iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To build a Serf cluster across Ubuntu VPS servers, run one Serf agent on every VPS, give each agent a unique node name, allow both TCP and UDP traffic on the gossip port (7946 by default), and give new agents at least one existing member address. Use the wan timing profile for Internet-spanning nodes, protect the cluster with one shared encryption key, and enable snapshots plus retry-based joining so reboots do not require manual recovery.
The procedure below creates a three-node, masterless cluster. Replace the example addresses with addresses that are actually routable between your providers and networks.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat the finished cluster looks like
Serf is a decentralized membership and event system. It has no elected membership master: every running agent participates in failure detection and gossip. One agent can start as a seed, and later agents join by contacting any reachable member. After a successful join, membership state is disseminated through the cluster rather than being fetched from a permanent controller.
A practical Internet-based layout uses three Ubuntu VPS servers:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
| Node | Example private bind address | Example advertised address | Serf name |
|---|---|---|---|
| VPS 1 | 10.0.0.11:7946 | 203.0.113.11:7946 | serf-ubuntu-1 |
| VPS 2 | 10.0.0.12:7946 | 203.0.113.12:7946 | serf-ubuntu-2 |
| VPS 3 | 10.0.0.13:7946 | 203.0.113.13:7946 | serf-ubuntu-3 |
The addresses above are documentation examples. Use private addresses when all providers can route them; otherwise advertise a public address that every other member can reach. The address used for -bind is where the agent listens locally. The address used for -advertise is what it tells peers to use. Advertising a private-only address while peers are outside that network is a common cause of failed joins.
Prerequisites on every Ubuntu VPS
- A stable hostname and a unique Serf node name.
- A Serf Linux binary of the same version on every member, verified according to the release instructions for that version.
- A writable directory for Serf configuration, logs, and snapshots.
- A private interface where available, plus a public address when members communicate across providers or isolated networks.
- Cloud security-group rules and host-firewall rules that allow both TCP and UDP on the selected gossip port between all members.
- One shared encryption key delivered through a secret-management channel.
- A service account that can read the key and write the snapshot directory.
Ubuntu’s release names, support windows, and package repositories change. The Serf sources used for this procedure describe a pre-built release binary or compiling with Go, but do not establish a current Ubuntu apt package name. Obtain the current Linux release binary from the Serf project, verify it using that release’s instructions, and place the executable on PATH on each VPS. Confirm the installation with:
serf versionKeep the version consistent while bootstrapping. Mixing incompatible protocol versions can produce confusing membership or join errors.
Plan the network and firewall
Open the gossip port in both protocols
Serf uses one configured gossip port for TCP and UDP. The documented default is 7946; opening only TCP is incomplete. TCP is used for a full state synchronization when a node joins, while UDP carries gossip and user events.
| Traffic | Default endpoint | Required scope | Purpose |
|---|---|---|---|
| Serf gossip TCP | 7946 | Every member to every member | Join synchronization and TCP membership traffic |
| Serf gossip UDP | 7946 | Every member to every member | Gossip, failure detection, and user events |
| Serf RPC | 127.0.0.1:7373 by default | Local administration only | CLI queries and commands |
Restrict 7946 to the other cluster addresses whenever your provider permits it. Keep RPC on loopback unless remote administration is an explicit requirement; exposing port 7373 publicly enlarges the control surface.
Test reachability before blaming Serf
From each VPS, test the advertised TCP endpoint of every other VPS. For example:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchnc -vz 203.0.113.11 7946UDP testing is less definitive because many tools cannot confirm delivery, but check that provider security groups and host-firewall rules permit UDP 7946 in both directions. Inspect both layers’ logs when a member remains failed. A successful TCP test alone does not prove that gossip will work.
