# Deploying a Full-Stack Application Across Hybrid Cloud Infrastructure This guide covers deploying a simple full‑stack app with an AWS frontend and backend that talks to an on‑prem database running in a Proxmox LXC container, plus a basic monitoring stack. It assumes you’ve completed the network setup in Article 1 and can reach ct-db from EC2 over Tailscale. ## Table of contents * Overview and architecture * Create AWS VPC (public + private subnets) * Provision EC2 instances (frontend public, backend private) * Configure frontend → backend communication (Nginx reverse proxy) * Create two LXC in Proxmox (ct-db, ct-monitor) * Proxmox host ↔ CT connectivity checks * Backend EC2 ↔ ct-db over Tailscale * Backend (Node.js + MariaDB client) setup * Database on ct-db (MariaDB recommended) * Monitoring on ct-monitor (Prometheus + Grafana) * End-to-end test and verification * Security hardening --- ## Overview and architecture High-level flow: A public frontend EC2 serves the website and proxies API requests to a private backend EC2. The backend talks to an on‑prem database (ct-db) over a Tailscale mesh to your Proxmox host. Monitoring runs in another LXC (ct-monitor). ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762714670101/2838acb6-e061-4089-aaa0-4140f468dec0.jpeg align="center") Prereqs from Article 1: * Proxmox with two LXC containers * ct-db: 192.168.8.101 (MariaDB/PostgreSQL) * ct-monitor: 192.168.8.102 (Prometheus + Grafana) * Tailscale configured * Proxmox advertises 192.168.8.0/24 * EC2 instances accept routes * Verified EC2 → ct-db connectivity (ping + TCP/3306) --- ## Create AWS VPC (public + private subnets) Minimal setup: 1. VPC with one public and one private subnet * Public subnet: Internet Gateway + route for 0.0.0.0/0 * Private subnet: NAT Gateway + route for 0.0.0.0/0 via NAT 2. Route tables * Associate the public subnet with the IGW route table * Associate the private subnet with the NAT route table Keep the backend private; you’ll reach it from the frontend using its private IP and an Nginx reverse proxy. --- ## Provision EC2 instances (frontend public, backend private) Create two EC2 instances in your VPC: one in the public subnet for the frontend and one in the private subnet for the backend. ### Frontend EC2 (Public Subnet) | Configuration | Value | | --- | --- | | AMI | Amazon Linux 2023 or Ubuntu 22.04 LTS | | Instance Type | t2.micro or t2.nano | | Subnet | Public subnet | | Auto-assign Public IP | Enable | | Security Group | SG-frontend | **SG-frontend Rules:** * Port 22 (SSH) from your IP * Port 80 (HTTP) from 0.0.0.0/0 * Port 443 (HTTPS) from 0.0.0.0/0 ### Backend EC2 (Private Subnet) | Configuration | Value | | --- | --- | | AMI | Amazon Linux 2023 or Ubuntu 22.04 LTS | | Instance Type | t2.micro or t2.nano | | Subnet | Private subnet | | Auto-assign Public IP | Disable | | Security Group | SG-backend | **SG-backend Rules:** * Port 22 (SSH) from SG-frontend * Port 3000 (TCP) from SG-frontend --- ## SSH Access and Bastion Setup ### Connect to Frontend EC2 Log into the frontend VM using SSH with your PEM key: ```bash ssh -i hybrid-cloud.pem ec2-user@ ``` ### Connect to Backend EC2 (via bastion) The backend instance has no public IP, so use the frontend as a bastion host. **Step 1:** Copy the PEM key to the frontend instance: ```bash scp -i hybrid-cloud.pem hybrid-cloud.pem ec2-user@:/home/ec2-user/ ``` **Step 2:** SSH from the frontend to the backend using its private IP: ```bash ssh -i ~/hybrid-cloud.pem ec2-user@ ``` --- ## Configure Frontend (Nginx + Static Site + Reverse Proxy) This section covers installing Nginx, creating the static HTML pages, and configuring the reverse proxy to route API requests to the backend. ### Install and Enable Nginx Update packages and install Nginx: ```bash sudo yum update -y && sudo yum upgrade -y sudo yum install -y nginx sudo systemctl enable --now nginx ``` ### Create Web Root and HTML Files Create the web root directory: ```bash sudo mkdir -p /var/www/html cd /var/www/html ``` Create `index.html`: ```html Hybrid Cloud Platform

