Deploying a Django project to a Hetzner VPS with Ubuntu + Nginx + Gunicorn + PostgreSQL and Automate Deployment with Github

ssh root@YOUR_SERVER_IP

apt update
apt upgrade -y

adduser yourusername

usermod -aG sudo yourusername

/* 
usermod: Modify User Account
-a: append
-G: group(s)
 */

ufw allow OpenSSH
ufw enable
ufw status

/*
ufw allows SSH connections
ufw enable will block all connections except SSH
ufw status shows the current rules
*/

exit # Log out as root
ssh yourusername@YOUR_SERVER_IP

sudo apt update
sudo apt install -y python3-pip python3-dev python3-venv libpq-dev nginx git

/*
python3-pip: Package installer for Python
python3-dev: Headers needed for building some Python packages
python3-venv: For creating virtual environments
libpq-dev: Headers needed to build the psycopg2 PostgreSQL adapter for Python
nginx: Web server
git: For cloning your project repository
*/

sudo apt install -y postgresql postgresql-contrib

sudo -u postgres psql

// Create Database
// Make sure the database name is the same as the database name set up in Django
CREATE DATABASE myprojectdb;

// Exit psql
\q

/*
For simplicity we will be using the default user 'postgres'
You can also set up a new user and grant this user the needed privileges
*/

git clone https://USERNAME:TOKEN@github.com/USERNAME/REPOSITORY.git

python3 -m venv venv
source venv/bin/activate

pip install gunicorn psycopg2-binary
pip freeze > requirements.txt

pip install -r requirements.txt

// Create a new file inside your project root folder to save secret keys
touch .env

// Edit the file
nano env

// EXAMPLE
DB_NAME=db_name
DB_USERNAME=db_user
DB_PASSWORD=db_password
DB_HOST=db_host
DB_PORT=db_port

DJANGO_DEBUG=False
DJANGO_SECRET_KEY=fdsjf32hjklds-fsf3j20fj2-dshn210

ALLOWED_HOSTS=YOUR_SERVER_IP, YOUR_DOMAIN.com, www.YOUR_DOMAIN.com

SUPER_ADMIN_PASSWORD=SUPERPASSWORD

// Save and close (Ctrl+X, then Y, then Enter)

ALLOWED_HOSTS=['YOUR_SERVER_IP', 'your_domain.com', 'www.your_domain.com']

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': os.getenv('DB_NAME'),
        'USER': os.getenv('DB_USER'),
        'PASSWORD': os.getenv('DB_PASSWORD'),
        'HOST': os.getenv('DB_HOST'),
        'PORT': os.getenv('DB_PORT'),
    }
}

STATIC_URL = '/static/'
STATICFILES_DIRS = [
    os.path.join(BASE_DIR, 'static'),
]
STATIC_ROOT = os.path.join(BASE_DIR, 'staticfiles')

MEDIA_URL = '/media/'
MEDIA_ROOT = os.path.join(BASE_DIR, 'media')

python manage.py migrate

python manage.py collectstatic

python manage.py createsuperuser

sudo nano /etc/systemd/system/gunicorn.socket

// Paste the following content in this file:
[Unit]
Description=gunicorn socket

[Socket]
ListenStream=/run/gunicorn.sock

[Install]
WantedBy=sockets.target

sudo nano /etc/systemd/system/gunicorn.service

[Unit]
Description=gunicorn daemon
Requires=gunicorn.socket
After=network.target

[Service]
User=USERNAME
Group=www-data
WorkingDirectory=/home/USERNAME/MY_PROJECT_DIR
ExecStart=/home/USERNAME/MY_PROJECT_DIR/venv/bin/gunicorn \
          --access-logfile - \
          --workers 3 \
          --bind unix:/run/gunicorn.sock \
          PROJECT_NAME.wsgi:application

[Install]
WantedBy=multi-user.target

sudo systemctl start gunicorn.socket
sudo systemctl enable gunicorn.socket // Starts socket on boot

sudo systemctl start gunicorn.service
sudo systemctl enable gunicorn.service // Starts service on boot

sudo systemctl status gunicorn.socket
sudo systemctl status gunicorn.service // Look for 'active (running)'

