Full-Stack Web App Setup on a Fresh VPS (With Docker, Node.js, Prisma, Authentication, Frontend, and HTTPS)

sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
docker compose version

app/
  compose.yaml
  .env                 # secrets, never committed
  backend/
    Dockerfile
    package.json
    prisma/schema.prisma
    prisma.config.ts
    src/db.ts
    src/index.ts
  frontend/
    Dockerfile

npm init -y
npm pkg set type=module
npm install express helmet express-rate-limit bcryptjs jsonwebtoken prisma @prisma/client @prisma/adapter-pg dotenv
npm install -D typescript @types/express @types/jsonwebtoken @types/node
npx prisma init --datasource-provider postgresql

model User {
  id        Int      @id @default(autoincrement())
  email     String   @unique
  password  String
  createdAt DateTime @default(now())
}

import express from 'express';
import helmet from 'helmet';
import rateLimit from 'express-rate-limit';
import bcrypt from 'bcryptjs';
import jwt from 'jsonwebtoken';
import { prisma } from './db.js';

const app = express();
const JWT_SECRET = process.env.JWT_SECRET!;

app.set('trust proxy', 1);            // behind Nginx: use the real client IP
app.use(helmet());
app.use(express.json({ limit: '100kb' }));

const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 20 });

app.post('/api/register', authLimiter, async (req, res) => {
  const { email, password } = req.body ?? {};
  if (typeof email !== 'string' || typeof password !== 'string' || password.length < 10) {
    res.status(400).json({ error: 'Email and a password of 10+ characters are required' });
    return;
  }
  const hash = await bcrypt.hash(password, 12);
  try {
    const user = await prisma.user.create({ data: { email: email.toLowerCase(), password: hash } });
    res.status(201).json({ id: user.id, email: user.email });
  } catch {
    res.status(409).json({ error: 'Account already exists' });
  }
});

app.post('/api/login', authLimiter, async (req, res) => {
  const { email, password } = req.body ?? {};
  const user = typeof email === 'string'
    ? await prisma.user.findUnique({ where: { email: email.toLowerCase() } })
    : null;
  if (!user || typeof password !== 'string' || !(await bcrypt.compare(password, user.password))) {
    res.status(401).json({ error: 'Invalid email or password' });
    return;
  }
  const token = jwt.sign({ sub: String(user.id) }, JWT_SECRET, { expiresIn: '15m' });
  res.json({ token });
});

app.get('/api/me', (req, res) => {
  const token = req.headers.authorization?.replace(/^Bearer /, '');
  try {
    const payload = jwt.verify(token ?? '', JWT_SECRET) as jwt.JwtPayload;
    res.json({ user: payload.sub });
  } catch {
    res.status(401).json({ error: 'Not signed in' });
  }
});

app.listen(4000, '0.0.0.0');

FROM node:24-slim AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build && npm prune --omit=dev

FROM node:24-slim
WORKDIR /app
ENV NODE_ENV=production
COPY --from=build /app ./
USER node
CMD ["sh", "-c", "npx prisma migrate deploy && node dist/index.js"]

services:
  db:
    image: postgres:17
    environment:
      POSTGRES_USER: app
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: app
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app"]
      interval: 5s
      retries: 10
    restart: unless-stopped

  api:
    build: ./backend
    environment:
      DATABASE_URL: postgresql://app:${POSTGRES_PASSWORD}@db:5432/app
      JWT_SECRET: ${JWT_SECRET}
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "127.0.0.1:4000:4000"
    restart: unless-stopped

  web:
    build: ./frontend
    ports:
      - "127.0.0.1:3000:3000"
    restart: unless-stopped

volumes:
  pgdata:

server {
    listen 80;
    server_name example.com www.example.com;

    location /api/ {
        proxy_pass http://127.0.0.1:4000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}