iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Run Node-RED on a Linux VPS with the official nodered/node-red container, persist its /data directory, and place the editor behind HTTPS and authentication. Keep your MQTT broker on a private Docker network whenever possible, expose only the dashboard endpoints that users need, and test backups before the VPS becomes part of a critical automation.
What a secure VPS deployment looks like
A VPS is a cloud virtual machine that gives you a stable public address, persistent storage, and control over the operating system. Node-RED can run directly on that host or in Docker. For most IoT projects, Docker is the easier operational choice: the application is isolated, upgrades are repeatable, and replacing a container does not remove flows when /data is stored in a volume or bind mount.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe deployment has four logical layers:
- VPS and firewall: the Linux host receives security updates and allows only the ports you deliberately publish.
- Node-RED runtime: the
nodered/node-redimage listens on container port 1880 and stores flows, credentials, and settings in/data. - Access layer: a reverse proxy with HTTPS, or a private VPN, controls access to the editor and dashboards.
- Device layer: MQTT and other IoT services communicate over a private Docker network or encrypted connections.
Node-RED’s documentation describes cloud deployment, including virtual machines, as a supported way to run the platform. It also warns that the editor is unsecured by default: anyone who can reach its IP address can otherwise view the editor and deploy changes. Treat an unprotected port 1880 as a setup state, not a finished deployment.
Choose the deployment and exposure model
| Decision | Recommended starting point | Why it matters |
|---|---|---|
| Installation | Docker using nodered/node-red |
Separates application files from the host and makes upgrades or rollback predictable. |
| Persistent data | Named Docker volume for simple operation; bind mount when host-level backup tools are required | Both preserve /data when a container is removed. A bind mount is easier to inspect with normal host tools. |
| Editor access | Reverse proxy with HTTPS, or a private VPN | Avoids publishing an unauthenticated editor directly on port 1880. |
| MQTT access | Private Docker network and container-name DNS | The broker can remain unexposed to the internet while Node-RED connects internally. |
| Public HTTP endpoints | Expose only routes required by devices or users | HTTP-in flows and static content need their own protection in addition to editor authentication. |
A native installation can be appropriate when you already manage Node.js services with the host’s package manager and service supervisor. It gives direct access to logs and files, but upgrades, dependency changes, and rollback become host-administration tasks. Docker is not automatically safer: a publicly reachable container still needs HTTPS, authentication, patching, and a restrictive firewall.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Prepare the VPS before installing Node-RED
1. Select a supported Linux image and an administrative account
Choose a current Linux distribution supported by your VPS provider. Create a non-root administrative user, use SSH keys instead of password login where the provider permits it, and reserve a DNS name for the service. You need enough disk space for the operating system, Docker images, Node-RED data, logs, and backups; the exact VPS size depends on flow count, message rates, dashboard traffic, and any additional services you run.
2. Apply updates and establish a firewall policy
Update the operating system before installing application software. Permit SSH only from addresses you administer when practical. A public web deployment normally needs TCP 80 and 443 for certificate issuance and HTTPS traffic; port 1880 should not be publicly open when a reverse proxy or VPN is used. If devices must reach an HTTP-in endpoint directly, publish only that endpoint through the access layer rather than opening the entire editor.
3. Decide where certificates and backups will live
Keep TLS private keys readable only by the service that needs them. Store backup archives outside the live /data directory and copy them to a separate system or storage account. A backup on the same VPS does not protect you from a deleted server or failed disk.
Install Docker and create persistent Node-RED storage
Install Docker Engine and its Compose component using the instructions for your Linux distribution. Do not mix packages from unrelated repositories, and verify that the Docker daemon starts automatically after a reboot.
A named volume is the simplest persistence option:
docker volume create nodered_dataUse a bind mount instead when you want the files at a known host path:
sudo mkdir -p /opt/nodered/data
sudo chown -R 1000:1000 /opt/nodered/dataThe container writes user configuration to /data. Without either a named volume or a bind mount, deleting the container also deletes your flows and configuration.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Start Node-RED in Docker
Quick start for a private or proxied deployment
Bind port 1880 to the VPS loopback interface when a reverse proxy on the same host will be the only public entry point:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
docker run -d
--name nodered
--restart unless-stopped
-p 127.0.0.1:1880:1880
-v nodered_data:/data
nodered/node-redCheck that the container is running and inspect startup messages:
docker ps
docker logs --tail=100 noderedFor a temporary first-run test on a private network, you can bind to all interfaces with -p 1880:1880, but do not leave that port internet-facing without HTTPS and editor authentication. A cloud security group and the host firewall must agree: allowing a port in only one of them does not make it reachable, while allowing it in both exposes it.
