Headless CMS architectures have become the gold standard for decoupling content management from modern frontend frameworks like Next.js, Nuxt, Astro, and mobile Flutter\/React Native apps. Strapi is the leading open-source Node.js headless CMS, offering an intuitive administrative UI, dynamic content-type builders, automated GraphQL\/REST API generation, and granular role-based permissions. While managed SaaS platforms charge hundreds of dollars per month with strict record limits, self-hosting Strapi on a cloud Linux VPS gives you unlimited content types, full database ownership, custom plugins, and complete privacy at zero recurring software costs.<\/p>\n
In this end-to-end production deployment guide, we will configure Strapi on Ubuntu 24.04\/22.04 LTS backed by enterprise PostgreSQL, managed by PM2 process manager for continuous background execution, secured behind an Nginx reverse proxy, and encrypted with Let’s Encrypt SSL.<\/p>\n
Strapi requires active Node.js LTS versions (Node.js 18 or 20) along with essential native C++ build tools like Production Strapi deployments should always utilize PostgreSQL instead of lightweight SQLite for superior concurrency, ACID transaction guarantees, and reliable automated backups:<\/p>\n Create your Strapi application in a standardized production directory like Create a production environment file at Build the production admin panel bundle:<\/p>\n To ensure Strapi starts automatically upon server reboot and restarts automatically if memory thresholds are exceeded, create a PM2 ecosystem file Start the daemon and generate the systemd startup hook:<\/p>\n Strapi requires handling large media library uploads and real-time dashboard updates. Configure Enable the virtual host and acquire a free Let’s Encrypt SSL certificate:<\/p>\n When running a headless CMS in production, storing user-uploaded media files (high-resolution images, PDF documents, video clips) directly on the local VPS SSD can quickly exhaust local disk capacity and complicate disaster recovery. The recommended industry practice is to offload media storage to S3-compatible cloud object storage (such as Cloudflare R2, AWS S3, or Backblaze B2).<\/p>\n Install the official S3 upload provider plugin inside your Strapi application directory:<\/p>\n Configure the provider in Exposing an administrative CMS to the public internet requires robust defenses against credential stuffing and brute-force attacks. Implement rate limiting and security headers in your Nginx reverse proxy configuration:<\/p>\ngcc<\/code>, g++<\/code>, and make<\/code> to compile database bindings:<\/p>\n# Install Node.js 20 LTS via official NodeSource repository\ncurl -fsSL https:\/\/deb.nodesource.com\/setup_20.x | sudo -E bash -\nsudo apt update && sudo apt install -y nodejs build-essential git\n\n# Verify Node and NPM runtime versions\nnode -v\nnpm -v\n\n# Install PM2 process manager globally\nsudo npm install -g pm2<\/code><\/pre>\nStep 2: Installing and Hardening PostgreSQL Database<\/h2>\n
# Install PostgreSQL server and client libraries\nsudo apt install -y postgresql postgresql-contrib\n\n# Switch to postgres user and create dedicated database & user\nsudo -u postgres psql << 'EOF'\nCREATE DATABASE strapi_production;\nCREATE USER strapi_admin WITH ENCRYPTED PASSWORD 'UltraSecureDbPass2026!';\nGRANT ALL PRIVILEGES ON DATABASE strapi_production TO strapi_admin;\nALTER DATABASE strapi_production OWNER TO strapi_admin;\n\\q\nEOF<\/code><\/pre>\nStep 3: Initializing and Building the Strapi Project<\/h2>\n
\/var\/www\/strapi-app<\/code>:<\/p>\ncd \/var\/www\n# Initialize