Deploys a Node.js application for a website by generating a systemd unit for it, wiring up a reverse-proxy vhost, and managing the process from the panel. On deploy the plugin picks a free port in the 8300–8399 range, writes /etc/systemd/system/<app>.service through the root agent with PORT and NODE_ENV=production in the environment, and configures the site's vhost for whichever web server is in use — Nginx, Apache2, or OpenLiteSpeed. You can preview the exact unit file before anything is written. Start, stop, restart, and reload act on that unit, and logs are read back per domain.

Node runtimes are managed with nvm under /opt/nvm; the version picker offers the LTS majors 22, 20, and 18 plus whatever is already installed, and a deployment can be pinned to a specific version instead of the system default. Version probes and builds are routed to the node that actually holds the site's code rather than running on the panel host. A bootstrap step scaffolds a starter project — express, fastify, or a plain skeleton — and runs npm install as the site owner via runuser, never overwriting existing code. Dependency tooling covers npm install, installing named packages, listing installed packages, and detecting the entry point; a small web-rules form sets static and media aliases and directory indexing.

The plugin registers a website_deleting hook so an app's unit is stopped, disabled, and removed before its website is torn down. It requires websites.manage and the deploy tooling is admin-only; tenants can only call the read-only Node version listing that the create form needs. Despite the tag list, the shipped scaffolds are Express, Fastify, and plain — there is no Next.js/Nest/Nuxt template.

Min Panel Version

1.0.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Paid license required

Hooks

website_deleting

Permissions

websites.manage

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.0.14 — Limits tab: an admin sets memory caps (MemoryHigh / MemoryMax), a CPU quota and the Node.js heap (--max-old-space-size through NODE_OPTIONS; by default 75% of MemoryMax); the website owner sees them read-only. A drop-in that overrides these settings is shown as a warning. 1.0.13 — Confirmation prompts use the panel's own dialog (with a title and a clear action button) instead of the browser's confirm() box. 1.0.12 — Security: the app log in ~/logs is opened by the app itself (as the account), not by systemd as root; the log file is prepared only inside the real log folder and read as the account, so a symlink in the home cannot point root at another file. Existing units are converted on update. 1.0.11 — Deploys restart the app's background workers marked “Restart after a deploy” in Supervisor (supervisor 1.0.6+) once the deploy succeeds. 1.0.10 — Requests send the panel’s own CSRF token: the cookie was matched by a pattern that also took any cookie whose name ends in “csrftoken” (another app on the same host), and the request was refused with 403. 1.0.9 — Environment variables: a per-app editor (Configuration → Environment) saved to an owner-only env file the service loads with EnvironmentFile=; names are validated, values are hidden after saving and the app can be restarted on save. Deploy from Git (new Git tab): link a repository + branch (private repositories use the site account's deploy key, shared with Git Manager); "Deploy now" fetches the branch, resets the app folder to it, runs npm install and npm run build, then restarts the app — every step runs as the site's account, with its output in a deploy log. Push to deploy: a per-app webhook URL and HMAC secret for GitHub, GitLab or Bitbucket; unsigned requests and pushes to other branches are ignored. Releases: the last deploys are listed and the last 5 successful ones can be rolled back to; rollback checks the commit out again and rebuilds it. 1.0.8 — Status, Stop and website deletion now read the app's service on the node that runs it: an app on a node showed as not deployed, and deleting its site left it running. Security: the starter package.json and index.js are now confined to the site owner's home. A symlink planted in the site folder could make them land on a system file, owned by the site account. 1.0.7 — Deploying makes sure the site account can write its app logs in ~/logs (an ACL, adding the acl package where a node lacks it). 1.0.6 — Website owners can deploy their own Node.js sites: the Deploy card shows on the Advanced tab of a Node.js site for its owner (scoped to that site, within the versions and packages the admin allows). The runtime manager in the sidebar stays admin-only. 1.0.5 — "Reload" no longer stops the app: it sent SIGHUP, which ends a Node.js process, and systemd took that as a clean exit, so the site stayed on a 502 until someone pressed Start. Reload now restarts the service, and new units no longer carry the HUP reload. 1.0.4 — Deployed apps get an "Edit settings" action that opens the deploy form prefilled with the settings the app is running with (port, entry point, Node.js version); app path, user and service name are shown read-only. Re-deploying with port 0 now keeps the app's current port instead of moving it to a new one; tick "Pick a new free port instead" to get a new one.

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/node-deploy/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "node-deploy",
  "version": "1.0.14",
  "download_url": "..."
}