Use Compose for repeatable configuration
Create a directory such as /opt/nodered and save this as compose.yaml:
services:
nodered:
image: nodered/node-red
container_name: nodered
restart: unless-stopped
ports:
- "127.0.0.1:1880:1880"
volumes:
- nodered_data:/data
networks:
- iot
volumes:
nodered_data:
networks:
iot:
external: trueCreate the shared network once, then launch the service:
docker network create iot
docker compose up -d
docker compose logs -f noderedAn MQTT broker container that is attached to the same iot network can be addressed from an MQTT node by its container name. Because the Compose file publishes no broker port, that broker remains internal unless you explicitly publish one. If your broker runs on another host, use its private address and enable TLS rather than assuming that a cloud network is private by default.
Put HTTPS and an access boundary in front of the editor
Use a DNS record that points your chosen hostname to the VPS, then configure a reverse proxy to terminate TLS and forward traffic to 127.0.0.1:1880. The proxy must pass normal HTTP requests and WebSocket upgrade requests; otherwise the editor may load but fail to deploy or stream updates. Redirect plain HTTP to HTTPS and renew certificates automatically.
A private VPN is an alternative when only your team or household needs access. In that design, keep Node-RED bound to a private interface, restrict the VPN network at the firewall, and do not treat the VPN as a substitute for editor authentication.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Node-RED can also serve HTTPS directly. In settings.js, provide certificate and key material with the https setting:
const fs = require('fs');
module.exports = {
https: {
key: fs.readFileSync('/certs/privkey.pem'),
cert: fs.readFileSync('/certs/fullchain.pem')
}
};Mount the certificate directory read-only into the container and ensure renewal updates the files before restarting Node-RED. Whether TLS terminates in Node-RED or a proxy, use encrypted transport for public deployments and avoid sending editor passwords or device credentials over plain HTTP.
Enable Node-RED authentication
Protect the editor and Admin API with adminAuth
Authentication is configured in settings.js. The credentials mode uses a username and a bcrypt password hash:
adminAuth: {
type: "credentials",
users: [{
username: "admin",
password: "$2b$08$REPLACE_WITH_A_BCRYPT_HASH",
permissions: "*"
}]
}Generate a bcrypt hash with the Node-RED administration command rather than storing a plain password:
Recommended Free Tools
docker run --rm -it nodered/node-red node-red admin hash-pwCopy the resulting hash into settings.js, protect that file, and restart the container. Bcrypt is the recommended password format; legacy MD5 hashes should not be used for a new deployment. Create separate accounts with narrower permissions when your team does not need full administration, and remove accounts that are no longer required.
Protect HTTP-in routes and static content separately
adminAuth secures the editor and Admin API, not every endpoint created by your flows. For deployments that expose HTTP-in routes or Node-RED-served static files, configure httpNodeAuth and httpStaticAuth as appropriate. A route that accepts a webhook from a device may need a token or signature check in the flow instead of browser-style basic authentication; validate the request before writing to a database, publishing to MQTT, or actuating hardware.
Keep secrets out of source control
Do not commit settings.js containing private keys, MQTT passwords, or the credential-encryption secret to a public repository. Restrict file permissions, use an environment or secret-management mechanism where practical, and keep exported flows separate from credentials. If a secret is exposed, rotate it at the broker or service and redeploy the affected configuration.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Connect Node-RED to MQTT without exposing the broker
Broker in the same Docker network
Attach the broker and Node-RED containers to the iot network. In the Node-RED MQTT configuration, set the broker host to the broker container name and use its internal listener port. Docker’s user-defined network provides name resolution between containers; no public DNS record or broker port mapping is needed.
Use a dedicated MQTT account for Node-RED. Grant only the publish and subscribe topics its flows require, and use separate accounts for devices, dashboards, and administration. Topic permissions reduce the damage from a compromised device or flow.
Broker on another host
Use a private address reachable through the VPS network or VPN. For traffic crossing an untrusted network, configure MQTT over TLS, normally on the broker’s TLS listener, and install the correct CA certificate in the MQTT node. Enable server-certificate verification; do not disable verification merely to bypass a hostname mismatch. Client certificates can provide mutual TLS when the broker is configured for them.
Test the connection safely
- From the Node-RED editor, configure the MQTT server hostname, port, TLS settings, and credentials.
- Deploy a small test flow that subscribes to a dedicated test topic and displays messages in a debug node.
- Publish a test message from a controlled client and verify that the message arrives without opening the broker to the public internet.
- Review broker logs and Node-RED status messages, then remove the test flow or change it to a production topic policy.
