GitHub Actions Deployment to Ubuntu VPS
SSH-based deploy pipelines that build Next.js apps and reload PM2 without exposing secrets in logs.
Pipeline shape
A typical workflow runs lint and test on push, builds artifacts on main, then deploys through SSH to your VPS. Keeping build on CI ensures the server does not compile with missing devDependencies.
Vcom Web Tech stores deploy keys as GitHub secrets and restricts SSH users to deployment commands via forced commands when security requirements are high.
Separate staging and production workflows with environment protection rules.
Remote steps
On the server, deploy scripts pull or rsync release directories, run npm ci --omit=dev, execute migrations, and pm2 reload. Use release folders with current symlink for quick rollback.
Never print environment files in CI logs. Mask secrets and validate .env permissions on the server.
Health check URLs after deploy before marking the workflow green.
Zero downtime considerations
Long migrations may require maintenance mode toggles at Nginx. Communicate expected downtime windows.
Concurrent deploys from multiple branches need locking so two workflows do not overwrite each other's releases.
Tag releases in git so rollback is a pointer move plus reload, not a scramble.
Observability
Notify Slack or email on failure with links to workflow runs. Success notifications are optional but help small teams trust automation.
Store artifact hashes deployed on each host to debug partial deploys.
Audit who can approve production environment deployments in GitHub settings.
Additional operational notes
Operational excellence on Linux hosting requires documenting every change to Nginx, systemd, PM2, Docker, and DNS in a runbook your team shares. Vcom Web Tech clients benefit when staging environments mirror production firewall rules, TLS versions, and mail authentication so surprises appear before customers notice. Schedule quarterly reviews of backups, certificate expiry, DMARC reports, and monitoring alerts even when traffic feels stable.
When incidents occur, capture timelines and root causes in blameless postmortems. Patterns from past 502 errors, failed renewals, or bounce spikes inform checklists for the next deployment. Training new team members on SSH access, log locations, and escalation paths reduces dependency on single maintainers.
Security patches, dependency upgrades, and framework migrations should ride the same CI pipelines that deploy application code. Automate smoke tests that hit health endpoints and send test mail through staging SMTP relays. Small consistent investments beat heroic firefighting during launch weekends.
Capacity planning matters on VPS hosts where vertical scaling has limits. Watch disk inode usage, connection counts, and database connection pools as traffic grows. Proactive upgrades cost less than emergency migrations during peak sales or campaign sends.
Finally, communicate with stakeholders using plain language about risk, downtime windows, and deliverability metrics. Technical depth supports trust when email authentication or deployment strategy changes affect revenue-facing systems.
Additional operational notes
Operational excellence on Linux hosting requires documenting every change to Nginx, systemd, PM2, Docker, and DNS in a runbook your team shares. Vcom Web Tech clients benefit when staging environments mirror production firewall rules, TLS versions, and mail authentication so surprises appear before customers notice. Schedule quarterly reviews of backups, certificate expiry, DMARC reports, and monitoring alerts even when traffic feels stable.
When incidents occur, capture timelines and root causes in blameless postmortems. Patterns from past 502 errors, failed renewals, or bounce spikes inform checklists for the next deployment. Training new team members on SSH access, log locations, and escalation paths reduces dependency on single maintainers.
Security patches, dependency upgrades, and framework migrations should ride the same CI pipelines that deploy application code. Automate smoke tests that hit health endpoints and send test mail through staging SMTP relays. Small consistent investments beat heroic firefighting during launch weekends.
Capacity planning matters on VPS hosts where vertical scaling has limits. Watch disk inode usage, connection counts, and database connection pools as traffic grows. Proactive upgrades cost less than emergency migrations during peak sales or campaign sends.
Finally, communicate with stakeholders using plain language about risk, downtime windows, and deliverability metrics. Technical depth supports trust when email authentication or deployment strategy changes affect revenue-facing systems.