d

# Clean up old images
docker image prune -f

echo "Update completed!"

# Backup PostgreSQL
docker exec myapp-db-1 pg_dump -U myuser mydatabase > backup_$(date +%Y%m%d).sql

# Restore from backup
docker exec -i myapp-db-1 psql -U myuser mydatabase < backup_20250101.sql

# Check Docker containers
docker ps -a

# Check Docker logs
docker-compose logs --tail=100 web

# Check Nginx logs
sudo tail -f /var/log/nginx/error.log
sudo tail -f /var/log/nginx/access.log

# Check system resources
htop
df -h  # Disk space
free -h  # Memory

# Check network
sudo netstat -tulpn | grep :3000
sudo netstat -tulpn | grep :80

# Restart containers
docker-compose restart

# Rebuild containers
docker-compose build --no-cache
docker-compose up -d

# Check database container
docker-compose ps db

# Check database logs
docker-compose logs db

# Verify connection string
docker exec myapp-web-1 env | grep DATABASE_URL

# Manual renewal
sudo certbot renew

# Check certificate expiry
sudo certbot certificates