Expose a dashboard without exposing the editor
Separate the audience for a dashboard from the audience that can edit flows. Keep the editor hostname restricted to administrators, and publish the dashboard through a distinct HTTPS path or hostname. Apply authentication at the proxy and, where supported by the Node-RED dashboard package, in the dashboard configuration itself. Do not assume that hiding the editor link protects it: the editor remains reachable if its route is publicly published.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesFor a device webhook, publish only the required HTTP-in path through the proxy. Use a long, unguessable path only as an additional layer; require an authorization header, signed payload, or equivalent validation in the flow. Rate-limit requests and reject unexpected methods or content types before processing data.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Back up, restore, and migrate the deployment
Named-volume backup
Stop or quiesce flows that write files before taking a consistent archive. One practical pattern is to mount the volume into a short-lived container and create an archive on the host:
docker run --rm
-v nodered_data:/data:ro
-v /opt/nodered/backups:/backup
alpine tar czf /backup/nodered-data.tgz -C /data .Copy the archive off the VPS, restrict its permissions, and retain more than one restore point. The archive contains credentials and configuration, so treat it as sensitive data.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Bind-mount backup
With a bind mount, back up /opt/nodered/data using your normal file-backup tool. Preserve ownership, permissions, symbolic links, and hidden files. Do not back up only the visible flow JSON; credentials, package metadata, settings, and encryption configuration may also be needed for a complete recovery.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Restore test
- Provision a clean VPS or an isolated test directory.
- Install the same Docker image family and mount an empty data location.
- Stop Node-RED, replace the empty
/datacontents with the archive, and restore the original ownership. - Start the container and verify editor login, credential decryption, MQTT connectivity, scheduled triggers, and dashboard routes.
- Record any secrets or certificates that must be restored separately from the archive.
A backup that has never been restored is only an assumption. Test after changing the Node-RED image, VPS provider, certificate arrangement, or credential-encryption secret.
Operate and update Node-RED safely
Pin an image tag in production when you need predictable upgrades, and read the Node-RED release notes before changing versions. Keep a current backup, pull the new image, recreate the container, and verify flows before deleting the previous image:
docker compose pull
docker compose up -d
docker compose logs --tail=200 noderedThe persistent volume means replacing the container does not remove user data. If an upgrade causes a regression, stop the new container and restore the previous image tag while keeping the same data backup; test compatibility before making the rollback permanent.
Monitor container restarts, disk consumption, memory pressure, and log volume. Configure log rotation so a noisy flow cannot fill the VPS disk. Alert on failed MQTT connections and repeated authentication failures. Keep the host, Docker Engine, reverse proxy, and Node-RED image patched; securing only the application leaves the surrounding stack exposed.
Troubleshoot common VPS failures
| Symptom | Likely cause | Checks and remedy |
|---|---|---|
| Browser cannot reach the editor | Firewall, cloud security group, or port binding blocks traffic | Run docker ps, confirm the published address, inspect host and provider firewall rules, and test the proxy-to-container connection locally. |
| Editor loads but deploy fails or live updates stop | Reverse proxy is not forwarding WebSocket upgrades | Enable HTTP/1.1 upgrade handling and inspect proxy logs; test direct local access to port 1880. |
| Flows disappear after recreation | /data was not mounted or the mount path changed |
Run docker inspect nodered and verify the volume is mounted at /data; restore the latest archive if necessary. |
| MQTT node shows connection refused | Wrong hostname, network, listener, or broker policy | Confirm both containers are on iot, resolve the broker name from the Node-RED container, and verify the internal port and account permissions. |
| TLS connection fails with a certificate error | Wrong CA, hostname mismatch, expired certificate, or incorrect system time | Check the broker hostname against the certificate, mount the intended CA, renew certificates, and verify VPS time synchronization. |
| Credentials cannot be decrypted after restore | The credential-encryption secret or settings file was omitted | Restore the matching secret and settings before starting flows; if the secret is lost, re-enter credentials and rotate affected service passwords. |
| VPS disk fills unexpectedly | Unbounded logs, retained MQTT data, or oversized backups | Inspect Docker and application logs, enable rotation, prune only unused images, and move backups off-host. |
Pre-launch checklist
- Operating-system updates are applied and SSH access is restricted.
- Only required firewall and cloud-security-group ports are open.
- Node-RED data is stored in a named volume or bind mount at
/data. - The editor is behind HTTPS or a private VPN and has
adminAuthenabled. - HTTP-in and static routes have separate authentication or request validation.
- MQTT uses a private network or encrypted remote connection, with least-privilege accounts.
- Private keys, broker credentials, and credential-encryption secrets are excluded from public repositories.
- Backups are encrypted or access-controlled, stored off the VPS, and have passed a restore test.
- Container logs, disk usage, restarts, and MQTT failures are monitored.
This arrangement gives Node-RED a persistent home on the VPS while minimizing public attack surface: administrators reach a protected editor, users reach only the dashboard or webhook paths they need, and the MQTT broker stays private whenever the network design allows it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
