Tryboy869 DEPLOYMENT VPS — Production Setup
systemd Service
# /etc/systemd/system/myapp.service
[Unit]
Description=My FastAPI App
After=network.target postgresql.service redis.service
[Service]
Type=exec
User=myapp
Group=myapp
WorkingDirectory=/opt/myapp
EnvironmentFile=/opt/myapp/.env
ExecStart=/opt/myapp/venv/bin/uvicorn src.main:app \
--host 127.0.0.1 --port 8000 \
--workers 4 --no-access-log
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal
[Install]
WantedBy=multi-user.target
systemctl daemon-reload && systemctl enable --now myapp
Nginx Reverse Proxy + SSL
server {
listen 80;
server_name api.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name api.example.com;
ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_pass http://127.0.0.1:8000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 120s;
}
}
certbot --nginx -d api.example.com
Zero-Downtime Deploy Script
#!/bin/bash
set -e
APP_DIR=/opt/myapp
cd $APP_DIR
git pull origin main
source venv/bin/activate
pip install -r requirements.txt -q
alembic upgrade head
# Reload without downtime (systemd)
systemctl reload myapp || systemctl restart myapp
echo "✅ Deployed $(git rev-parse --short HEAD)"
Firewall (ufw)
ufw default deny incoming
ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
Forbidden
❌ Running app as root
❌ No SSL (plain HTTP)
❌ Exposing app port directly (bypass nginx)
❌ .env file world-readable (chmod 600 .env)
❌ No firewall
❌ git pull on production without migration