iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The dependable production path is Sinatra application → Puma → systemd → nginx → HTTPS. Sinatra supplies the Rack application, Puma supplies the web-server process and concurrency, systemd keeps Puma running, nginx is the public reverse proxy, and Certbot obtains and renews a Let’s Encrypt certificate. This guide takes you from a fresh Ubuntu VPS to a verified HTTPS deployment, using least-privilege accounts, a reproducible Ruby environment, and a firewall that exposes only the ports you need.
What the production stack does
Sinatra is a Rack application framework; it does not impose a concurrency model. The Rack handler you choose, commonly Puma (or another Rack server such as Falcon), owns the listening socket and request concurrency. In production, avoid treating ruby app.rb as a complete operations strategy. Run Puma in the foreground under a supervisor, keep it private to the VPS, and let nginx handle public HTTP concerns.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Layer | Responsibility | Typical address |
|---|---|---|
| Sinatra | Routes, middleware, views, and application code | Loaded through config.ru |
| Puma | Rack server process and concurrency | Loopback TCP port or Unix socket |
| systemd | Boot start, restart policy, identity, logs | Application service unit |
| nginx | Public listener and reverse proxy | Ports 80 and 443 |
| Certbot/Let’s Encrypt | Certificate issuance and renewal | HTTPS for your domain |
Prerequisites and decisions
- An Ubuntu VPS with a public IPv4 address (and IPv6 if you intend to serve it).
- SSH access that you will keep available while changing accounts and firewall rules.
- A registered domain whose DNS can point to the VPS before certificate issuance.
- A Sinatra project with a
Gemfileand committedGemfile.lock. - A supported Ruby release. Sinatra 4.0.0 does not support Ruby versions earlier than 2.7.8; check the Sinatra project’s current compatibility statement when selecting your exact release.
- A planned application directory such as
/srv/myapp, and a separate Linux account for the service.
Choose your bind method before writing the service and nginx configuration. A loopback TCP listener is simple to inspect and works well for a single app. A Unix socket avoids a TCP port and can be restricted by filesystem permissions, but both Puma and nginx must use exactly the same socket path and ownership.
1. Prepare Ubuntu securely
Create an administrative account without using root routinely
Keep your current SSH session open while making these changes. Create a named user, grant administrative rights, and test a second SSH session before disabling or restricting root login. Ubuntu’s security guidance favors least privilege, SSH administration, regular updates, and a host firewall.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
sudo adduser deploy
sudo usermod -aG sudo deployInstall updates and the packages needed for the web edge and build tools. The exact Ruby installation command depends on whether your team standardizes on a version manager or Ubuntu packages; whichever method you choose, record the Ruby version and keep it consistent with the project’s lockfile.
sudo apt update
sudo apt upgrade
sudo apt install nginx ufw git build-essentialDo not enable UFW until SSH is explicitly allowed. A premature firewall enablement can lock you out of the VPS.
Recommended Free Tools
Create the application location and account
Use a service account that cannot log in interactively unless your operations policy requires it. The account must be able to read the application and write only the directories that need runtime writes (for example, a log or upload directory). Keep deployment ownership and runtime ownership deliberate rather than making the whole tree world-writable.
sudo adduser --system --group --home /srv/myapp myapp
sudo mkdir -p /srv/myapp
sudo chown -R myapp:myapp /srv/myapp2. Install and pin Ruby and gems
Install a stable Ruby version supported by your Sinatra release using the version manager or distribution method selected by your project. Verify the interpreter and Bundler used by the service, not just the ones in your interactive shell.
ruby --version
bundle --versionDeploy the code into /srv/myapp by cloning a repository or copying a release artifact. Keep Gemfile.lock with the application so production resolves the same dependency graph as development. Install without development-only groups if your Gemfile separates them.
cd /srv/myapp
sudo -u myapp git clone YOUR_REPOSITORY_URL .
