How to Create and Deploy a Flask App on VPS — Production-Ready Guide (Free & Paid Options)

# AWS EC2 uses ubuntu as the default user (not root)
ssh -i ~/.ssh/your-key.pem ubuntu@YOUR_EC2_PUBLIC_IP

# Fix key permissions if SSH complains
chmod 400 ~/.ssh/your-key.pem

# Connect as root (Hostinger/ DigitalOcean / Hetzner)
ssh root@YOUR_SERVER_IP

# Or with SSH key
ssh -i ~/.ssh/your-key root@YOUR_SERVER_IP

pip install flask gunicorn python-dotenv
pip freeze > requirements.txt

# app.py
from flask import Flask, jsonify, request
import os
from datetime import datetime

app = Flask(__name__)

# Load secret key from environment — never hardcode this
app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY', 'dev-fallback-key')

@app.route('/')
def index():
    return jsonify({
        "status":  "ok",
        "message": "Flask app is live!",
        "time":    datetime.utcnow().isoformat()
    })

@app.route('/health')
def health():
    return jsonify({"status": "healthy"}), 200

@app.route('/api/greet', methods=['POST'])
def greet():
    data = request.get_json()
    name = data.get('name', 'World') if data else 'World'
    return jsonify({"greeting": f"Hello, {name}!"})

# Only used during local development
# Gunicorn replaces this entirely in production
if __name__ == '__main__':
    debug_mode = os.environ.get('FLASK_DEBUG', 'False').lower() == 'true'
    app.run(host='0.0.0.0', port=5000, debug=debug_mode)

from flask import Flask, jsonify, request
import os
from datetime import datetime

app = Flask(__name__)

app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY', 'dev-fallback-key')

@app.route('/')
def index():
    return jsonify({
        "status":  "ok",
        "message": "Flask app is live!",
        "time":    datetime.utcnow().isoformat()
    })

@app.route('/health')
def health():
    return jsonify({"status": "healthy"}), 200

@app.route('/api/greet', methods=['POST'])
def greet():
    data = request.get_json()
    name = data.get('name', 'World') if data else 'World'
    return jsonify({"greeting": f"Hello, {name}!"})

POST /api/greet
{ "name": "Arjun" }

{ "greeting": "Hello, Arjun!" }

if __name__ == '__main__':
    debug_mode = os.environ.get('FLASK_DEBUG', 'False').lower() == 'true'
    app.run(host='0.0.0.0', port=5000, debug=debug_mode)

# wsgi.py
from app import app

if __name__ == '__main__':
    app.run()

# .env (NEVER commit this to Git — add to .gitignore)
SECRET_KEY=your-very-long-random-secret-key-here
FLASK_DEBUG=true

# .gitignore
venv/
.env
__pycache__/
*.pyc
*.pyo
instance/
.DS_Store

# Flask dev server
python app.py

# OR test Gunicorn locally
gunicorn --bind 0.0.0.0:5000 wsgi:app

# Test in another terminal
curl http://localhost:5000/
curl http://localhost:5000/health

deactivate

flaskapp/
├── app.py             ← main application
├── wsgi.py            ← Gunicorn entry point
├── requirements.txt   ← pip dependencies
├── .env               ← local secrets (NEVER upload)
├── .gitignore
└── venv/              ← virtual environment (NEVER upload)

# AWS EC2 (Free Tier)
ssh -i ~/.ssh/your-key.pem ubuntu@YOUR_EC2_PUBLIC_IP

# Paid VPS (Hostinger/ DigitalOcean / Hetzner)
ssh root@YOUR_SERVER_IP

# Create user
adduser flaskuser

# Grant sudo access
usermod -aG sudo flaskuser

# Copy SSH keys so you can log in as this user
rsync --archive --chown=flaskuser:flaskuser ~/.ssh /home/flaskuser

# Switch to new user
su - flaskuser

sudo apt update && sudo apt upgrade -y

# Reboot if kernel was updated
sudo reboot

# Python 3, pip, and build tools
sudo apt install python3 python3-pip python3-dev build-essential -y

# Verify versions
python3 --version
pip3 --version

# virtualenv
python3 -m venv myenv
source myenv/bin/activate
sudo pip3 install virtualenv

# Nginx web server
sudo apt install nginx -y

# Verify Nginx is running
sudo systemctl status nginx
# Expected: active (running)

sudo apt install python3 python3-pip python3-dev build-essential -y

python3 --version    # Prints: Python 3.x.x
pip3 --version       # Prints: pip 23.x.x

python3 -m venv myenv

source myenv/bin/activate

sudo pip3 install virtualenv

sudo apt install nginx -y

sudo systemctl status nginx

Active: active (running)