Create and distribute the encryption key
Serf’s security model uses a symmetric shared secret for confidentiality, integrity, and authentication. Generate one key, store it as a secret, and install exactly the same value on every member. On a trusted administrative machine, use Serf’s key-generation command:
serf keygenDeliver the resulting base64 value through your secret-management channel rather than placing it in shell history, a public repository, cloud-init output, or an image shared by unrelated tenants. If you rotate keys, use Serf’s documented keyring-file mechanism so old and new keys can coexist during the transition; do not casually generate a different key for one node.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
The examples below expect the key in an environment variable named SERF_ENCRYPT_KEY. Ensure the file or secret source that sets it is readable only by the Serf service account.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Start the first (seed) agent
Create the snapshot directory and start the first agent with the WAN timing profile. The WAN profile is important when members are separated by the public Internet: LAN timing is more aggressive and can interpret normal Internet latency or packet loss as a failure.
sudo install -d -o serf -g serf -m 0750 /var/lib/serf
export SERF_ENCRYPT_KEY='paste-the-secret-from-your-secret-store'
serf agent
-node=serf-ubuntu-1
-bind=10.0.0.11:7946
-advertise=203.0.113.11:7946
-profile=wan
-encrypt="$SERF_ENCRYPT_KEY"
-rpc-addr=127.0.0.1:7373
-snapshot=/var/lib/serf/snapshotReplace both example addresses with the real interface and routable address for VPS 1. The seed can start without a join target; it is the initial member to which the other agents will connect. Starting it does not create a leader.
Join the remaining VPS servers
Give every additional agent its own node name, bind address, advertised address, WAN profile, encryption key, RPC address, and snapshot path. Use one or more -retry-join options. Retrying is preferable to a one-time join command for unattended boots because a seed may be temporarily down while networking or another service is starting.
export SERF_ENCRYPT_KEY='the-same-secret-used-on-serf-ubuntu-1'
serf agent
-node=serf-ubuntu-2
-bind=10.0.0.12:7946
-advertise=203.0.113.12:7946
-profile=wan
-encrypt="$SERF_ENCRYPT_KEY"
-retry-join=203.0.113.11:7946
-retry-join=203.0.113.13:7946
-retry-max=0
-rpc-addr=127.0.0.1:7373
-snapshot=/var/lib/serf/snapshotUse the same pattern for VPS 3, changing its node name and addresses. Supplying multiple seeds prevents one address from becoming a permanent bootstrap dependency. A node needs at least one existing member address to join; after it reaches one member, Serf performs a full state sync over TCP and then spreads membership through UDP gossip.
Recommended Free Tools
-retry-max=0 requests unlimited retries. If your operational policy requires bounded retries, set a finite value and arrange a service restart or alert when that limit is reached.
Understand the startup and gossip sequence
The order of operations explains many apparent mysteries during installation. First, the operating system brings up the interface and routes. The Serf process then binds its local address and port. A joining process uses a configured seed address to establish contact and exchange complete membership state over TCP. Only after that initial synchronization does the node participate fully in the UDP gossip fanout used for failure detection, ordinary membership dissemination, and user events.
This is why a node can have a correct binary and key yet remain absent: it may be listening on an address that peers cannot route to, or the TCP bootstrap path may be blocked. Conversely, a successful TCP connection followed by missing or stale membership usually points to UDP filtering, asymmetric routing, packet loss, or an unsuitable timing profile.
There is no permanent coordinator to repair a partition automatically. A seed is simply an initial contact point. Once several agents are alive, each has enough peer information to continue disseminating state. Keeping two or more retry targets on every joining node reduces dependence on one VPS during maintenance or an outage.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Verify membership before adding automation
Run these commands against the local agent on each VPS:
serf members
serf info
serf monitor -log-level=infoserf members should show one alive entry for every intended member, with the address and port you expect. Watch the monitor output while a node joins and confirm that the agent logs record the join. Do not attach deployment scripts or failover automation until membership is stable.
- Compare the encryption key source on every host without printing the secret into shared logs.
- Confirm all agents use the same gossip port, Serf protocol-compatible version, and timing profile.
- Check that every advertised address is routable from every other member.
- Review cloud security-group and host-firewall logs for dropped TCP or UDP packets.
- Check that the RPC listener remains on the intended loopback address.
Make the cluster survive reboots
Use snapshots and rejoin behavior
The -snapshot path retains recovery information across restarts. Keep it writable by the Serf service account and on durable local storage. Add -rejoin when a node should attempt to return after a previous leave state rather than treating that state as a reason to remain absent. Retain -retry-join as well so a rebooted node can find a currently available member.
