How to install coolify on a vps

Coolify is an open-source, self-hosted platform for deploying applications, databases, and services on your own server.

It sits in the same category as Heroku, Vercel, and Netlify, except the server is yours and there is no per-seat or per-build pricing. You connect a Git repository, Coolify builds the project, runs it in a Docker container behind a reverse proxy, and issues a Let's Encrypt certificate for the domain.

This guide installs Coolify on a Linux VPS, secures the dashboard with HTTPS, and walks through deploying the first application from a Git repository.

Step 1: Prepare the VPS

Coolify runs on any Debian-based or RHEL-based Linux distribution. Ubuntu 22.04 LTS and 24.04 LTS are the most widely tested and are what this guide assumes.

The minimum practical specification is 2 vCPU, 2 GB RAM, and 30 GB of disk. That works for a handful of small applications. Builds are the memory-hungry part — compiling a Node.js or Next.js project inside a container can spike well past 2 GB and the build will be killed by the OOM killer with a confusing error. If you plan to build anything JavaScript-based, 4 GB RAM is the realistic floor.

Disk fills faster than you expect. Every build produces Docker image layers, and Coolify keeps previous deployments so you can roll back. 50 GB is a comfortable starting point.

Connect over SSH as root, or as a user with full sudo:

ssh root@your-server-ip

Update the system before installing anything:

apt update && apt upgrade -y

Set a proper hostname. Docker and the reverse proxy both read it, and a hostname of localhost causes odd behaviour later:

hostnamectl set-hostname coolify

A clean server is strongly preferred. Coolify installs and configures Docker, Traefik, and its own network stack. If the VPS already runs Nginx, Apache, or another service bound to ports 80 and 443, the installer will conflict with it.

Step 2: Open the Required Ports

Coolify needs several ports reachable. Configure the firewall before running the installer so you do not lock yourself out.

Allow SSH first — always this one first:

ufw allow 22/tcp

Then HTTP and HTTPS, which the built-in Traefik proxy uses to serve your deployed applications and to complete Let's Encrypt challenges:

ufw allow 80/tcp
ufw allow 443/tcp

Then the Coolify dashboard and its realtime channels:

ufw allow 8000/tcp
ufw allow 6001/tcp
ufw allow 6002/tcp

Enable the firewall:

ufw enable
ufw status

Ports 8000, 6001, and 6002 are only needed until you put the dashboard behind a domain with HTTPS, which is covered in step 5. Close 8000 after that.

If your provider has a network-level firewall in addition to the one on the server, open the same ports there too. A dropped packet at the provider edge produces the same symptom as a wrong install: a dashboard that never loads.

Step 3: Run the Coolify Installer

Coolify ships a single installation script that installs Docker Engine, creates the required directories under /data/coolify, and starts the Coolify containers.

Run it as root:

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

The script prints each stage as it runs. It takes two to five minutes depending on your disk and network speed.

When it finishes, it prints the dashboard URL and the port. Confirm the containers came up:

docker ps

You should see containers for coolify, coolify-db, coolify-redis, coolify-realtime, and coolify-proxy. If any of them show a restarting status, read its logs before continuing:

docker logs coolify

The most common first-run failure is insufficient RAM during startup. Check with free -h — if available memory is near zero, resize the VPS rather than adding swap and hoping.

Step 4: Create the Admin Account

Open the dashboard in a browser using your server IP:

http://your-server-ip:8000

The first page is the registration form. The first account created becomes the instance owner with full administrative rights.

Enter a name, an email address, and a strong password, then submit. There is no email verification step on a fresh instance, so the password is the only thing protecting the dashboard.

Registration closes automatically after the first account is created, so a stranger cannot claim your instance. Do not leave the installer running on a public IP for hours before completing this step.

After logging in, Coolify runs its initial setup and registers the server it is installed on as localhost. This is the default deployment target. You can add more servers later from:

Servers → + Add

Step 5: Point a Domain at Coolify and Enable HTTPS

Running the dashboard over plain HTTP on an IP address means your login credentials cross the internet unencrypted. Fix that before doing anything else.

