Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To put app.example.com on one VPS, complete two separate configurations: create a DNS record that points the hostname to the VPS, then configure Nginx to answer that hostname and serve files or proxy requests to an application. Add HTTPS after the hostname resolves, and keep application ports private behind Nginx.
A single public IPv4 address can serve many subdomains. Nginx selects the correct site by matching the requested hostname in server_name; TLS SNI lets multiple HTTPS names share the same address. The procedure below uses app.example.com as an example and assumes an Ubuntu- or Debian-like Linux server with Nginx installed.
How a subdomain reaches an application on one VPS
A browser request passes through several independent layers:
- DNS translates
app.example.cominto an IP address or an alias hostname. - The network and firewall allow the connection to reach TCP port 80 for HTTP or TCP port 443 for HTTPS.
- Nginx receives the request and chooses a
serverblock by comparing the hostname withserver_name. - The site or upstream application returns the content. For an application, Nginx can forward the request to a private listener such as
127.0.0.1:3000.
DNS does not select a folder, process, or port on the VPS. Conversely, an Nginx configuration cannot make a hostname resolve if DNS still points elsewhere. Treat these as separate troubleshooting domains.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
What you need before starting
- A registered parent domain, such as
example.com, with access to its authoritative DNS provider. - The VPS public IPv4 address. In the examples,
203.0.113.10is a documentation-only address; replace it with your real address. - Root or
sudoaccess to the VPS. - Nginx installed and running.
- The hostname you want to add and a clear target: static files, or an application and its local listening port.
- A firewall policy that permits inbound TCP 80 and 443. This may involve both the operating-system firewall and a firewall supplied by the VPS provider.
If the application listens only on localhost, Nginx can reach it while the public internet cannot. That is normally preferable to exposing application ports directly.
Step 1: Choose the hostname and its target
Decide the label and the service before editing either DNS or Nginx. The DNS record name is usually just the label, while Nginx uses the complete hostname.
| Hostname | DNS record name | Nginx server_name |
Typical target |
|---|---|---|---|
app.example.com |
app |
app.example.com |
127.0.0.1:3000 |
api.example.com |
api |
api.example.com |
127.0.0.1:8080 |
blog.example.com |
blog |
blog.example.com |
A directory such as /var/www/blog |
Confirm that the application is already bound to the intended address and port. A service bound to 127.0.0.1 is reachable from Nginx on the same VPS; a service bound only to another private address requires a matching proxy_pass target.
Step 2: Create the DNS record
Use an A record for IPv4
At the authoritative DNS provider for example.com, add an A record similar to:
Type: A
Name: app
Value: 203.0.113.10The resulting name is app.example.com. Do not enter the full name in the Name field if your provider automatically appends the parent domain; doing so can accidentally create a doubled name such as app.example.com.example.com.
Add an AAAA record only when IPv6 is ready
An AAAA record advertises an IPv6 address. Add one only after IPv6 traffic reaches the same VPS and the same Nginx service, with the provider firewall and host firewall allowing the required ports. For example:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Type: AAAA
Name: app
Value: 2001:db8:1234::10If the AAAA path is broken while the A path works, some clients will try IPv6 first and fail or experience long delays. An unreachable IPv6 address can also interfere with ACME HTTP validation. It is safer to omit AAAA until IPv6 has been tested end to end.
Use CNAME when the destination is another hostname
A CNAME makes the subdomain an alias of another hostname, rather than directly storing the VPS address:
Type: CNAME
Name: app
Target: service.example.netUse CNAME when the service operator gives you a hostname to target. Use A or AAAA when the VPS itself is the destination. A CNAME cannot normally coexist with other records at the same name, so do not add A, AAAA, or conflicting record types to app.
Cloudflare’s subdomain documentation, updated April 16, 2026, states the prerequisite plainly: “To host content on a subdomain of your domain, first ensure that your hosting provider can serve content for the given hostname (<subdomain>.example.com).” In practice, that means both the DNS record and the Nginx server_name must be present.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 3: Open only the public network path
Allow inbound TCP 80 and 443 in every firewall layer that applies to the VPS. Port 80 is needed for ordinary HTTP and for the common ACME HTTP-01 certificate challenge; port 443 carries HTTPS.
