Node.js 22

sudo systemctl is-active sac-app.service nginx.service nodejs-firstboot.service node --version npm --version pnpm --version pm2 --version

sudo cat /stage/scripts/nodejs-credentials.log

The credentials log holds the per-VM SESSION_SECRET, which Express uses to sign session cookies. It also holds the per-VM NODEAPP_ADMIN_API_KEY, which you pass in the X-Admin-Key header to reach /api/admin.

The same values are mirrored into /etc/nodeapp/sac.env, which the sac-app.service systemd unit reads at start-up.

curl -sf -o /dev/null -w 'homepage: HTTP %{http_code}\n' http://127.0.0.1/
curl -sf http://127.0.0.1/api/info | python3 -m json.tool | head -10

The first call hits the Express homepage through nginx. The second confirms that the JSON API is alive and reports the same nodeVersion you saw in Step 4.

Open http://<vm-ip>/ in a browser. The Express + EJS homepage renders the running Node version, the npm version, the request URL and the user agent. It also shows a small live block driven by the /ws WebSocket echo endpoint.

Visit http://<vm-ip>/api/info. Chrome and Firefox pretty-print the JSON. Your front-end SPA, mobile client or a downstream service would consume the same response programmatically.

/api/admin requires the X-Admin-Key header. Visiting it without the key in a plain browser returns HTTP 401 Unauthorized with a JSON error body. This response proves that the key check is wired correctly.

To call it successfully from your terminal, run:

KEY=$(sudo grep '^NODEAPP_ADMIN_API_KEY=' /stage/scripts/nodejs-credentials.log | cut -d= -f2-)
curl -sf -H "X-Admin-Key: ${KEY}" http://127.0.0.1/api/admin | python3 -m json.tool

sac-app.service runs the app through pm2-runtime, so the systemd unit is the supervisor. To list the running pm2 processes as the nodeapp user, run:

sudo -u nodeapp pm2 list
sudo journalctl -u sac-app.service --no-pager -n 20

The pm2 list output shows a single sac-app process with its CPU, memory and restart counters. The journal tail shows the last twenty Express request log lines from morgan.

To add a runtime dependency to the SecureAnyCloud sample app, run the following and replace <package> with the npm package you need:

cd /opt/nodeapp/sac
sudo -u nodeapp npm install <package>
sudo systemctl restart sac-app.service

Run the install as the nodeapp user, so that node_modules/ keeps the right ownership. The systemd restart makes pm2-runtime re-spawn the worker against the updated module tree.

The SecureAnyCloud sample app ships in fork mode (one worker). To run cluster mode across all CPU cores, edit /opt/nodeapp/sac/ecosystem.config.js and set the instances field on the sac-app block:

instances: "max", exec_mode: "cluster",

Then restart:

sudo systemctl restart sac-app.service
sudo -u nodeapp pm2 list

instances: "max" tells pm2 to spawn one worker per CPU core (2 on Standard_B2s, 4 on Standard_B4s_v2, and so on). Use a number such as instances: 2 if you want to leave headroom for nginx and the OS.

Edit /etc/nginx/sites-available/nodeapp-sac, set the server_name to your hostname, and reload nginx:

sudo sed -i 's/server_name _;/server_name apps.example.com;/' /etc/nginx/sites-available/nodeapp-sac
sudo nginx -t sudo systemctl reload nginx

nginx -t checks the configuration syntax without applying it. reload swaps configs without dropping live connections.

Point your domain's DNS A record at this VM, then run:

sudo apt-get install -y python3-certbot-nginx
sudo certbot --nginx -d apps.example.com -m you@example.com --agree-tos --non-interactive --redirect

Certbot edits /etc/nginx/sites-available/nodeapp-sac to add the SSL server block plus a :80 → :443 redirect, then reloads nginx.

The certbot.timer systemd unit handles renewal and runs twice daily.

Node.js 22 is held at the major version with apt-mark hold nodejs, so an unattended apt-get upgrade never crosses a major boundary. To take a 22.x patch upgrade explicitly, run:

sudo apt-mark unhold nodejs
sudo apt-get update
sudo apt-get install -y --only-upgrade nodejs
sudo apt-mark hold nodejs
sudo systemctl restart sac-app.service

To run multiple Node versions side by side (for example a legacy Node 18 service and a new Node 22 service on the same VM), install nvm per user and let each developer pin their own runtime:

curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/master/install.sh | bash . ~/.bashrc nvm install 22 nvm use 22

The system-wide NodeSource Node 22 stays in place for sac-app.service.

sudo journalctl -u sac-app.service --no-pager -n 80
sudo journalctl -u nginx.service --no-pager -n 30
sudo tail -50 /var/log/nginx/access.log
sudo tail -50 /var/log/nginx/error.log
sudo -u nodeapp pm2 logs sac-app --lines 50 --nostream

The Express app logs all requests through morgan to stdout, so journalctl -u sac-app.service is the canonical event log.

nginx has its own access and error logs at /var/log/nginx/. pm2 also keeps per-process logs under /var/lib/nodeapp/.pm2/logs/ (visible through pm2 logs).