One server, many apps: a self-hosted app platform
A repeatable way to run Laravel, Node, Next.js and Docker apps side by side on one Linux server, with HTTPS and push-to-deploy.
- Engagement
- Own product
- Role
- Designed and built
- Status
- Internal
In plain words
Before
Small products often end up with a separate hosting bill for each app, or one server configured by hand that only one person understands. Every new app means another round of manual setup, certificates that quietly expire, and releases done by copying files to the server and hoping nothing breaks.
What I built
I built a repeatable way to run many apps on one Linux server. A single bootstrap script prepares a fresh machine with the web server, PHP, a database, Node, a firewall and protection against repeated break-in attempts. Every app then follows the same layout and has its own deploy script, whether it is a Laravel site, a Node API, a Next.js front end or a Docker-based product.
Releases are push-to-deploy: merging code triggers GitHub Actions, which asks the server to run that app’s deploy script. Each app gets its own domain with HTTPS, and only the web server is exposed to the internet.
This is not a template on paper. The MidnightMM and EzeeRecap platforms in these case files run on it today, alongside other apps.
Under the hood
Architecture
- GitHub Actions
- Restricted SSH key
- Deploy script
- Nginx + HTTPS
- Laravel · Node · Docker apps
Stack
- Ubuntu, Bash bootstrap script
- Nginx, PHP-FPM, MariaDB
- Node via nvm, PM2
- Docker Compose
- Let's Encrypt (Certbot)
- UFW, fail2ban, SSH hardening
- GitHub Actions over SSH
Decisions
- Deploy logic lives in versioned scripts on the server, and CI only triggers them over SSH with a command-restricted key, so a leaked CI secret cannot run arbitrary commands.
- Each app family has a predictable layout and runtime. Laravel runs on PHP-FPM with its environment file and storage kept outside the release, Node and Next.js run under PM2 on internal ports, and newer products run as one Docker Compose project each.
- Only Nginx faces the internet. Apps listen on loopback ports behind it, and HTTPS certificates come from Let's Encrypt.
- One bootstrap script builds the hardened base, with SSH hardening, a UFW firewall and fail2ban. This website deploys through a dedicated, command-restricted CI key.
- Every deploy script is run and checked by hand before CI is connected to it.