Keep application ports such as 3000 and 8080 closed to the internet when Nginx is the public entry point. On a system using UFW, a typical policy is:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw statusUse the equivalent controls if your distribution uses another firewall. Also check the VPS provider’s network firewall or security-group interface; opening UFW alone does not help if the provider blocks the traffic upstream.
Step 4: Configure Nginx for the subdomain
Static content
Create a document root and a dedicated server-block file. The exact include directory varies by distribution; the following layout is common on Debian and Ubuntu:
sudo mkdir -p /var/www/app
sudo chown -R www-data:www-data /var/www/app
sudo nano /etc/nginx/sites-available/app.example.comPut a minimal HTTP configuration in the file:
server {
listen 80;
listen [::]:80;
server_name app.example.com;
root /var/www/app;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}Add a test page so you can distinguish a working Nginx site from an empty directory:
printf '%sn' '<h1>app.example.com is working</h1>' | sudo tee /var/www/app/index.htmlReverse proxy to an application
For an application listening on 127.0.0.1:3000, use a proxy location instead of a document root:
server {
listen 80;
listen [::]:80;
server_name app.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}proxy_pass forwards the request to the local service. The forwarded headers preserve the original hostname, client address, and protocol information that many frameworks need for redirects, logging, and secure-cookie decisions. Change the port to match the process that actually serves this subdomain.
Free tools Windows power users keep installed
One-click scans. No signup required.
Enable the site and validate the syntax
On systems using sites-available and sites-enabled, enable the file and test before reloading:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
sudo ln -s /etc/nginx/sites-available/app.example.com /etc/nginx/sites-enabled/app.example.com
sudo nginx -t
sudo systemctl reload nginxNever skip nginx -t. If it reports an error, Nginx keeps the previous working configuration when you avoid the reload; fix the indicated file and test again. A reload applies the new configuration without stopping existing connections.
Step 5: Put the subdomain on HTTPS
Check the prerequisites for certificate validation
Before requesting a certificate, verify that the hostname resolves to this VPS and that an unauthenticated request can reach Nginx on port 80. HTTP-01 validation requires a direct connection to port 80. A proxy or CDN mode that does not pass the challenge through, a provider firewall, or a bad AAAA record can prevent validation even when the site appears reachable from one network.
Request a certificate with an ACME client
Use an ACME client supported by your distribution. With Certbot’s Nginx integration, a common command is:
sudo certbot --nginx -d app.example.comThe client obtains a trusted certificate and can modify the Nginx configuration to install it, add an HTTP-to-HTTPS redirect, and reload Nginx. Review the proposed changes rather than accepting a redirect blindly if the application has a special HTTP endpoint or if you are managing redirects yourself.
If you install the certificate manually, the HTTPS server block needs the certificate paths supplied by the ACME client and a listener on 443:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name app.example.com;
ssl_certificate /etc/letsencrypt/live/app.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
Keep a separate port-80 block for the redirect and, when necessary, the ACME challenge path:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
server {
listen 80;
listen [::]:80;
server_name app.example.com;
return 301 https://$host$request_uri;
}Test and reload after certificate changes:
sudo nginx -t
sudo systemctl reload nginxMake renewal automatic
ACME certificates are short-lived, so renewal must be scheduled by the client. Check the installed timer or scheduled task and perform a dry run using the client’s documented test mode. A successful initial issuance does not prove that future renewals will work; the renewal job must be able to reach the validation endpoint and reload Nginx.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteStep 6: Verify each layer
- Check DNS from a shell:
dig +short app.example.comThe output should contain the VPS IPv4 address. If you intentionally configured IPv6, query it separately with
dig +short AAAA app.example.com. - Confirm Nginx selected the intended server block. Request the hostname, not the IP address, because
server_namematching depends on the Host header:curl -I http://app.example.com curl -I https://app.example.com - Verify that HTTP returns a redirect to the same hostname over HTTPS.
- Open the HTTPS URL in a browser and inspect the certificate. It must contain the exact hostname, be within its validity period, and chain to a trusted authority.
