Java VPS go-live checklist

Memory and Java

1. Heap is set explicitly. -Xms and -Xmx are equal and leave room for everything else. Calculator.
2. Metaspace is capped with -XX:MaxMetaspaceSize.
3. A small swap file exists as a safety net. How.
4. You run a supported LTS Java (17, 21 or 25). Versions.
5. Heap dump on OOM is enabled and writes to a folder with space: -XX:+HeapDumpOnOutOfMemoryError.

Network and security

6. HTTPS works with a valid certificate that renews itself (certbot timer).
7. Firewall allows only 22, 80 and 443. Port 8080 and the database port are closed to the internet.
8. The application listens on 127.0.0.1 if a proxy is in front.
9. SSH uses keys, password login is off, root login is off. Harden the VPS.
10. Tomcat Manager is not public. Use a tunnel.
11. Automatic security updates are on (unattended-upgrades).
12. The app runs as its own user, not root.

Reliability

12. The service starts at boot (systemctl enable) and restarts on failure (Restart=on-failure).
13. You tested a reboot. After sudo reboot everything comes back without your help, including the database.
14. Logs rotate. A full disk is one of the most common reasons a server dies.
15. The proxy passes the right headers for HTTPS and client IP. Details.

Recovery and visibility

16. Backups go off the server and include the database. restic guide.
17. You tested a restore at least once on another machine.
18. Monitoring and an alert exist for CPU, memory, disk and "site is down". Monitor a Java VPS.
19. DNS TTL was lowered a day before the move, so you can switch back fast.
20. You wrote down where everything is: paths, service names, passwords in a password manager, the provider contact.

Want it done for you?

The managed plans cover most of this list, and the setup script behind our Java VPS plans is open source: java-vps-setup on GitHub.

Last updated October 29, 2026.