Strapi with no quickstart template to connect PostgreSQL\nnpx create-strapi-app@latest strapi-app --no-run\n\n# Navigate into project directory\ncd \/var\/www\/strapi-app<\/code><\/pre>\n\/var\/www\/strapi-app\/.env<\/code> with cryptographically secure random keys:<\/p>\nHOST=127.0.0.1\nPORT=1337\n\n# App security keys\nAPP_KEYS=generate_random_key_1,generate_random_key_2\nAPI_TOKEN_SALT=generate_random_salt_1\nADMIN_JWT_SECRET=generate_random_admin_secret\nTRANSFER_TOKEN_SALT=generate_random_transfer_salt\nJWT_SECRET=generate_random_jwt_secret\n\n# Database Configuration\nDATABASE_CLIENT=postgres\nDATABASE_HOST=127.0.0.1\nDATABASE_PORT=5432\nDATABASE_NAME=strapi_production\nDATABASE_USERNAME=strapi_admin\nDATABASE_PASSWORD=UltraSecureDbPass2026!\nDATABASE_SSL=false<\/code><\/pre>\nNODE_ENV=production npm run build<\/code><\/pre>\nStep 4: Configuring PM2 Cluster Daemon and Ecosystem<\/h2>\n
\/var\/www\/strapi-app\/ecosystem.config.js<\/code>:<\/p>\nmodule.exports = {\n apps: [\n {\n name: 'strapi-cms',\n cwd: '\/var\/www\/strapi-app',\n script: 'npm',\n args: 'run start',\n env: {\n NODE_ENV: 'production',\n },\n instances: 1,\n autorestart: true,\n max_memory_restart: '800M',\n error_file: '\/var\/log\/strapi-error.log',\n out_file: '\/var\/log\/strapi-out.log',\n },\n ],\n};<\/code><\/pre>\npm2 start ecosystem.config.js\npm2 save\npm2 startup systemd<\/code><\/pre>\nStep 5: Nginx Reverse Proxy with WebSocket & File Upload Buffers<\/h2>\n
\/etc\/nginx\/sites-available\/cms.example.com<\/code>:<\/p>\nserver {\n listen 80;\n server_name cms.example.com;\n\n client_max_body_size 50M;\n\n location \/ {\n proxy_pass http:\/\/127.0.0.1:1337;\n proxy_http_version 1.1;\n proxy_set_header X-Forwarded-Host $host;\n proxy_set_header X-Forwarded-Server $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n proxy_set_header Host $http_host;\n proxy_set_header Upgrade $http_upgrade;\n proxy_set_header Connection \"Upgrade\";\n }\n}<\/code><\/pre>\nsudo ln -s \/etc\/nginx\/sites-available\/cms.example.com \/etc\/nginx\/sites-enabled\/\nsudo nginx -t && sudo systemctl reload nginx\nsudo certbot --nginx -d cms.example.com<\/code><\/pre>\nProduction Hardening & Performance Checklist<\/h2>\n
\n
@strapi\/provider-upload-aws-s3<\/code> to store media library images on cloud object storage rather than filling local VPS storage.<\/li>\npg_dump<\/code> cron jobs encrypted and synchronized to offsite storage.<\/li>\n<\/ul>\nAutomating Production Media Backups with S3-Compatible Object Storage<\/h2>\n
# Install Strapi S3 provider\nnpm install @strapi\/provider-upload-aws-s3 --save<\/code><\/pre>\n\/var\/www\/strapi-app\/config\/plugins.js<\/code>:<\/p>\nmodule.exports = ({ env }) => ({\n upload: {\n config: {\n provider: 'aws-s3',\n providerOptions: {\n s3Options: {\n accessKeyId: env('AWS_ACCESS_KEY_ID'),\n secretAccessKey: env('AWS_ACCESS_SECRET'),\n region: env('AWS_REGION'),\n endpoint: env('AWS_ENDPOINT'),\n params: {\n Bucket: env('AWS_BUCKET'),\n },\n },\n },\n actionOptions: {\n upload: {},\n uploadStream: {},\n delete: {},\n },\n },\n },\n});<\/code><\/pre>\nSecuring Strapi Headless CMS with Web Application Firewalls<\/h2>\n
# Rate limit zone: 10 requests per second per IP\nlimit_req_zone $binary_remote_addr zone=strapi_limit:10m rate=10r\/s;\n\nserver {\n server_name cms.example.com;\n\n # Apply rate limiting to admin login endpoints\n location \/admin {\n limit_req zone=strapi_limit burst=15 nodelay;\n proxy_pass http:\/\/127.0.0.1:1337;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n }\n}<\/code><\/pre>\nRecommended Related Technical Guides<\/h3>\n