🚀 Hybrid Cloud Platform

Seamless Integration Across Environments

Project Scope

Hybrid Cloud Infrastructure: AWS Cloud + Proxmox Homelab

AWS Proxmox Homelab
Register as a User
``` Create `register.html`: ```xml Register - Hybrid Cloud Platform
← Back to Home

Create Account

Join the Hybrid Cloud Platform

🔒 Secure Registration
Your credentials will be securely stored in our hybrid cloud infrastructure.
``` ### Configure Nginx Reverse Proxy Edit the Nginx configuration (Amazon Linux path: `/etc/nginx/nginx.conf` or create a file under `/etc/nginx/conf.d/`): ```nginx server { listen 80; server_name _; root /var/www/html; index index.html; location /api/ { proxy_pass http://:3000/; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ``` Replace `` with your backend EC2's private IP address. ### Restart Nginx Restart Nginx to apply the configuration: ```bash sudo systemctl restart nginx ``` ### Test Connectivity Optional: verify the frontend can reach the backend: ```bash ping -c 5 ``` --- ## Configure Backend (Node.js API) This section covers setting up the Node.js backend API that connects to the ct-db database over Tailscale. ### Install Node.js and Dependencies On the backend EC2 instance, install Node.js and create the application directory ```bash sudo yum update -y && sudo yum upgrade -y sudo yum install -y nodejs npm mkdir ~/simple-app && cd ~/simple-app npm init -y npm install express body-parser cors mariadb sudo yum install mariadb105 -y ``` ### Create the Backend API (server.js) Create `server.js` in the `~/simple-app` directory: ```javascript const express = require('express'); const bodyParser = require('body-parser'); const mariadb = require('mariadb'); const cors = require('cors'); const path = require('path'); const app = express(); // Middleware app.use(cors()); app.use(bodyParser.json()); app.use(express.static(path.join(__dirname, 'public'))); // Serve static files // Create MariaDB pool with increased timeouts for VPN connection const pool = mariadb.createPool({ host: '192.168.8.101', user: 'appuser', password: 'StrongPassword123', database: 'appdb', port: 3306, connectionLimit: 10, connectTimeout: 30000, // 30 seconds (default is 1000ms) acquireTimeout: 30000, // 30 seconds for pool acquisition timeout: 30000, // 30 seconds for queries socketTimeout: 30000, // 30 seconds for socket operations initializationTimeout: 30000 // 30 seconds for pool initialization }); // Test database connection on startup (async () => { try { const conn = await pool.getConnection(); console.log('✓ Database connected successfully'); conn.release(); } catch (err) { console.error('✗ Database connection failed:', err); } })(); // API Routes app.post('/api/register', async (req, res) => { const { username, password } = req.body; // Validation if (!username || !password) { return res.status(400).json({ success: false, message: 'Username and password required' }); } if (username.length < 3) { return res.status(400).json({ success: false, message: 'Username must be at least 3 characters' }); } if (password.length < 6) { return res.status(400).json({ success: false, message: 'Password must be at least 6 characters' }); } let conn; try { conn = await pool.getConnection(); const result = await conn.query( 'INSERT INTO users (username, password) VALUES (?, ?)', [username, password] ); console.log(`✓ User registered: ${username} (ID: ${result.insertId})`); res.json({ success: true, message: 'User registered successfully!', user: { username: username, id: result.insertId.toString() } }); } catch (err) { console.error('Database error:', err); // Handle duplicate username if (err.code === 'ER_DUP_ENTRY') { return res.status(409).json({ success: false, message: 'Username already exists' }); } // Generic server error res.status(500).json({ success: false, message: 'Server error occurred' }); } finally { if (conn) conn.release(); } }); // Get all users (for testing/admin purposes) app.get('/api/users', async (req, res) => { let conn; try { conn = await pool.getConnection(); const rows = await conn.query('SELECT id, username, created_at FROM users ORDER BY created_at DESC'); res.json({ success: true, users: rows }); } catch (err) { console.error('Database error:', err); res.status(500).json({ success: false, message: 'Server error' }); } finally { if (conn) conn.release(); } }); // Health check endpoint app.get('/api/health', async (req, res) => { let dbStatus = 'disconnected'; try { const conn = await pool.getConnection(); dbStatus = 'connected'; conn.release(); } catch (err) { console.error('Health check failed:', err); } res.json({ status: 'running', database: dbStatus, timestamp: new Date().toISOString() }); }); // 404 handler app.use((req, res) => { res.status(404).json({ success: false, message: 'Endpoint not found' }); }); // Error