So now you have a cloud server. What do you put on it?

I picked a real app idea

I chose one small thing to organize. The best beginner app is personal and boring in a useful way.

• Recipe App: meals, ingredients, instructions, notes
• Movie App: titles, file sizes, drives, watched status
• Music App: albums, artists, formats, cleanup notes
• Seed App: varieties, planting dates, trays, grow bags

I designed one item first

Before writing routes, I wrote one example JSON item. That kept the project from turning into chaos.

{
  "id": "example-001",
  "title": "Example Item",
  "category": "Personal",
  "notes": "What I want to remember",
  "rating": 5,
  "tags": ["favorite", "test"]
}

I used a simple project structure

This layout is enough for a first real Flask app.

blank-app/
├── app.py
├── requirements.txt
├── data/
│   └── items.json
├── static/
│   └── style.css
└── templates/
    ├── index.html
    ├── detail.html
    └── form.html

I created a Python virtual environment

A virtual environment keeps this app's Python packages separate from the rest of the system.

cd blank-app
python3 -m venv .venv
source .venv/bin/activate
pip install Flask gunicorn
pip freeze > requirements.txt

I wrote the smallest useful Flask app

The first version only needs to load JSON and show it in the browser.

from flask import Flask, render_template
import json
import os

app = Flask(__name__)
DATA_FILE = os.path.join(app.root_path, "data", "items.json")

def load_items():
    with open(DATA_FILE) as f:
        return json.load(f)

@app.route("/")
def index():
    return render_template("index.html", items=load_items())

if __name__ == "__main__":
    app.run(debug=True)

I ran it locally first

I tested the app before touching Apache, DNS, HTTPS, or systemd.

source .venv/bin/activate
flask --app app run

Then I opened http://127.0.0.1:5000 in the browser.

I added forms only after the list worked

The order matters. First show data. Then add detail pages. Then add create/edit forms.

• List page: show all items
• Detail page: show one item
• Add form: create a new item
• Edit form: update an item
• Save function: write JSON back to disk

I added basic password protection

For a personal app, I do not want the whole internet editing my recipes, movies, music, or seed collection.

The password should come from an environment variable, not from code committed to GitHub.

APP_PASSWORD=change-this
SECRET_KEY=generate-a-long-random-value

I installed server packages

On the cloud server, I installed Python tools, Apache, Git, and basic security packages.

sudo apt update
sudo apt install -y python3-venv python3-pip apache2 git ufw fail2ban

I copied the app to the server

The cleanest version is to push the project to GitHub, then clone it on the server.

mkdir -p ~/apps
cd ~/apps
git clone https://github.com/YOURNAME/blank-app.git
cd blank-app

I installed the app dependencies

The server gets its own virtual environment.

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

I tested Gunicorn

Gunicorn runs the Flask app as a real application server. I bound it to localhost so it was not directly exposed to the internet.

.venv/bin/gunicorn -w 2 -b 127.0.0.1:5000 app:app

In another SSH window, I tested:

curl http://127.0.0.1:5000

I created an environment file

Secrets do not belong in the Git repository.

sudo nano /etc/blank-app.env

SECRET_KEY=replace-with-a-long-random-string
APP_PASSWORD=replace-with-a-real-password
SESSION_COOKIE_SECURE=1

I created a systemd service

systemd keeps the app running, starts it on boot, and gives me logs through journalctl.

sudo nano /etc/systemd/system/blank-app.service

[Unit]
Description=Blank Flask App
After=network.target

[Service]
User=ubuntu
WorkingDirectory=/home/ubuntu/apps/blank-app
EnvironmentFile=/etc/blank-app.env
ExecStart=/home/ubuntu/apps/blank-app/.venv/bin/gunicorn -w 2 -b 127.0.0.1:5000 app:app
Restart=always

[Install]
WantedBy=multi-user.target

I enabled the service

This starts the app and makes it come back after reboot.

sudo systemctl daemon-reload
sudo systemctl enable --now blank-app
sudo systemctl status blank-app --no-pager

I put Apache in front

Apache handles public web traffic. Flask stays private on 127.0.0.1:5000.

sudo a2enmod proxy proxy_http headers
sudo nano /etc/apache2/sites-available/blank-app.conf

<VirtualHost *:80>
    ServerName app.example.com

    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:5000/
    ProxyPassReverse / http://127.0.0.1:5000/

    ErrorLog ${APACHE_LOG_DIR}/blank-app-error.log
    CustomLog ${APACHE_LOG_DIR}/blank-app-access.log combined
</VirtualHost>

I enabled the Apache site

Then I tested Apache before reloading it.

sudo a2ensite blank-app.conf
sudo apachectl configtest
sudo systemctl reload apache2

I pointed DNS at the server

I created an A record for the app subdomain.

Type: A
Name: app
Value: YOUR_SERVER_PUBLIC_IP
Proxy: on, if using Cloudflare for web traffic

I added HTTPS

Once the domain reached the server over HTTP, I used Certbot.

sudo apt install -y certbot python3-certbot-apache
sudo certbot --apache -d app.example.com

I checked logs and backups

A web app is not finished until I know how to troubleshoot it and back it up.

sudo journalctl -u blank-app -f
sudo tail -f /var/log/apache2/blank-app-error.log
tar -czf ~/blank-app-data-$(date +%F).tar.gz ~/apps/blank-app/data