sudo -u myapp bundle config set --local without development test
sudo -u myapp bundle installReplace the repository placeholder with your real internal source; do not commit credentials. Put secrets and production settings in a protected environment file or the service manager’s environment, never in the repository. For example:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallsudo install -o root -g myapp -m 0640 /dev/null /etc/myapp.env
sudo editor /etc/myapp.envStore only the variables your application expects, and ensure the service account can read the file while unprivileged users cannot.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
3. Add a reproducible Rack entry point
Puma’s documented Sinatra path uses a Rack configuration file. Create /srv/myapp/config.ru with the application require path that matches your project:
require './app'
run Sinatra::ApplicationIf your main file has another name or defines a modular Sinatra class, adjust the require and run target accordingly. Test that the file loads from the application directory; relative requires depend on the working directory.
You may also add a Puma configuration file such as /srv/myapp/config/puma.rb to define threads, workers, bind address, environment, and paths. Do not invent capacity numbers: choose concurrency from your application’s workload, database limits, and measured behavior. A single-process configuration is a sensible first deployment; scale only after observing resource use.
4. Run Puma manually before supervision
Start the exact command you intend systemd to run while logged in as the service account. Running in the foreground exposes missing gems, bad environment variables, and bind errors immediately.
cd /srv/myapp
sudo -u myapp bundle exec puma -C /srv/myapp/config/puma.rbIf you do not have a Puma configuration file, sudo -u myapp bundle exec puma uses the Rack entry point and Puma defaults. Puma also documents a direct Sinatra launch such as ruby app.rb -s Puma, but the config.ru plus Bundler command is easier to make identical across manual runs and systemd.
From a second shell, query the local listener. Use the port or socket you configured; for a loopback example:
curl --fail http://127.0.0.1:9292/Stop Puma with Ctrl-C after the local response succeeds. Do not proceed to nginx until the application itself starts cleanly.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
5. Keep Puma running with systemd
Create an application-specific unit at /etc/systemd/system/myapp.service. Keep Puma in the foreground so systemd can track the real process. Use an absolute executable path or a Bundler binstub; relying on an interactive shell’s PATH is a common cause of boot failures.
[Unit]
Description=Sinatra Puma service for myapp
After=network.target
[Service]
Type=simple
User=myapp
Group=myapp
WorkingDirectory=/srv/myapp
EnvironmentFile=-/etc/myapp.env
ExecStart=/srv/myapp/bin/puma -C /srv/myapp/config/puma.rb
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.targetGenerate the binstub if your project does not already have one:
cd /srv/myapp
sudo -u myapp bundle binstubs puma --path /srv/myapp/binAlternatively, set ExecStart to the absolute path of the Ruby environment’s bundle executable followed by exec puma, matching the installation method you selected. Confirm the file is executable and readable by myapp.
Load, enable, start, and inspect the unit:
sudo systemctl daemon-reload
sudo systemctl enable myapp.service
sudo systemctl start myapp.service
sudo systemctl status myapp.service
sudo journalctl -u myapp.service -eAfter editing the unit, always run daemon-reload before restarting:
sudo systemctl daemon-reload
sudo systemctl restart myapp.serviceIf you use a Unix socket, keep one owner of the socket lifecycle. Puma’s systemd guidance warns that a release-path socket can be detected as different from the path systemd supplied, causing Puma to bind again and report There is already a server bound to:. Do not combine incompatible socket-activation settings with a Puma-managed socket; use one explicit path and remove stale files during a controlled restart.
6. Put nginx in front of Puma
Install nginx if you have not already, then create a server block under /etc/nginx/sites-available/myapp. The public listener belongs to nginx; Puma should bind to loopback or a protected Unix socket rather than a public interface.
