Host a Node.js Express App on AWS EC2 with PM2 and Nginx

By Ravindra Bagale, trainer · LinkedIn · Last updated: 18 October 2026

1. Python app vs Node.js app, side by side

Why: a dynamic app, PHP, Python or Node.js, is hosted the same way: install the language, install the app's libraries, run the app on an internal port, keep it running in the background, and put nginx in front on port 80. Once you see the steps side by side, a new language is only new command names.

The Python side is explained step by step in Host a Python Flask app on EC2 with gunicorn and nginx.

2. Install Node.js and npm

Why: Without Node.js the server cannot run JavaScript at all, and npm is how you fetch Express. Picking a current version means you keep getting security fixes.

What: Node.js runs JavaScript outside the browser. npm (Node Package Manager) downloads libraries such as Express; it comes with Node.js.

How, on Amazon Linux 2023:

1. Launch an Amazon Linux 2023 instance (t2.micro or t3.micro) with a security group that allows SSH (22) from My IP and HTTP (80) from anywhere, and connect with ssh -i mykey.pem ec2-user@PUBLIC_IP.

2. Install Node.js and check the versions:

   sudo yum install nodejs24 -y
   node -v
   npm -v
   

3. node -v prints v24.x and npm -v prints the npm version. The nodejs24 package installs npm with it.

4. Amazon Linux 2023 has one package per Node.js version: nodejs22 and nodejs24 are current. The plain nodejs package is Node.js 18, which no longer gets security fixes, so don't use it for a new app.

How, on Ubuntu: the package is also called nodejs, and npm is a separate package:

sudo apt update
sudo apt install nodejs npm -y
node -v

3. Create the project and package.json

Why: package.json is what lets any server rebuild the app with one npm install. Without it you would have to remember every library by hand.

What: package.json describes the app: its name, its version, and the libraries it needs. It plays the role of requirements.txt, written as JSON: "key": "value" pairs inside { }, separated by commas.

How:

1. Create the folder and open the file:

   mkdir nodeapp
   cd nodeapp
   nano package.json
   

2. Write:

   {
     "name": "node-app",
     "description": "sample Express API",
     "version": "0.0.1",
     "private": true,
     "dependencies": {
       "express": "^5.3.0"
     },
     "devDependencies": {
       "mocha": "^12.0.3",
       "supertest": "^7.3.1"
     }
   }
   

3. Save with Ctrl+O, Enter, and leave with Ctrl+X.

What each part means:

1. name and version identify the app. "private": true stops it from being published to the npm registry by mistake.
2. dependencies are the libraries the app needs to run: here only Express.
3. devDependencies are only needed while you write and test the code: mocha runs tests and supertest sends test requests to the app. The live app never uses them.
4. ^5.3.0 means "version 5.3.0 or any newer 5.x". npm never jumps to 6.0 by itself, because a new major version can break the code.

A ready-made sample app is in the GitHub repository ravibagale/nodeapp; git clone https://github.com/ravibagale/nodeapp.git downloads it.

4. Write the Express app: index.js

Why: This small file is the whole app. Knowing what each line does lets you add routes and fix errors on your own.

How: nano index.js, and write:

var express = require('express');
var app = express();

app.get('/', function (req, res) {
  res.send('Hello from Node.js on EC2');
});

app.get('/getusers', function (req, res) {
  res.json({ username: 'ravi' });
});

app.listen(process.env.PORT || 3000);
module.exports = app;

What each line does:

1. require('express') loads Express from node_modules; express() creates the app object, called app.
2. app.get('/', ...) answers a GET request for /. It is the Express version of Flask's @app.route('/').
3. The function gets the request req and the response res. res.send() sends text or HTML.
4. /getusers is an API route: res.json() sends the object as JSON, {"username":"ravi"}, with the content type application/json.
5. app.listen(process.env.PORT || 3000) listens on the port in the PORT environment variable, or on 3000 if it is not set.
6. module.exports = app lets test files, such as a supertest test, load the app.

5. npm install and the node_modules folder

Why: require('express') fails until the library is in node_modules. npm install puts it there, at the versions package.json asks for.

How: inside ~/nodeapp:

npm install
ls

What happens:

1. npm reads package.json, downloads Express and every library Express itself needs, and puts them all in a new folder, node_modules, inside the project.
2. It also writes package-lock.json with the exact version of every package it installed, so the next npm install, on any server, gets the same versions.
3. node_modules belongs to this app only. That is why Node.js needs no virtual environment: two apps in two folders each have their own node_modules.
4. On a live server you can skip the test libraries with npm install --omit=dev.
5. Never copy node_modules to GitHub or between servers. Put node_modules in .gitignore, keep package.json and package-lock.json, and run npm install on each server.
6. If npm install lists vulnerabilities, npm audit shows which package; updating that package's version in package.json usually fixes it.

6. Test the app with node index.js

Why: Testing on the server first, with curl, proves the app works before nginx or the security group can get in the way.

