Self-host Coolify to deploy your apps on a VPS

Coolify is an open-source dashboard that builds and runs your apps, databases and ready-made services such as Uptime Kuma with Docker (software that packages and runs apps), and gets HTTPS certificates for them. We tested this guide with Coolify v4.7.5 on Debian 13 and AlmaLinux 10, and Ubuntu 24.04 is also supported.

1. Pick a big enough server

Coolify needs at least 2 CPU cores. Its installer asks for 30GB of disk, and with Coolify and three small apps our test server had 11GB in use. Building an app needs the most memory. On our 2GB test server, rebuilding a small Node.js app used about 1.4GB of RAM plus 950MB of swap (disk space used as extra memory). Without swap, the server stopped responding and we had to reboot it.

Use 4GB of RAM or more, and add swap on any plan. Start from a fresh server, because Coolify runs its own web server on ports 80 and 443. If a firewall runs on the server or at your provider, allow both ports there. To pick a size, see how much RAM and CPU your VPS needs.

On AlmaLinux, update and reboot first, so the server runs its newest kernel before Docker is installed:

$ sudo dnf upgrade -y
$ sudo reboot

2. Point a domain at the server

Choose a name for the dashboard, such as coolify.example.com. Create an A record with your server's IPv4 address and an AAAA record with its IPv6 address. Create the same two records for *.coolify.example.com, so that each app can get its own name, such as blog.coolify.example.com. If your DNS is at Cloudflare, set the records to DNS only (grey cloud).

3. Prepare the install

On a new Coolify server, the first person to open the dashboard can create the admin account. That account has root access to the whole server. So before you install, you close the dashboard ports and create the account yourself.

Become root (skip sudo -i if you already log in as root), then create the folder and a settings file:

$ sudo -i
$ mkdir -p /data/coolify/source
$ nano /data/coolify/source/docker-compose.custom.yml

services:
  coolify:
    ports: !override
      - "127.0.0.1:8000:8080"
      - "127.0.0.1:6001:6001"
      - "127.0.0.1:6002:6002"

Without this file, Coolify opens ports 8000, 6001 and 6002 to the internet, and Docker's own firewall rules bypass the ufw firewall. With it, they work only on the server itself. Coolify's update script also loads this file.

Then create a file with your admin details:

$ nano /root/coolify-admin.env

ROOT_USERNAME='admin'
ROOT_USER_EMAIL='you@example.com'
ROOT_USER_PASSWORD='your-password'

The password needs at least 8 characters with upper and lower case letters, a digit and a symbol, and must not appear in a known data breach. Do not use a single quote (') in it. The email address must be one that can receive mail. If either check fails, Coolify does not create the account, but the installer still reports success.

4. Install and check

$ chmod 600 /root/coolify-admin.env
$ set -a; . /root/coolify-admin.env; set +a
$ curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash
$ curl -sS -o /dev/null -w '%{http_code} %{redirect_url}\n' http://127.0.0.1:8000/register
$ ss -ltn | grep -E ':(8000|6001|6002) '

The curl check must print 302 and an address ending in /login. That means your account exists. In the ss output, all three ports must show 127.0.0.1, never 0.0.0.0 or [::]. If one does not, run docker stop coolify, correct docker-compose.custom.yml, and use the restart command below. Then delete the file with your password:

$ rm /root/coolify-admin.env

If curl prints 200 instead, the account was not created. Port 8000 is closed, so nobody else can reach the sign-up page. To see what was wrong, run docker logs coolify 2>&1 | grep -A4 'Invalid Root'. Correct the ROOT_ values in /data/coolify/source/.env, then restart Coolify and repeat the checks:

$ cd /data/coolify/source
$ docker compose --env-file .env -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.custom.yml up -d --force-recreate coolify

5. Log in and set your domain

On your own computer, open an SSH tunnel (a private connection through SSH) to the dashboard:

$ ssh -L 8000:127.0.0.1:8000 -L 6001:127.0.0.1:6001 -L 6002:127.0.0.1:6002 user@203.0.113.10

Browse to http://127.0.0.1:8000 and log in. On the welcome screen, click Skip setup. Open Settings, enter https://coolify.example.com in the URL field and click Save changes. Then open Servers, choose localhost, enter https://coolify.example.com as the Wildcard domain and save.

Coolify then gets an HTTPS certificate for the dashboard, which can take a few minutes. After that, use https://coolify.example.com and close the tunnel. Under Profile, change your password, because the first one stays in /data/coolify/source/.env, and turn on two-factor authentication, so that each login also needs a code from an app on your phone.

6. Deploy an app and a database

Create a project, add a resource and choose Public Git Repository. To try it, use https://github.com/coollabsio/coolify-examples with the base directory /javascript/runtimes/nodejs, the Nixpacks build pack (it detects the app's language and builds it) and port 3000. Coolify gives the app a name under your wildcard domain. Click Deploy. A full rebuild took about two minutes on our test server.

To add a database, add a PostgreSQL resource to the same project, then click Start. Leave Public access set to Private. Your apps reach it over Docker's internal network, using the Postgres URL (internal) that Coolify shows. Open its Backups tab and add a daily schedule.

7. Updates and Coolify's own backup

Automatic updates are on by default and run once a day. You can change this under Settings, Updates.

To back up Coolify itself, open Settings, Backup, click Configure backup, then Back up now and check that it succeeds. Coolify then also backs up its database before each update. Keep a copy of /data/coolify/source/.env off the server too. It holds APP_KEY, and without it a restored Coolify cannot read your saved passwords and keys.

Quick reference

Where to go next

Keep the server patched and protected as in the first ten minutes on a new VPS.

We tested this guide on a D4 Networks Standard VPS.