Ruby 3

sudo systemctl is-active puma.service nginx.service postgresql.service /opt/ruby/bin/ruby --version cd /opt/rails/sac && sudo -u rails /opt/ruby/bin/bundle exec bin/rails --version

sudo cat /stage/scripts/rails-credentials.log

The file lists RAILS_URL, RAILS_ARTICLES_URL, RAILS_ADMIN_USER, RAILS_ADMIN_EMAIL and RAILS_ADMIN_PASSWORD. It also includes the per-VM RAILS_DB_NAME, RAILS_DB_USER and RAILS_DB_PASSWORD. The file is mode 0600 and readable only by root.

curl -sf -o /dev/null -w 'root: HTTP %{http_code}\n' http://127.0.0.1/
curl -sf -o /dev/null -w '/articles: HTTP %{http_code}\n' http://127.0.0.1/articles
ASSET=$(sudo find /opt/rails/sac/public/assets -type f \( -name '*.css' -o -name '*.js' \) 2>/dev/null | head -1) if [ -n "$ASSET" ]; then
curl -sf -o /dev/null -w "asset: HTTP %{http_code}\n" "http://127.0.0.1/assets/$(basename "$ASSET")"; fi

The first two calls reach Puma through nginx. The third call confirms that nginx serves precompiled assets directly from public/assets/, which is faster than going through Rails.

Browse to http://<vm-ip>/. The root path routes to articles#index. On a fresh boot, the list is empty.

Select New article, fill in the title and body fields, and submit the form.

After you submit the form, the scaffold redirects to the article detail page, where you can edit or destroy the article.

set -a; . /etc/rails/sac.env; set +a cd /opt/rails/sac
sudo -E -u rails /opt/ruby/bin/bundle exec bin/rails runner 'puts "article-count:" + Article.count.to_s'
sudo -E -u rails /opt/ruby/bin/bundle exec bin/rails runner 'puts "admin-count:" + Admin.count.to_s'

For an interactive console, use sudo -E -u rails /opt/ruby/bin/bundle exec bin/rails console. bin/rails db:migrate is idempotent, so already-applied migrations are no-ops.

Replace <Resource> and the field list with your own:

cd /opt/rails/sac
sudo -u rails /opt/ruby/bin/bundle exec bin/rails generate scaffold Comment body:text article:references
sudo -u rails /opt/ruby/bin/bundle exec bin/rails db:migrate
sudo -u rails /opt/ruby/bin/bundle exec bin/rails assets:precompile
sudo systemctl restart puma.service

The scaffold generates routes, a controller, views and a migration. After db:migrate and assets:precompile, restart Puma so that it loads the new code.

Edit /etc/rails/sac.env to raise PUMA_WORKERS, then restart:

sudo systemctl restart puma.service

The defaults on Standard_B2s are:

• PUMA_WORKERS: 2
• PUMA_THREADS_MIN: 2
• PUMA_THREADS_MAX: 8
• RAILS_ENV: production
• RAILS_LOG_TO_STDOUT: true
• RAILS_SERVE_STATIC_FILES: true
• DB: PostgreSQL 16, role SecureAnyCloud, db sac_production

For production, raise the worker count to 2 × CPU + 1 (for example, 9 on a D4s_v5).

Rails 8 ships with Rails.application.config.hosts empty by default in production, so host authorization is not enforced (unlike Django's strict ALLOWED_HOSTS). If you enable host authorization, add your domain in config/environments/production.rb:

Rails.application.config.hosts << "apps.example.com"

Then restart Puma:

sudo systemctl restart puma.service

Most setups behind nginx need no change, because the proxy passes the original Host header through and Rails accepts it.

Point your domain's DNS A record at this VM, then run Certbot:

sudo apt-get install -y python3-certbot-nginx
sudo certbot --nginx -d apps.example.com -m you@example.com --agree-tos --non-interactive --redirect

Certbot edits /etc/nginx/sites-available/rails-sac to add the SSL server block and a :80 → :443 redirect, then reloads nginx. The certbot.timer systemd unit handles renewal and runs twice daily.

To take a consistent backup while the app is running, dump the database with pg_dump and archive the ActiveStorage storage/ directory:

PASS=$(sudo grep '^RAILS_DB_PASSWORD=' /stage/scripts/rails-credentials.log | cut -d= -f2-) PGPASSWORD="$PASS" pg_dump -h 127.0.0.1 -U sac sac_production | gzip > /var/backups/sac-db-$(date +%F).sql.gz
sudo tar czf /var/backups/sac-storage-$(date +%F).tgz -C /opt/rails/sac storage

Copy /var/backups to Azure Blob Storage (az storage blob upload-batch) on a regular schedule for off-VM retention.

sudo journalctl -u puma.service --no-pager -n 80
sudo journalctl -u nginx.service --no-pager -n 30
sudo journalctl -u postgresql.service --no-pager -n 30
sudo tail -50 /var/log/nginx/access.log
sudo tail -50 /var/log/nginx/error.log

RAILS_LOG_TO_STDOUT=true sends Rails logs to the systemd journal through Puma's stdout. For more verbose output while debugging, set RAILS_ENV=development in /etc/rails/sac.env and restart Puma. Never do this in production, because it disables view caching, exposes stack traces and reloads classes on every request.