Browser ⟶ Nginx (port 80/443) ⟶ Gunicorn (port 5000) ⟶ Flask App ⟶ Response

# Run on your LOCAL machine

# AWS EC2
scp -i ~/.ssh/your-key.pem -r ~/flaskapp ubuntu@YOUR_EC2_IP:/home/ubuntu/

# Paid VPS
scp -r ~/flaskapp flaskuser@YOUR_SERVER_IP:/home/flaskuser/

# On LOCAL machine — push to GitHub
cd ~/flaskapp
git init
git add .
git commit -m "Initial Flask app"
git remote add origin https://github.com/yourusername/flaskapp.git
git push -u origin main

git push -u origin main

Username for 'https://github.com': yourusername
Password for 'https://yourusername@github.com': ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

git log --oneline -3 # Should show your commits

# On SERVER — clone the repo
cd /home/flaskuser # or /home/ubuntu for AWS

git clone https://github.com/yourusername/flaskapp.git
cd flaskapp

cd /home/flaskuser/flaskapp # or /home/ubuntu/flaskapp on AWS

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
deactivate

nano /home/flaskuser/flaskapp/.env

SECRET_KEY=generate-a-long-random-string-here
FLASK_DEBUG=false
FLASK_ENV=production
# DATABASE_URL=postgresql://user:pass@localhost/mydb

openssl rand -hex 32
# Copy output as your SECRET_KEY value

/home/flaskuser/flaskapp/       ← /home/ubuntu/flaskapp on AWS
├── app.py
├── wsgi.py
├── requirements.txt
├── .env                        ← created directly on server
└── venv/                       ← created on server

cd /home/flaskuser/flaskapp
source venv/bin/activate

gunicorn --bind 0.0.0.0:5000 wsgi:app
# Expected: [INFO] Listening at: http://0.0.0.0:5000

# Test from another terminal or browser
curl http://YOUR_SERVER_IP:5000/

deactivate

sudo nano /etc/systemd/system/flaskapp.service

[Unit]
Description=Gunicorn instance to serve Flask application
After=network.target

[Service]
# --- CHANGE THIS based on your setup ---
# AWS EC2:   User=ubuntu  and paths use /home/ubuntu/flaskapp
# Paid VPS:  User=flaskuser and paths use /home/flaskuser/flaskapp
User=flaskuser
Group=www-data

WorkingDirectory=/home/flaskuser/flaskapp
EnvironmentFile=/home/flaskuser/flaskapp/.env
Environment="PATH=/home/flaskuser/flaskapp/venv/bin"

# Workers formula: (2 × CPU cores) + 1
# t2.micro (1 CPU) → 3 workers
# Paid VPS 2 CPU   → 5 workers
ExecStart=/home/flaskuser/flaskapp/venv/bin/gunicorn \
    --workers 3 \
    --bind unix:/home/flaskuser/flaskapp/flaskapp.sock \
    -m 007 \
    --access-logfile /var/log/flaskapp/access.log \
    --error-logfile  /var/log/flaskapp/error.log \
    wsgi:app

Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

# Create log directory
sudo mkdir -p /var/log/flaskapp
sudo chown flaskuser:flaskuser /var/log/flaskapp
# AWS: sudo chown ubuntu:ubuntu /var/log/flaskapp

# Reload systemd, enable, and start
sudo systemctl daemon-reload
sudo systemctl enable flaskapp
sudo systemctl start flaskapp

# Verify
sudo systemctl status flaskapp
# Expected: Active: active (running)

sudo nano /etc/nginx/sites-available/flaskapp

server {
    listen 80;

    # --- CHOOSE BASED ON YOUR SETUP ---
    # Free (no domain): use server IP
    # server_name YOUR_SERVER_IP;
    #
    # Free (AWS + no domain): use EC2 public DNS
    # server_name ec2-xx-xx-xx-xx.compute.amazonaws.com;
    #
    # Paid domain: use your domain
    # server_name yourdomain.com www.yourdomain.com;
    server_name YOUR_SERVER_IP_OR_DOMAIN;

    access_log /var/log/nginx/flaskapp_access.log;
    error_log  /var/log/nginx/flaskapp_error.log;

    client_max_body_size 16M;

