Hosting Many Websites on One Server with One IP Address

0) Problem Restatement

Google asked a practical networking question: you have one Linux server with one public IPv4 address. A coffee shop, a butcher shop and an auto repair shop each want their own website on their own domain (coffee.example, butcher.example, auto.example). How do you host all three on this one machine? How does the right site show up for each domain, and how do you support HTTPS?

1) Step 1: DNS

In each domain's DNS settings, create an A record pointing to the same IP:

coffee.example   A   203.0.113.10
butcher.example  A   203.0.113.10
auto.example     A   203.0.113.10

(Also www. versions, as CNAMEs to the main name.) Now all three names lead browsers to the same server.

2) Step 2: Name-Based Virtual Hosting

How does the server know which site to show? Every HTTP/1.1 request includes a Host header with the domain the user typed:

GET / HTTP/1.1
Host: butcher.example

A web server or reverse proxy (Nginx, Apache, Caddy) uses it to pick the site:

server {
    listen 80;
    server_name coffee.example www.coffee.example;
    root /var/www/coffee;
}
server {
    listen 80;
    server_name butcher.example www.butcher.example;
    root /var/www/butcher;
}
server {
    listen 80;
    server_name auto.example www.auto.example;
    location / { proxy_pass http://127.0.0.1:3001; }   # a dynamic app on a local port
}

Static sites are served from their own folders. Dynamic sites run as separate processes on different local ports (3001, 3002...) and Nginx reverse-proxies to them.

flowchart LR
    B["Browser: butcher.example"] -->|"DNS: 203.0.113.10"| NG["Nginx on :80/:443 - picks site by Host/SNI"]
    NG --> S1["coffee site - /var/www/coffee"]
    NG --> S2["butcher site - /var/www/butcher"]
    NG --> S3["auto app - localhost:3001"]

3) Step 3: HTTPS for Several Domains

With HTTPS, the server must present the right certificate before it sees the Host header (which is encrypted). The solution is SNI (Server Name Indication): the browser sends the domain name in the TLS handshake, so the server picks the matching certificate. All modern browsers support it.

• Get a free certificate per domain from Let's Encrypt (e.g., with certbot --nginx), with automatic renewal, or one certificate listing all domains (a SAN certificate).
• Redirect HTTP to HTTPS.

4) Isolation and Safety

• Run each app as a separate Linux user or in its own container (Docker), so one compromised site can't read the others' files.
• Separate databases or DB users per site, with resource limits (CPU and memory per container).
• Firewall: only ports 80 and 443 (and SSH restricted to admins) open.
• Separate logs per site. Back up each site.

5) Growing Later

• More traffic or reliability → put a load balancer in front and run the sites on 2+ servers (the same virtual-host config), with a CDN for static files.
• A managed platform (PaaS) or Kubernetes Ingress does the same Host/SNI-based routing at larger scale.

6) Wrap-Up

Point every domain's DNS A record at the single IP, then run a web server or reverse proxy that uses name-based virtual hosting: the HTTP Host header (and SNI for HTTPS) selects the right site, served from its own folder or proxied to its own local app port. Use per-domain Let's Encrypt certificates with SNI, isolate sites with separate users or containers, and add a load balancer and CDN when it's time to grow.