- If validation fails, request the ACME challenge path while troubleshooting and inspect Nginx logs:
sudo tail -f /var/log/nginx/access.log /var/log/nginx/error.log - For a proxied application, test the local upstream independently from the VPS:
curl -i http://127.0.0.1:3000A successful local response narrows remaining problems to Nginx, DNS, or the network path.
Adding more subdomains to the same VPS
Repeat the DNS record and create a distinct Nginx server block for each hostname. Give every block its own server_name and upstream or document root.
| Hostname | DNS value | Nginx target |
|---|---|---|
app.example.com |
Same VPS IPv4 | 127.0.0.1:3000 |
api.example.com |
Same VPS IPv4 | 127.0.0.1:8080 |
blog.example.com |
Same VPS IPv4 | /var/www/blog |
Each name can have its own certificate, or one certificate can cover several names when your ACME client and renewal design support that arrangement. Nginx uses the hostname sent by the client to choose the matching HTTPS server. NGINX describes TLS Server Name Indication (SNI), standardized in RFC 6066, as the generic solution for running several HTTPS servers on one IP because the browser sends the requested server name during the TLS handshake.
Do not copy a server block and forget to change server_name or proxy_pass. That mistake sends two hostnames to the same content and is especially confusing when both sites otherwise return valid HTTP responses.
Troubleshooting by symptom
| Symptom | Likely cause | Checks and fixes |
|---|---|---|
| DNS returns the wrong address | Wrong authoritative nameservers, mistyped record name, stale record, or a conflicting A/AAAA record. | Check which nameservers are authoritative, inspect A and AAAA responses with dig, remove obsolete records, and confirm the record name is the intended label. |
| Timeout or connection refused | Port 80 or 443 is blocked, Nginx is stopped, or the provider firewall denies traffic. | Check both firewall layers, run sudo systemctl status nginx, and verify Nginx is listening with sudo ss -ltnp | grep -E ':80|:443'. |
| ACME challenge fails | Port 80 is unreachable, a proxy/CDN does not pass the challenge, or IPv6 reaches a different service. | Temporarily test the HTTP URL directly, inspect the challenge request in the access log, verify firewall rules, and remove or correct an AAAA record that does not reach this Nginx instance. |
| 502 Bad Gateway | The upstream process is stopped, listening on another address or port, or rejecting Nginx’s connection. | Check the application service, confirm its listening socket with ss, curl the local upstream, compare it with proxy_pass, and read /var/log/nginx/error.log. |
| The default Nginx page appears | The request matches another server block first, or the desired hostname is absent from server_name. |
Search enabled configurations for the hostname, disable the unintended default site if appropriate, ensure the new symlink exists, run nginx -t, and reload. |
| HTTPS warning in the browser | The certificate lacks the exact hostname, has expired, or the browser reached a different IP than the server where the certificate was installed. | Inspect the certificate names and dates, compare DNS answers with the VPS address, verify both A and AAAA paths, and check the renewal task. |
Operational and security checks
- Keep DNS records, Nginx files, and application deployment settings under change control so a rollback restores all three layers consistently.
- Use separate server blocks and least-privilege filesystem ownership for unrelated sites. Do not give a web process write access to the entire VPS.
- Bind internal applications to localhost or a private interface unless another host genuinely needs direct access.
- Monitor Nginx access and error logs, application logs, disk space, and certificate-renewal results.
- When changing an upstream port, update the application service and Nginx configuration together, then test locally before reloading.
- After adding IPv6, test from an IPv6-capable network; successful IPv4 testing alone does not validate the AAAA path.
- For every new subdomain, repeat the complete cycle: DNS record, firewall review, server block, syntax test, certificate issuance, redirect test, and log check.
The shortest reliable sequence
For a new application subdomain, the dependable order is: choose app.example.com and its local port; create an A record; add AAAA only after IPv6 works; permit ports 80 and 443; create an Nginx block with the exact server_name; test and reload; issue the ACME certificate; enable the HTTPS redirect; then verify DNS, the certificate, the redirect, and the application response. Once that pattern is correct, additional subdomains can share the same VPS and public IP without sharing the wrong content.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
