How I Deploy Node.js Apps with GHCR, EC2, Webhook, and Certbot

Why I use this stack

I need a deployment flow that is simple, repeatable, and production-safe. GHCR gives me image versioning, EC2 gives predictable hosting, webhook gives one-click redeploy from GitHub Actions, and Certbot keeps TLS automatic.

The full setup is practical for client projects because it is easy to explain, easy to audit, and easy to maintain.

My release pipeline structure

Every push to the production branch triggers a GitHub Actions pipeline. The workflow builds a Docker image, pushes to GHCR, then calls a secure webhook endpoint on the server.

That webhook executes a controlled redeploy script on EC2. The script pulls the latest image and restarts the service with Docker Compose.

• Build and push image to `ghcr.io`
• Trigger authenticated `/hooks/redeploy` endpoint
• Run `docker compose pull` and `docker compose up -d`
• Prune old images to control disk usage

How I keep it secure and stable

I never expose raw container ports directly to public traffic. Nginx acts as the reverse proxy and routes only the required paths. SSL termination is handled by Certbot certificates so the app stays behind HTTPS.

For webhook security, I use an auth secret in the request header and reject any trigger that does not match.

Operational checks I always add

I include a `/health` endpoint, test both local and public health URLs, and keep quick log commands ready for webhook and app containers. When incidents happen, these checks save time immediately.

I also make sure DNS is configured before cert issuance. This avoids unnecessary TLS setup failures.

What this process delivers for my clients

This setup gives teams confidence during releases. They get predictable deployments, HTTPS by default, and a clean path to scale from staging to production with minimal process changes.

Most importantly, it lets me focus engineering time on product features instead of firefighting deployment drift.