Case Study
End-to-End Deployment of Guidra Backend on Azure VM
Azure VM → Nginx → Node.js → MongoDB Atlas
Executive Summary
This case study documents the production deployment of the Guidra backend API on Microsoft Azure infrastructure. The implementation demonstrates production-oriented deployment practices including security hardening, reverse proxy configuration, SSL termination, process management, and cloud database integration.
Technologies Used:Azure VM (Ubuntu 24.04), Nginx, Node.js, PM2, MongoDB Atlas, Let's Encrypt
Key Metrics:
- API latency: ~150–230ms
- Memory usage: ~600MB (idle)
- Uptime tested: 7+ days
- SSL rating: A (Qualys SSL Labs)
- Deployment time: less than 30 seconds (automated script)
- Availability: verified during deployment and validation testing
1. System Architecture
Internet → Azure NSG → UFW → Nginx (reverse proxy) → PM2 → Node.js App → MongoDB Atlas
| Layer | Technology | Purpose |
|---|---|---|
| Cloud | Azure VM (B2als v2) | Compute infrastructure |
| Network | Azure NSG + UFW | Defense-in-depth firewall |
| Web Server | Nginx | Reverse proxy, SSL termination |
| Runtime | Node.js 20 LTS | Application execution |
| Process | PM2 | Process management, auto-restart |
| Database | MongoDB Atlas | Cloud database service |
| Security | fail2ban, SSH hardening | Intrusion prevention |
| SSL | Let's Encrypt | Free automated certificates |
2. Deployment Phases
Infrastructure Foundation
- Azure VM provisioning with static public IP
- SSH key authentication (password-less)
- Deploy user creation (non-root)
- UFW configuration (ports 22, 80, 443 only)
Security Implementation
- SSH hardening (/etc/ssh/sshd_config modifications)
- fail2ban configuration with custom jail
- Automatic security updates enabled
- Azure NSG rules configured
Application Stack
- NVM + Node.js LTS installation
- PM2 process manager setup
- MongoDB Atlas connection with SRV string
- Environment variable management
Web Server Configuration
- Nginx reverse proxy setup
- SSL certificates via Let's Encrypt
- HTTP → HTTPS redirection
- Custom domain configuration
3. Challenges & Solutions
Key Incident: Self-inflicted SSH ban due to fail2ban testing led to Azure emergency recovery—validated both fail2ban functionality and cloud provider fallback mechanisms. Nginx IPv6-only binding required explicit listen 0.0.0.0:80 directive. Domain DNS propagation delays necessitated verification tools for troubleshooting.
4. Security Hardening
Defense-in-depth approach with multiple security layers: Azure NSG firewall restricts inbound to ports 22, 80, 443. UFW provides host-level firewall. fail2ban blocks brute force attempts (3 strikes = 1 hour ban). SSH hardened with key-only authentication and root login disabled. Automatic security updates via unattended-upgrades. SSL certificates auto-renewed via Let's Encrypt.
5. Production Validation
- Server reboot persistence: PM2 auto-restart verified
- Process crash recovery: PM2 respawned within 2 seconds
- Nginx auto-start: Active post-reboot confirmed
- SSL auto-renewal: certbot renew dry-run successful
- Firewall validation: nmap verified only specified ports open
6. Lessons Learned
- Cloud Infrastructure: Azure VMs require explicit NSG configuration for security
- Network Security: Defense-in-depth with multiple firewall layers is essential
- Process Management: PM2 provides reliable process supervision and auto-restart
- SSL/TLS: Let's Encrypt + Certbot simplifies certificate management
- Intrusion Prevention: fail2ban requires careful testing to avoid self-lockout
- Automation: Deployment scripts reduce manual steps and human error
- Monitoring: Regular testing (reboots, restarts) validates production readiness