Snapshots contain cluster recovery state, not application data. Back them up only when your operational policy requires it, and protect them with the same filesystem and access controls used for other service state.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Run Serf under systemd
Use a dedicated unprivileged account, a root-owned unit, and an environment file readable only by that account. The following is an implementation example; adapt paths, addresses, and your distribution’s hardening policy.
# /etc/serf/serf.env (mode 0600, owned by serf:serf)
SERF_ENCRYPT_KEY=base64-key-from-your-secret-store
# /etc/systemd/system/serf.service
[Unit]
Description=Serf membership agent
Wants=network-online.target
After=network-online.target
[Service]
User=serf
Group=serf
EnvironmentFile=/etc/serf/serf.env
ExecStart=/usr/local/bin/serf agent
-node=serf-ubuntu-1
-bind=10.0.0.11:7946
-advertise=203.0.113.11:7946
-profile=wan
-encrypt=${SERF_ENCRYPT_KEY}
-retry-join=203.0.113.1:7946
-retry-max=0
-rpc-addr=127.0.0.1:7373
-snapshot=/var/lib/serf/snapshot
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetOn the seed, remove the example -retry-join or point it only at a deliberately chosen existing member. On each joining node, use that node’s identity and one or more real seed addresses. Then enable the service:
sudo systemctl daemon-reload
sudo systemctl enable --now serf
sudo systemctl status serf
sudo journalctl -u serf -fConfigure the agent’s leave_on_terminate setting when your service manager should perform a graceful leave during a controlled stop. A graceful leave tells peers the node is intentionally stopping; an unplanned crash is handled through failure detection and later rejoin.
Advertise roles and react to events safely
Tags let applications discover a member’s role without relying on hostnames. For example:
-tag role=webUse a different tag such as role=db on database nodes, or maintain tags in a tags file where that better fits your deployment process. Tags are gossiped and can be changed on reload.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Event handlers can react to member joins, leaves, failures, and user events. Filter each handler by event type and role so a web node cannot accidentally execute database automation. Treat handlers as distributed code: membership is eventually consistent, notifications can be delayed or duplicated, and a handler should therefore be idempotent.
Serf user events travel through the gossip layer over UDP. The documented hard limit for complete user-event framing is 9 KB. Keep payloads comfortably below that limit and put larger data in an authenticated external system, passing only a reference through Serf.
Design trade-offs and operational limits
Serf’s masterless model removes the need to operate an elected membership leader, which is useful when VPS providers, regions, or networks can fail independently. The trade-off is eventual rather than instantly identical state: two agents can briefly show different membership views while gossip converges. Automation must therefore tolerate delay and duplicate notifications instead of assuming a single serialized event stream.
WAN timing is another deliberate trade-off. The lan profile reacts faster on a low-latency local network, but those short intervals are unsuitable across the public Internet, where normal jitter and packet loss can look like failure. The wan profile gives separated VPS nodes more realistic failure-detection behavior. Do not mix profiles casually across members; use a consistent profile for the cluster segment being operated.
The firewall surface is small but non-negotiable: the configured gossip port must be reachable in both TCP and UDP, while the RPC port can remain local. Changing the gossip port is supported, but every bind, advertise value, security-group rule, host-firewall rule, and join target must change together. A partial port change often looks like an encryption or membership problem.
