Deploy Ghost on a VPS in Minutes

Step 01 — Create a non-root sudo user

Ghost-CLI refuses to run as root. Don't name the user ghost — it clashes with the system user Ghost-CLI creates during setup.

adduser ghostadminusermod -aG sudo ghostadmin

Step 02 — Install dependencies and open the firewall

Install NGINX, MySQL, and the packages for Node.js, then allow web traffic:

su - ghostadminsudo apt-get update && sudo apt-get upgrade -ysudo apt-get install -y nginx mysql-server ca-certificates curl gnupgsudo ufw allow 'Nginx Full'sudo ufw allow OpenSSHsudo ufw enable

Switch MySQL's root user to password auth, which Ghost requires:

sudo mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH 'mysql_native_password' BY 'your_secure_password'; FLUSH PRIVILEGES;"

Step 03 — Install Node.js 22 LTS

Ghost 6.x runs on Node.js v22 only. Install it from NodeSource:

sudo mkdir -p /etc/apt/keyringscurl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpgecho "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.listsudo apt-get update && sudo apt-get install -y nodejs

Step 04 — Install Ghost-CLI

Install the official installer globally as root, then switch back to your user:

exitnpm install ghost-cli@latest -gsu - ghostadmin

Step 05 — Create the install directory and run the installer

Ghost lives in /var/www/ghost with your user as owner:

sudo mkdir -p /var/www/ghostsudo chown ghostadmin:ghostadmin /var/www/ghostsudo chmod 775 /var/www/ghostcd /var/www/ghostghost install

Answer the wizard with your blog URL (full https:// domain), MySQL details, and yes to the NGINX, SSL and systemd prompts. Ghost-CLI configures the reverse proxy, requests a Let's Encrypt certificate and starts Ghost as a systemd service.

Step 06 — Go live and confirm the ports

Your admin panel is now at https://yourdomain.com/ghost/. Ports 80 and 443 are public via NGINX; Ghost (2368) and MySQL (3306) stay bound to localhost, so no extra firewall rules are needed. Open the admin URL to create your account and publish your first post.

Next steps (before production): harden SSH, connect Mailgun for newsletters, set up monitoring, and run ghost backup before every ghost update — rollback a bad update with ghost update --rollback.

• Ghost-CLI refuses to run as root. That's by design — Ghost-CLI won't install under the root account. Create a non-root sudo user first and run the install from there. Don't name that user ghost either, as it collides with the system user Ghost-CLI creates during setup.
• SSL step is skipped during install. If Ghost-CLI prints "SSL certs cannot be generated for IP addresses, skipping," you ran the install against an IP instead of a domain. Point a DNS A-record at your VPS before installing and enter the full https:// domain as your blog URL — Let's Encrypt needs DNS resolving to issue the certificate.
• Ghost can't connect to MySQL. On Ubuntu, MySQL 8's root user defaults to socket-based authentication, which Ghost can't use. Switch it to password auth with mysql_native_password, and use those credentials in the install wizard.
• Newsletter emails don't send. Outbound SMTP is blocked by default on the Start plan, so Mailgun delivery fails until it's enabled. Open a support ticket to unblock the SMTP ports (a KYC check may apply), then add your Mailgun API key under Settings → Newsletters.
• Install fails on the wrong Node.js version. Ghost 6.x runs on Node.js v22 LTS only and will refuse to install on Node 18 or 20. Install v22 from NodeSource and confirm with node --version before running ghost install. Note also that MySQL 8 is required — MariaDB isn't supported for production.