Ravindra BagaleCourses & study guides मराठी Track your progress

Chapter 12: Technology Stacks — LAMP, LEMP, MEAN, MERN

Common Mistakes I See Students Make

By Last updated:

Friends, I see these stack mistakes in every batch – npm start on the server, forgetting try_files, port 27017 open. Read them once.

  • Running npm start / ng serve on the server and opening port 3000/4200 to the world instead of building and serving with Nginx.
  • Missing try_files $uri $uri/ /index.html; → refreshing a React/Angular route gives 404.
  • Copying the whole project folder (with node_modules) instead of only the dist/ build output.
  • Opening port 27017 in the security group or changing bindIp to 0.0.0.0 without authentication.
  • Installing MongoDB from an outdated distro package or mixing repository versions.
  • Building on a 1 GiB instance without swap → the build is killed (out of memory).

The same mistakes in other stacks

Mistake → fix, per stack

Spring Boot

Running mvn spring-boot:run on the server. Build a jar and run it under systemd.

ASP.NET Core

Running dotnet run on the server. Publish (dotnet publish -c Release) and run the DLL under systemd.

Django

Using runserver in production. Use Gunicorn behind nginx.

Rails

Running in development mode. Set RAILS_ENV=production and precompile assets.

Angular / React

Serving with ng serve or npm start. Build and serve static files with try_files.

PostgreSQL

listen_addresses = '*' plus a 0.0.0.0/0 line in pg_hba.conf. Keep it private.

MongoDB / Redis

Exposed without authentication. Bind to private addresses and turn on auth.

Real example

Global: waves of attacks in 2017 wiped or ransomed many MongoDB databases that had been left open to the internet without authentication. This was widely reported in security news.

Self-check

  1. The security group shows only 22 (your IP), 80 and 443.
  2. ss -tlnp shows MongoDB on 127.0.0.1:27017.
  3. A refresh on /notes/5 returns 200 (try_files works).
  4. A reboot brings back MongoDB, the API (pm2) and nginx.

Indian company example (sample): a MERN startup in Bengaluru had its MongoDB wiped by a ransom bot after opening 27017 "for one day". Their backups were 3 days old. Two simple controls (no public port, daily backups) would have prevented it.

Beginner questions I get in class

Q. Can I build React on a small EC2?
Better to build in CI or on your laptop and copy only dist/. Small instances run out of memory.

Q. Is MongoDB Atlas safer than self-hosting?
It handles many defaults for you, such as authentication, encryption and backups. You still control network access and users.

Q. Why does my Angular route 404 on refresh?
Add try_files $uri $uri/ /index.html;.

Beginner questions I get in class

Q. Should the API and the front end be on the same server?
For learning, yes. In production they are often split: the front end on S3 + CloudFront, the API on EC2, ECS or Lambda behind a load balancer.

Q. What about environment files?
Keep .env out of Git and out of the built front end. Anything in a React or Angular bundle is visible to every user.

Key terms

  • Stack: A set of technologies used together.
  • SPA: Single-page app (React, Angular), built to static files.
  • REST API: An HTTP interface returning JSON.
  • try_files: The nginx rule that lets SPA routes work on refresh.
  • bindIp: The MongoDB setting for which addresses it listens on.
  • ODM / ORM: Libraries that map objects to documents or tables, such as Mongoose, Hibernate, EF Core and Django ORM.

Mini case study

Suppose we are a junior cloud engineer at a Bengaluru e-commerce startup (sample data). The team runs a PHP admin, a Node.js storefront API and a Python report job on two EC2 instances. Using this chapter, you write a one-page runbook: which service listens where, how to test and reload each one, which logs to read, and which ports are public (only 80 and 443, plus 22 from the office IP). New team members can then fix most problems on their own.

Recap

  • Dev servers are not production servers in any stack.
  • Databases stay private, with authentication on.