# Check for errors if it failed:
sudo journalctl -u gunicorn.service

sudo nano /etc/nginx/sites-available/MY_PROJECT

server {
    listen 80;
    server_name YOUR_SERVER_IP your_domain.com www.your_domain.com;

    location = /favicon.ico { access_log off; log_not_found off; }

    location /static/ {
        alias /home/USERNAME/MY_PROJECT_DIR;
    }

    location /media/ {
       root /home/USERNAME/MY_PROJECT_DIR;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/run/gunicorn.sock;
    }
}

sudo ln -s /etc/nginx/sites-available/myproject /etc/nginx/sites-enabled/

/*
ln -s  Creates a symbolic link (like a shortcut).
Source: /etc/nginx/sites-available/MY_PROJECT (your config file).
Destination: /etc/nginx/sites-enabled/ (where Nginx looks for active sites).
*/

sudo nginx -t

sudo ufw allow 'Nginx Full' // Allows both HTTP (80) and HTTPS (443)
sudo ufw status

// Show ownership and permissions of each component in the full path to a file
// -o: Shows the owner of each path component.
// -m: Shows the permissions of each path component.
sudo namei -om /home/USERNAME/MY_PROJECT_DIR/staticfiles/css/main.css

/*
You might see something like:
drwxr-x--- username username username

d: It's a directory.
rwx: The owner has read, write, and execute permissions.
r-x: The group has read and execute permissions.
---: Others (everyone else on the system) have NO permissions!!
*/

sudo chmod o+x /home/USERNAME

/*
chmod: Command to change permissions.
o+x: For others, add execute permission.
*/

sudo systemctl reload nginx

sudo apt install -y certbot python3-certbot-nginx

sudo certbot --nginx -d your_domain.com -d www.your_domain.com

/*
Follow the prompts.
Redirect traffic to HTTPS.
Certbot will automatically update your Nginx configuration 
to handle HTTPS and set up automatic renewal.
*/

// Should show 'active'
sudo systemctl status certbot.timer

// Generate a new ssh key on your LOCAL MACHINE
// # -N "": No passphrase (required for automated use)
ssh-keygen -t ed25519 -f deploy_key -N ""

// Make sure the .ssh directory exists and has correct permissions:
// -p: Create parent directories as needed (won't error if directory exists)
// ~/.ssh: The .ssh directory in your home folder (default location for SSH)
mkdir -p ~/.ssh

// 700 = sets permissions so that:
// Owner can read, write, and execute (7)
// Group and others have no permissions (0 0)
chmod 700 ~/.ssh

echo "PASTE_PUBLIC_KEY_CONTENT_HERE" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

name: Deploy Django App

on:
  push:
    branches: [ main ]

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Deploy to Server via SSH
      uses: appleboy/ssh-action@master
      with:
        host: ${{ secrets.SSH_HOST }}
        username: ${{ secrets.SSH_USER }}
        key: ${{ secrets.SSH_PRIVATE_KEY }}
        port: ${{ secrets.SSH_PORT || 22 }}
        script: |

          cd /home/${{ secrets.SSH_USER }}/MY_PROJECT_DIR

          echo ">>> Pulling latest code..."
          git pull origin main

          echo ">>> Activating venv..."
          source venv/bin/activate

          echo ">>> Installing dependencies..."
          pip install -r requirements.txt

          echo ">>> Running migrations..."
          python manage.py migrate

          echo ">>> Collecting static files..."
          python manage.py collectstatic --noinput

          deactivate

          echo ">>> Restarting Gunicorn..."
          sudo systemctl restart gunicorn.service

          echo ">>> Checking Gunicorn status..."
          sudo systemctl status gunicorn.service --no-pager

          echo ">>> Deployment finished!"

// On your server, run sudo visudo. This safely edits the sudoers file
// Add the following line at the end
YOUR_USERNAME ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart gunicorn.service, /usr/bin/systemctl status gunicorn.service

/*
This allows YOUR_USERNAME to run the restart and 
status commands for the gunicorn.service without a password.
Save and exit the editor (Ctrl+X, then Y).
*/

// See if systemd thinks the socket is active
sudo systemctl status gunicorn.socket

// If the status was failed or inactive, check its specific logs:
sudo journalctl -u gunicorn.socket --no-pager

// Verify the gunicorn.socket Configuration File exists
ls -l /etc/systemd/system/gunicorn.socket

// Double check the configuration files we created earlier
cat /etc/systemd/system/gunicorn.socket
cat /etc/systemd/system/gunicorn.service
cat /etc/nginx/sites-available/MY_PROJECT

// Make sure your settings in Django are correctly configured

// Make sure Nginx is running
sudo systemctl status nginx

// If you made changes to Gunicorn/Django code or systemd files
sudo systemctl daemon-reload
sudo systemctl restart gunicorn.service
sudo systemctl restart nginx

// Make sure your DNS records are set up and point to your SERVER_IP