Deploying Isolated Web Applications with Yunohost Reverse Proxy
Learn how to deploy and manage isolated web applications using Yunohost's automated reverse proxy and system-user isolation to prevent lateral movement.
22 Dec 2025, 04:26 UTC
When hosting multiple web services on a single server, the primary risk is lateral movement: if one application is compromised, an attacker could potentially access the data of every other service on that machine. Yunohost mitigates this by enforcing a strict isolation architecture where each application runs under a unique system user and sits behind an automated Nginx reverse proxy.
The critical takeaway for administrators is to avoid manual modifications to Nginx configuration files or SSL certificate management. Instead, use the Yunohost CLI to manage the lifecycle of services, ensuring that file system permissions and proxy routing remain consistent and sandboxed.
Prerequisites for Application Deployment
Before deploying isolated applications, ensure the following environment conditions are met:
- A clean Debian-based installation with Yunohost already installed.
- A registered domain name or subdomain pointed to your server's public IP address.
- Ports 80 (HTTP) and 443 (HTTPS) open on your firewall to allow external traffic.
- Minimum 2GB of RAM if deploying resource-heavy services such as Nextcloud to prevent service failure.
Deploying and Isolating Applications via CLI
Yunohost uses the yunohost command-line tool to automate the creation of dedicated system users, directory permissions, and the generation of Nginx virtual hosts.
Step 1: Identify Available Applications
Connect to your server via SSH and list the available packages to find the desired service:
sudo yunohost app list
Step 2: Install the Application
To install a service (e.g., Nextcloud), use the install command. Replace the placeholder with your actual configured subdomain:
sudo yunohost app install nextcloud --domain cloud.example.com
The system will prompt for confirmation if the domain is not already mapped. Once confirmed, Yunohost resolves dependencies, creates the isolated system user, and requests an SSL certificate from Let's Encrypt.
Verifying Isolation and Routing
After installation, you must verify that the service is running and that the reverse proxy is routing traffic to the correct isolated user.
Check Service Status
Run the following command to ensure the application is marked as "running":
sudo yunohost app list
Inspect the Nginx Configuration
Yunohost generates configuration files in /etc/nginx/sites-enabled/. You can verify that a proxy entry exists for your application by listing the directory:
ls -l /etc/nginx/sites-enabled/ | grep cloud.example.com
Warning: Do not edit these files manually. Yunohost will overwrite manual changes during package updates or system reconfigurations.
Test SSL and Connectivity
Navigate to https://cloud.example.com in a web browser. Click the padlock icon in the address bar to verify that the certificate is issued by Let's Encrypt and the chain is valid.
Troubleshooting Deployment Issues
If the application fails to start or returns a 502 Bad Gateway, use the following diagnostic decision table:
| Issue | Diagnostic Action | Expected Check |
|---|---|---|
| Port Conflict | Run sudo ss -tulpn | grep :80 | Ensure no other web server is bound to port 80. |
| Memory Exhaustion | Check system logs with dmesg | Look for "Out of memory: Kill process" (OOM killer) entries. |
| Permission Denied | Inspect /var/www/appname/ | Verify the application-specific system user owns the directory. |
Recovery Options
If an installation fails halfway through or becomes unstable, you can remove the application and its associated system user to reset the state:
sudo yunohost app remove nextcloud --domain cloud.example.com --force
yunohost
nginx
debian0 replies
A thoughtful contribution can make all the difference. Be the first to share one.