handler app.use((err, req, res, next) => { console.error('Server error:', err); res.status(500).json({ success: false, message: 'Internal server error' }); }); // Start server const PORT = process.env.PORT || 3000; app.listen(PORT, '0.0.0.0', () => { console.log('================================='); console.log(`🚀 Server running on port ${PORT}`); console.log(`📡 Access at: http://localhost:${PORT}`); console.log('================================='); }); ``` ### Run the Backend Server Start the Node.js server: ```bash node server.js ``` You should see output like: ```plaintext ================================= 🚀 Server running on port 3000 📡 Access at: http://localhost:3000 ================================= ``` --- ## Create Two LXC Containers in Proxmox This section covers creating two LXC containers on your Proxmox host: one for the database (ct-db) and one for monitoring (ct-monitor). ### Download LXC Template In the Proxmox web UI: 1. Navigate to **Datacenter → proxmox → local (storage) → Templates** 2. Click **Templates** button 3. Download a Debian or Ubuntu template (e.g., `ubuntu-22.04-standard`) ### Create ct-db Container (Database) Click **Create CT** and configure: | Field | Value | | --- | --- | | Node | proxmox | | CT ID | 101 | | Hostname | ct-db | | Password | (choose a secure password) | | Template | Debian/Ubuntu template downloaded above | | Disk Size | 10 GB | | CPU | 2 cores | | Memory | 2048 MB (2 GB) | | Swap | 512 MB | | Network - Bridge | vmbr0 | | IPv4 | Static | | IPv4/CIDR | 192.168.8.101/24 | | Gateway | 192.168.8.1 *(Router Gateway Address)* | | DNS Server | 8.8.8.8 | After creation, enable "Start at boot" in ct-db → Options. ### Create ct-monitor Container (Monitoring) Click **Create CT** and configure: | Field | Value | | --- | --- | | Node | proxmox | | CT ID | 102 | | Hostname | ct-monitor | | Password | (choose a secure password) | | Template | Debian/Ubuntu template downloaded above | | Disk Size | 10 GB | | CPU | 2 cores | | Memory | 2048 MB (2 GB) | | Swap | 512 MB | | Network - Bridge | vmbr0 | | IPv4 | Static | | IPv4/CIDR | 192.168.8.102/24 | | Gateway | 192.168.8.1 *(Router Gateway Address)* | | DNS Server | 8.8.8.8 | After creation, enable "Start at boot" in ct-monitor → Options. --- ## Configure Database on ct-db This section covers installing MariaDB, creating the database and user, and setting up the users table. ### Install and Start MariaDB Access the ct-db container console from Proxmox UI or use: ```bash pct enter 101 ``` Update and install MariaDB: ```bash sudo apt update && sudo apt upgrade -y sudo apt install -y mariadb-server sudo systemctl enable mariadb sudo systemctl start mariadb ``` ### Create Database and User Log into MariaDB: ```bash mysql -u root -p ``` Run the following SQL commands: ```sql -- Create database CREATE DATABASE appdb; -- Show current users and their hosts SELECT User, Host FROM mysql.user; -- Create user with remote access GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'%' IDENTIFIED BY 'StrongPassword123'; FLUSH PRIVILEGES; -- Verify the grant SELECT User, Host FROM mysql.user WHERE User='appuser'; -- Switch to database USE appdb; -- Create users table CREATE TABLE IF NOT EXISTS users ( id INT AUTO_INCREMENT PRIMARY KEY, username VARCHAR(255) UNIQUE NOT NULL, password VARCHAR(255) NOT NULL, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ); -- Verify table structure DESCRIBE users; EXIT; ``` ### Configure Remote Access Edit the MariaDB configuration to allow remote connections: ```bash sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf ``` Find the `bind-address` line and change it to: ```plaintext bind-address = 0.0.0.0 ``` Restart MariaDB: ```bash sudo systemctl restart mariadb ``` ## Configure Monitoring Setup on ct-monitor (Prometheus + Grafana + Node Exporter) This comprehensive section covers installing and configuring Prometheus, Grafana, and Node Exporter across all machines. ### 1\. Install on ct-monitor (192.168.8.102) Access the ct-monitor container: ```bash pct enter 102 ``` #### Install Prometheus ```bash # Access container pct enter 102 # Update system apt update && apt upgrade -y # === PROMETHEUS === useradd --no-create-home --shell /bin/false prometheus cd /tmp wget https://github.com/prometheus/prometheus/releases/download/v2.47.0/prometheus-2.47.0.linux-amd64.tar.gz tar -xvf prometheus-2.47.0.linux-amd64.tar.gz cd prometheus-2.47.0.linux-amd64 mv prometheus promtool /usr/local/bin/ mkdir -p /etc/prometheus /var/lib/prometheus mv consoles console_libraries /etc/prometheus/ chown -R prometheus:prometheus /etc/prometheus /var/lib/prometheus # Create Prometheus config (only 2 targets) cat > /etc/prometheus/prometheus.yml < /etc/systemd/system/prometheus.service < /etc/systemd/system/node_exporter.service <