How:

1. Start the app in the foreground:

   node index.js
   

2. The prompt does not come back: the app is running in this terminal. In a second SSH window, test it on the server itself:

   curl http://127.0.0.1:3000/
   curl http://127.0.0.1:3000/getusers
   

3. To test from your browser, add a temporary inbound rule to the security group: Custom TCP, port 3000, source My IP. Open http://PUBLIC_IP:3000/ and http://PUBLIC_IP:3000/getusers.

4. Press Ctrl+C: the app stops. Closing the SSH window stops it too. That is fine for a test, not for a live app.

7. Keep the app running with PM2

Why: An app started with node dies when the SSH window closes. A live API must keep running and come back after a crash, which is PM2's job.

What: PM2 is a process manager for Node.js. It runs the app in the background, restarts it if it crashes, keeps its logs, and can start it again after a reboot. For Node.js it does the job gunicorn and systemd do for Python.

How:

1. Install it once, globally (-g), so the pm2 command works in every folder:

   sudo npm install -g pm2
   

2. Start the app from ~/nodeapp:

   pm2 start index.js
   

3. PM2 prints a table: id 0, name index (the file name without .js), mode fork, status online. The prompt comes back, and the app keeps running after you log out.

4. The everyday commands:

   pm2 list
   pm2 logs index
   pm2 restart index
   pm2 stop index
   pm2 delete index
   

5. pm2 list shows the table again; the ↺ column counts restarts. pm2 logs index shows the app's output and errors live (Ctrl+C leaves the log view; the app keeps running). stop stops the app but keeps it in the list; delete removes it from PM2.

6. To give the app a clearer name, start it with pm2 start index.js --name nodeapp and use nodeapp in the other commands.

8. Start the app again after a reboot: pm2 startup and pm2 save

Why: PM2 itself is a normal program. After a reboot, or a stop and start of the instance, nothing starts it, so the app is down until you log in.

How:

1. Ask PM2 to create a startup service:

   pm2 startup
   

2. It prints one command that starts with sudo env PATH=$PATH:/usr/bin ... pm2 startup systemd -u ec2-user --hp /home/ec2-user. Copy that exact line and run it. It creates a systemd service, pm2-ec2-user, that starts PM2 at boot.

3. Save the list of running apps:

   pm2 save
   

4. pm2 save writes the current list to ~/.pm2/dump.pm2. At boot, PM2 starts every app in that list.

5. Test it: sudo reboot, connect again after a minute, and run pm2 list: index is online without you starting it.
6. Run pm2 save again whenever you add or delete an app.

9. Put nginx in front: proxy_pass to port 3000

Why: visitors should use plain http://ADDRESS on port 80 (and 443 for HTTPS), not port 3000. nginx receives every request and passes it on to the app. This works exactly as for a Python app; the full explanation of the reverse proxy is in Put nginx in front as the reverse proxy.

How:

1. Install and start nginx:

   sudo yum install nginx -y
   sudo service nginx start
   

2. Open the config with sudo nano /etc/nginx/nginx.conf. Inside the existing server { ... } block, after the root line, add:

   location / {
       proxy_pass http://127.0.0.1:3000;
   }
   

3. Check the file, then reload:

   sudo nginx -t
   sudo service nginx reload
   

4. nginx -t must say syntax is ok and test is successful. If not, fix the line it names and test again; the running nginx keeps the old config meanwhile.

5. Open http://PUBLIC_IP/ and http://PUBLIC_IP/getusers without a port: the Express app answers through nginx.

Close port 3000: nobody outside needs it now.

1. Delete the port 3000 rule from the security group. Keep 22 from My IP, 80, and 443 if you add HTTPS.
2. For extra safety, let the app listen only on the server itself. Change the last line but one of index.js to app.listen(process.env.PORT || 3000, '127.0.0.1'); and run pm2 restart index.
3. http://PUBLIC_IP/ still works; http://PUBLIC_IP:3000/ no longer answers.

10. Change the code: pm2 restart

Why: PM2 keeps the old code in memory. Until you restart, your edit changes nothing, which looks like a bug when it isn't.

What: PM2 loaded index.js when the app started. A change to the file does nothing until the app restarts.

Worked example: add a second API route.

1. Add a route to index.js, above the app.listen line:

   app.get('/health', function (req, res) {
     res.json({ status: 'ok' });
   });
   

2. Open http://PUBLIC_IP/health: it says Cannot GET /health, a 404 from Express. The running app still has the old code.

3. Restart it, and look at the log for errors:

   pm2 restart index
   pm2 logs index --lines 20
   

4. Open /health again: it returns {"status":"ok"}.

5. If you changed package.json, run npm install first, then pm2 restart index. pm2 restart all restarts every app.

11. When something goes wrong

Why: Each symptom points to one layer: the app, PM2, nginx or the security group. Checking them in order finds the problem fast.