Loopback TCP proxy
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location / {
proxy_pass http://127.0.0.1:9292;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Unix-socket proxy
Point both Puma and nginx at the same socket, and make the socket directory traversable by the nginx worker. The proxy target uses the http://unix: form:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
location / {
proxy_pass http://unix:/run/myapp/puma.sock:
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}Adapt the syntax to your chosen socket path and nginx version, and validate it before reload. A loopback TCP bind is often easier to troubleshoot; a Unix socket can provide tighter local access control.
Enable the site and test nginx:
sudo ln -s /etc/nginx/sites-available/myapp /etc/nginx/sites-enabled/myapp
sudo nginx -t
sudo systemctl reload nginx
sudo systemctl status nginxRemove or disable the default site if it captures your domain. Confirm that curl http://127.0.0.1/ reaches the expected server block, then test the domain after DNS is configured.
7. Point DNS at the VPS
Create the required DNS records at your DNS provider: normally an A record for the domain and, if serving IPv6, an AAAA record. Point each hostname listed in nginx’s server_name to the corresponding public address. DNS propagation is outside nginx and Certbot; verify resolution from more than one network before troubleshooting the web server.
Use the same hostnames in the certificate request that users will visit. If you serve both the apex domain and www, include both explicitly.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →8. Add HTTPS with Certbot and Let’s Encrypt
Let’s Encrypt is a free, automated certificate authority trusted by major browsers and clients. Ubuntu documents certificates as valid for 90 days. HTTP-01 validation generally requires the certificate authority to reach your server on port 80, so leave nginx listening there during issuance and allow the port through the firewall.
Install Certbot and its nginx integration using Ubuntu’s supported package method, then request the certificate:
sudo certbot --nginx -d example.com -d www.example.comThe nginx plugin edits the matching server block and reloads nginx. Review the resulting configuration and test both HTTP and HTTPS. If you have not yet configured DNS, or port 80 is blocked, validation will fail; fix DNS and reachability first rather than repeatedly requesting certificates.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Verify automatic renewal
Ubuntu’s Certbot setup installs a systemd timer that attempts renewal twice a day. The certificate is not renewed on every attempt; Certbot renews when the remaining lifetime is within its renewal window.
sudo systemctl list-timers | grep certbot
sudo certbot renew --dry-runThe dry run exercises the renewal workflow without replacing the live certificate. If your deployment uses a service other than nginx to terminate TLS, configure an appropriate post-renewal hook so that service reloads the new certificate. With nginx, the plugin’s reload behavior normally handles the active configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.9. Configure UFW without locking yourself out
Allow SSH first, then the web ports. Restrict SSH to a trusted source range when your VPS provider and network policy permit it.
sudo ufw allow 22
sudo ufw insert 1 allow 80
sudo ufw allow 443
sudo ufw enable
sudo ufw statusUse your actual SSH port instead of 22 if you changed it, and consider a source-specific rule rather than opening SSH globally. Do not expose Puma’s loopback port or Unix socket to the internet. Also check any provider-level firewall or security group; both layers must permit the traffic you intend.
10. Verify the complete request path
Check each layer separately so a failure has a clear boundary.
- DNS: resolve every hostname to the VPS address you configured.
- Puma: run
sudo systemctl status myapp.service, inspectsudo journalctl -u myapp.service, and curl the local TCP port or socket. - nginx syntax: run
sudo nginx -t, then reload and inspect its status and error log. - HTTP: request the domain on port 80 and confirm nginx reaches the application rather than the default site.
- TLS: request the HTTPS URL, inspect the certificate hostname and expiry, and confirm HTTP redirects if Certbot configured one.
- Renewal: complete
sudo certbot renew --dry-runsuccessfully. - Firewall: run
sudo ufw statusand verify that only the required administrative and web ports are allowed.
These checks are operational safeguards, not a substitute for application monitoring. Add log rotation, resource alerts, backups, and a documented rollback procedure before treating the VPS as a critical production system.