    # Static files served by Nginx directly (faster)
    location /static {
        alias /home/flaskuser/flaskapp/static;
        # AWS: alias /home/ubuntu/flaskapp/static;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # All other requests → Gunicorn via Unix socket
    location / {
        include proxy_params;
        proxy_pass http://unix:/home/flaskuser/flaskapp/flaskapp.sock;
        # AWS: proxy_pass http://unix:/home/ubuntu/flaskapp/flaskapp.sock;

        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 60s;
        proxy_read_timeout    60s;
        proxy_send_timeout    60s;
    }
}

# Enable site
sudo ln -s /etc/nginx/sites-available/flaskapp \
/etc/nginx/sites-enabled/

# Remove default site
sudo rm -f /etc/nginx/sites-enabled/default

# Test config — always do this before restarting
sudo nginx -t
# Expected: syntax is ok / test is successful

# Reload Nginx
sudo systemctl reload nginx

# Allow SSH first — do this BEFORE enabling UFW
sudo ufw allow ssh
sudo ufw allow 22/tcp

# Allow HTTP and HTTPS
sudo ufw allow 'Nginx Full'

# Enable firewall
sudo ufw enable

# Verify active rules
sudo ufw status verbose

http://YOUR_SERVER_IP

Type: A Name: @ Value: YOUR_SERVER_IP TTL: 300
Type: A Name: www Value: YOUR_SERVER_IP TTL: 300

ping yourdomain.com
# Should resolve to YOUR_SERVER_IP

sudo nano /etc/nginx/sites-available/flaskapp
# Change: server_name yourdomain.com www.yourdomain.com;
sudo nginx -t && sudo systemctl reload nginx

# Install Certbot + Nginx plugin
sudo apt install certbot python3-certbot-nginx -y

# Generate SSL certificate (replace with your domain)
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Certbot prompts:
# 1. Enter email address
# 2. Agree to terms (A)
# 3. Choose redirect: select 2 (HTTP → HTTPS auto-redirect)

# Dry-run to confirm renewal works
sudo certbot renew --dry-run

# Check renewal timer
sudo systemctl status certbot.timer

# Gunicorn service status
sudo systemctl status flaskapp

# Live log stream
sudo journalctl -u flaskapp -f

# Application logs
tail -f /var/log/flaskapp/access.log
tail -f /var/log/flaskapp/error.log

# Nginx logs
tail -f /var/log/nginx/flaskapp_access.log
tail -f /var/log/nginx/flaskapp_error.log

sudo usermod -aG flaskuser www-data
# AWS: sudo usermod -aG ubuntu www-data

sudo systemctl restart nginx
sudo systemctl restart flaskapp

# No domain (IP only)
curl http://YOUR_SERVER_IP/
curl http://YOUR_SERVER_IP/health

# With domain + SSL
curl https://yourdomain.com/
curl https://yourdomain.com/health

curl -X POST https://yourdomain.com/api/greet \
-H "Content-Type: application/json" \
-d '{"name": "Wave Function"}'

# app.py — always read from environment
import os

app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY')
app.config['DATABASE_URL'] = os.environ.get('DATABASE_URL')

if not app.config['SECRET_KEY']:
raise RuntimeError("SECRET_KEY is not set!")

# /home/flaskuser/flaskapp/.env
FLASK_DEBUG=false
FLASK_ENV=production

# App files
sudo chown -R flaskuser:www-data /home/flaskuser/flaskapp
# AWS: sudo chown -R ubuntu:www-data /home/ubuntu/flaskapp

sudo chmod -R 750 /home/flaskuser/flaskapp

# .env — owner-read only
chmod 600 /home/flaskuser/flaskapp/.env

# Log directory
sudo chmod 755 /var/log/flaskapp

# 1. Disable root SSH login
sudo nano /etc/ssh/sshd_config
# Set: PermitRootLogin no
# Set: PasswordAuthentication no
sudo systemctl restart sshd

# 2. Install fail2ban (blocks SSH brute force)
sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban

# 3. Automatic security updates
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure unattended-upgrades

# 4. Check listening ports (should only see 22, 80, 443)
sudo ss -tlnp

cd /home/flaskuser/flaskapp
git pull origin main

source venv/bin/activate
pip install -r requirements.txt
deactivate

# Graceful reload — zero downtime
sudo systemctl reload flaskapp

Internet → Nginx (80/443) → Unix Socket → Gunicorn → Flask App
                                  ↑
                           systemd manages
                           (auto-start / auto-restart)