1. node: command not found: Node.js is not installed. Run sudo yum install nodejs24 -y.
2. Error: Cannot find module 'express': npm install was not run, or was run in another folder. cd ~/nodeapp and run npm install.
3. npm install fails with code EJSONPARSE: package.json is not valid JSON. Look for a missing comma, a missing " or a comma after the last item.
4. Error: listen EADDRINUSE: address already in use :::3000: another copy of the app already uses port 3000, often one started by PM2. pm2 list shows it; don't also run node index.js.
5. http://PUBLIC_IP:3000 does not open while testing: the app is not running, or the security group has no port 3000 rule.
6. pm2: command not found: install it with sudo npm install -g pm2.
7. The app is gone after a reboot: run pm2 startup, run the line it prints, then pm2 save.
8. 502 Bad Gateway: nginx works but the app does not answer. pm2 list and pm2 logs index show why; check the port in proxy_pass.
9. The nginx welcome page instead of your app: the location / block is missing or outside the server block, or nginx was not reloaded.
10. nginx -t says duplicate location "/": one server block can have only one location /. Delete the extra block.
11. A new route gives Cannot GET: run pm2 restart index.

When you're done practising, stop the EC2 instance. Everything you installed lives on the instance's EBS root volume; the next chapter adds a second EBS volume for data.

12. The whole class on one page

1. Python and Node.js apps are hosted the same way: language, libraries, app on an internal port, a process manager, nginx in front.
2. Amazon Linux 2023: sudo yum install nodejs24 -y (npm comes with it); Ubuntu: sudo apt install nodejs npm -y. Check with node -v and npm -v.
3. package.json describes the app; dependencies are needed to run it, devDependencies only to write and test it.
4. Express: app.get('/path', function (req, res) { ... }); res.send() for text, res.json() for JSON; app.listen(process.env.PORT || 3000).
5. npm install fills the project's own node_modules and writes package-lock.json; no venv is needed. Keep node_modules out of git.
6. node index.js runs in the foreground: good for a test with a temporary port 3000 rule.
7. sudo npm install -g pm2, pm2 start index.js; then pm2 list, logs, restart, stop, delete.
8. pm2 startup (run the printed line) and pm2 save bring the app back after a reboot.
9. nginx: location / { proxy_pass http://127.0.0.1:3000; } in the server block, one location / only; sudo nginx -t, then sudo service nginx reload.
10. Behind nginx, delete the port 3000 rule; new code needs pm2 restart index.

13. Hands-on lab: an Express API behind nginx, kept alive by PM2

Why this lab. This lab takes a fresh Amazon Linux 2023 server to a Node.js API that answers on port 80 and survives logouts and reboots, checking every layer on the way.

1. Install Node.js
   • Command: sudo yum install nodejs24 -y
   • You should see: Complete!
   • Check: node -v prints v24.x; npm -v prints a version.
   • Why: nodejs24 is a current version that gets security fixes and brings npm with it. The plain nodejs package is Node.js 18, which no longer gets fixes.
2. Make the project folder
   • Command: mkdir ~/nodeapp && cd ~/nodeapp
   • You should see: Nothing.
   • Check: pwd → /home/ec2-user/nodeapp
   • Why: Each app gets its own folder, so its node_modules never mixes with another app's.
3. Write package.json
   • Do: nano package.json and enter the file from section 3, with "express" under dependencies.
   • Check: cat package.json shows the braces and commas exactly as in section 3.
   • Why: A missing comma or quote makes npm stop with a JSON parse error.
4. Write index.js
   • Do: nano index.js and enter the code from section 4.
   • Check: cat index.js ends with app.listen(process.env.PORT || 3000);.
   • Why: Port 3000 is the app's own port; nginx will forward to it later.
5. Install the libraries
   • Command: npm install
   • You should see: added ... packages and a new node_modules folder.
   • Check: ls node_modules/express lists Express's files.
   • Why: Without this, node index.js fails with Cannot find module 'express'.
6. Start it with PM2
   • Command: sudo npm install -g pm2 && pm2 start index.js
   • You should see: A table with index and status online.
   • Check: curl http://127.0.0.1:3000/getusers → {"username":"ravi"}
   • Why: -g makes pm2 work in every folder. PM2 keeps the app running after you log out.
7. Survive reboots
   • Command: pm2 startup
   • You should see: One line starting with sudo env PATH=$PATH:/usr/bin. Copy it and run it, then run pm2 save.
   • Check: sudo reboot, reconnect, pm2 list: index is online.
   • Why: startup starts PM2 at boot; save tells it which apps to start. You need both.
8. Put nginx in front
   • Command: sudo yum install nginx -y && sudo service nginx start
   • You should see: Complete!
   • Check: Add the location / { proxy_pass http://127.0.0.1:3000; } block from section 9, then sudo nginx -t → syntax is ok and test is successful.
   • Why: Visitors use port 80; nginx passes each request to the app. nginx -t catches typos before they break the running server.
9. Reload and test from the browser
   • Command: sudo service nginx reload
   • You should see: Nothing.
   • Check: http://PUBLIC_IP/getusers shows {"username":"ravi"} with no port in the address.
   • Why: If it fails, check that the security group allows port 80. Port 3000 never needs to be open to the internet.
10. Change code and restart
    • Do: Add the /health route from section 10, then run pm2 restart index.
    • Check: http://PUBLIC_IP/health → {"status":"ok"}
    • Why: Before the restart the same address says Cannot GET /health, because PM2 still runs the old code.

14. Try at home

Recap

Quick revision cards

Revise this lesson in two minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens its lesson.

More cards: Ravi Sir's Cards.