There is no quoted maximum node count or benchmark for this exact Ubuntu VPS arrangement. Plan capacity from your event volume, network conditions, handler workload, and provider limits, then observe real membership convergence with serf monitor and logs. Keep user events below the hard 9 KB framing limit regardless of cluster size.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot the common failure modes
| Symptom | Likely checks | Correction |
|---|---|---|
| No members appear | Seed process, TCP 7946, UDP 7946, advertised address, cloud rules, host firewall | Start the seed, allow both protocols, and advertise an address peers can route to. |
| Immediate authentication or decryption errors | Secret value, whitespace or truncation during copying, key source permissions | Securely recopy or regenerate the shared key and apply the identical value to every agent. |
| Nodes repeatedly change between alive and failed | Internet latency, packet loss, timing profile | Use -profile=wan for Internet-spanning members instead of LAN timing. |
| A rebooted node stays absent | Writable snapshot, retry targets, prior leave state | Keep -snapshot writable, use -retry-join, and add -rejoin when prior leave state should not block return. |
| Handlers run on the wrong machines | Missing or ambiguous role tags, unfiltered event definitions | Add explicit tags and filter handlers by event and role. |
| User events disappear or fail | Payload size and UDP reachability | Keep the complete event below the 9 KB framing limit and verify UDP gossip between members. |
When a node is visible but unreachable
Compare the address shown by serf members with the address that should be reachable from the other VPS. If it is a private address from an isolated network, correct -advertise and restart the agent. Changing firewall rules cannot fix an address that peers cannot route to.
When only one direction works
Check ingress rules on the destination and egress rules on the source in both cloud and host firewalls. Serf membership requires bidirectional communication; a rule that permits only connections initiated from one provider can leave nodes stuck in a failed state.
When a join works once but fails after reboot
Check that systemd starts after network readiness, that the environment file is still readable by the service account, and that the snapshot directory has not changed ownership. Confirm that retry targets are configured in the unit rather than only in an interactive shell. If a controlled shutdown recorded a leave state, -rejoin may be required for the intended return behavior.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Operational checklist
- Every agent has a unique node name.
- Every agent uses the same Serf version and encryption key.
- TCP and UDP 7946 are allowed between all members, or the equivalent custom port if you changed it.
-advertisepoints to an address every peer can route to.- Internet-spanning agents use
-profile=wan. - At least one existing member is supplied through
-retry-join, preferably more than one. - RPC remains on loopback unless remote administration is intentionally secured.
- Snapshot files and the key environment file are writable or readable only where required.
serf membersshows the intended members asalivebefore automation is enabled.- Handlers are filtered, idempotent, and designed for eventual, duplicate notifications.
Frequently Asked Questions
Which ports must be open between Serf VPS servers?
Allow the configured gossip port in both TCP and UDP directions between every member. The default is 7946. TCP handles joining and full state synchronization; UDP carries gossip, failure detection, and user events. The RPC listener defaults to 127.0.0.1:7373 and normally does not need Internet access.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →How do Serf nodes find one another over the Internet?
A new agent must receive at least one existing member address, normally through one or more -retry-join options. It first synchronizes state over TCP, then membership spreads through UDP gossip. Advertise a public or otherwise routable address when peers cannot reach the bind interface.
Should Internet-connected VPS nodes use the LAN or WAN profile?
Use -profile=wan for nodes separated by public networks. LAN timing is more aggressive and can mistake ordinary Internet latency or packet loss for failure, causing members to flap between alive and failed.
How is Serf gossip secured?
Generate one shared key with serf keygen and configure the identical value on every agent with -encrypt. The shared secret provides confidentiality, integrity, and authentication. Deliver it through a secret-management channel and use the documented keyring-file mechanism for rotation.
What makes a Serf cluster survive a VPS reboot?
Run the agent under systemd with network readiness ordering, restart-on-failure, a writable -snapshot path, and persistent -retry-join targets. Add -rejoin when a previous leave state should not prevent the node from returning.
Why do user events fail even though membership works?
User events use UDP gossip and have a hard 9 KB limit for complete framing. Verify UDP reachability and keep the event comfortably below 9 KB. Store larger payloads in an authenticated external system and send only a reference through Serf.
Can I expose the Serf RPC port for remote administration?
The documented default is loopback at 127.0.0.1:7373. Leave it there unless remote administration is deliberately required and separately secured; exposing it publicly increases the control surface.
The Bottom Line
A reliable multi-VPS Serf cluster depends on correct addressing and disciplined operations more than on a complicated topology: run one uniquely named agent per server, permit TCP and UDP on the gossip port, advertise routable addresses, use the WAN profile, share one protected encryption key, and bootstrap with multiple retry targets. Verify all members as alive before enabling handlers, then use snapshots, rejoin behavior, and systemd to make restarts predictable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