Deployment choices and their trade-offs
| Decision | Option A | Option B | How to decide |
|---|---|---|---|
| Process supervision | systemd unit | Platform-managed service | Use systemd when you control the VPS and want native boot, restart, identity, and journal integration; use a platform service when that platform owns those operations. |
| Public edge | nginx in front of Puma | Direct Puma exposure | nginx provides a conventional public TLS and proxy boundary; direct exposure removes a layer but makes Puma the internet-facing listener. |
| Puma bind | Loopback TCP | Unix socket | TCP is straightforward to test; a socket avoids a network port but requires matching paths and permissions. |
| Ruby installation | Distribution package | Version manager | Packages simplify host maintenance; a version manager helps pin a project-specific Ruby. In either case, keep the selected version supported by Sinatra and reproducible. |
| Release layout | In-place update | Versioned releases with a current symlink | In-place deployment is simpler. Versioned directories make atomic switchovers and rollback easier as the team grows. |
| ACME workflow | Certbot nginx plugin | Centralized ACME workflow | Certbot is convenient when nginx terminates TLS on this VPS; central management can fit estates with many hosts or a separate certificate platform. |
Updating the application safely
For a small in-place release, fetch code, install the locked dependencies, run a local smoke test, and restart Puma. Keep the previous commit identifiable so you can revert quickly.
cd /srv/myapp
sudo -u myapp git fetch --all
sudo -u myapp git checkout YOUR_RELEASE
sudo -u myapp bundle install
sudo systemctl restart myapp.service
sudo systemctl status myapp.serviceFor a higher-risk application, deploy each release into its own directory, install dependencies there, run checks, update a current symlink, and restart only after the new tree is complete. Ensure the systemd WorkingDirectory and Puma paths follow the symlink strategy consistently. Database migrations need their own backup and rollback plan; do not hide them inside an unconditional service restart.
Common failures and fixes
| Symptom | Likely cause | What to check |
|---|---|---|
| systemd says executable not found | ExecStart depends on an interactive PATH |
Use an absolute Puma or Bundler binstub path and run daemon-reload. |
| Puma exits immediately | Bad require path, missing gem, or missing environment variable | Run the same command manually as myapp; read journalctl -u myapp.service. |
| 502 Bad Gateway from nginx | Puma is stopped, bound elsewhere, or socket permissions are wrong | Check the local listener, the exact proxy_pass target, and nginx’s error log. |
| Address already in use | Two Puma processes or conflicting socket activation | Stop duplicate processes, choose one socket owner, and remove stale socket files during a controlled restart. |
| Certbot validation fails | DNS is wrong or port 80 is unreachable | Resolve the hostname publicly, check UFW and provider firewalls, and keep nginx listening on port 80. |
| HTTPS serves the wrong certificate | Another nginx server block matches first | Review server_name, enabled sites, and nginx -t output. |
| Firewall lockout | UFW was enabled before allowing SSH | Use the VPS console or provider recovery access, allow the correct SSH port, then re-enable UFW. |
Production security checklist
- Use a named administrative account and avoid routine root sessions.
- Run Sinatra and Puma as a dedicated unprivileged user.
- Keep secrets out of Git and protect the environment file with ownership and mode restrictions.
- Bind Puma to loopback or a protected Unix socket; expose only nginx publicly.
- Allow only required UFW ports, normally SSH, HTTP, and HTTPS.
- Keep Ubuntu, Ruby, gems, nginx, and Certbot patched, while respecting the Sinatra-supported Ruby range.
- Verify certificate renewal with a dry run and monitor renewal failures.
- Back up application data and document a tested rollback path.
When this architecture is the right fit
This stack suits a Sinatra application on a VPS where you control the operating system and want transparent service management. It keeps responsibilities clear: Rack code in Sinatra, concurrency in Puma, supervision in systemd, edge traffic and TLS in nginx, and certificate lifecycle in Certbot. Larger teams may adopt versioned releases, centralized logging, managed databases, or a platform service, but those additions do not change the essential requirement that the Ruby version, dependencies, process identity, bind address, and public certificate path remain explicit.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