At your DNS provider, create an A record pointing a subdomain at the server:

coolify.example.com    A    your-server-ip

Wait for the record to resolve. Verify it from your local machine before continuing — Let's Encrypt validation fails if DNS has not propagated:

dig +short coolify.example.com

In the Coolify dashboard, go to:

Settings → Configuration

Set the instance domain to the full URL including the scheme:

https://coolify.example.com

Save. Coolify reconfigures its Traefik proxy and requests a Let's Encrypt certificate automatically. Add a valid email address in the same settings page — Let's Encrypt uses it for expiry warnings.

Give it thirty seconds, then load the new URL. Once HTTPS works, close the raw dashboard port:

ufw delete allow 8000/tcp

The dashboard is now reachable only through the proxy on port 443.

Step 6: Connect a Git Source

Coolify deploys from Git. Connecting a source lets it read your repositories and receive webhooks so pushes trigger deployments.

Navigate to:

Sources → + Add

For GitHub, choose the GitHub App method rather than a personal access token. A GitHub App is scoped to the specific repositories you select, can be revoked independently, and handles webhook registration for you. A personal access token grants access to everything the token owner can see.

Coolify redirects you to GitHub to create and install the app. Select the repositories you want to deploy, approve, and you are returned to the dashboard with the source connected.

GitLab, Bitbucket, and self-hosted Gitea instances are configured from the same screen. For any Git server reachable over SSH, you can also skip the source integration and deploy from a raw repository URL with a deploy key — you lose automatic webhook deployments but keep everything else.

Step 7: Deploy the First Application

Coolify organises work into projects, and each project has one or more environments such as production and staging.

Create one from:

Projects → + Add

Open the project, select the production environment, then:

+ New → Application

Pick your Git source and the repository, then the branch to deploy.

Coolify inspects the repository and proposes a build pack. Nixpacks is the default and detects most Node.js, Python, PHP, Go, and Ruby projects without any configuration. If your repository has a Dockerfile, select the Dockerfile build pack instead — an explicit Dockerfile is more predictable than automatic detection and is the better choice for anything going to production.

Set the port your application listens on. This is the single most common source of a failed first deployment: the container builds fine, the proxy routes traffic to port 3000, and the app is actually listening on 8080. Check your framework's default and set it explicitly.

Add environment variables under the Environment Variables tab before deploying. Variables needed during the build — anything a framework inlines at build time — must be marked as build-time variables, not just runtime.

Set the application domain in the Domains field:

https://app.example.com

Create the matching DNS A record pointing at the same server IP. Coolify issues the certificate for this domain automatically once traffic reaches the proxy.

Then press:

Deploy

The build log streams live. On success the container starts and the domain serves your application over HTTPS. On failure, the log shows the exact build step that broke — read it from the bottom up, since the real error is usually a few lines above the final exit code.

Once the first deployment succeeds, pushes to the selected branch trigger new deployments automatically through the webhook that Coolify registered with your Git source.

Step 8: Add a Database

Applications that need persistent storage get a managed database container in the same project.

From inside the project environment:

+ New → Database

PostgreSQL, MySQL, MariaDB, MongoDB, Redis, KeyDB, Dragonfly, and ClickHouse are available. Choose the version explicitly rather than accepting latest — a major version bump on a container restart is not something you want to discover during an incident.

After creation, Coolify shows both an internal and an external connection string. Use the internal one in your application, since it routes over the Docker network and never leaves the server:

postgres://username:password@internal-hostname:5432/database

Leave the public port closed unless you specifically need to connect from outside the VPS. An exposed database port is the most common way a self-hosted stack gets compromised.

Enable scheduled backups from the database's Backups tab and point them at S3-compatible storage. A backup written to the same disk as the database protects you from a bad migration and from nothing else.

Step 9: Verify and Harden

Confirm the deployed application responds over HTTPS with a valid certificate:

curl -I https://app.example.com

Expected output is a 200 status with no TLS warnings.

Then tighten a few things that the installer leaves open by default.

Disable public registration so no one else can create an account on your instance:

Settings → Configuration → Registration Allowed

Turn on two-factor authentication for the owner account under your profile settings. The dashboard has root-equivalent control over the server; a password alone is thin protection for that.

Set a disk cleanup threshold so old Docker images and build caches are pruned before the disk fills:

Settings → Configuration → Docker Cleanup

Keep SSH key-based authentication only, and disable password login in /etc/ssh/sshd_config if you have not already.

Coolify is now running with HTTPS on the dashboard, a connected Git source, and at least one application deploying automatically on push. Everything from here — adding more servers, staging environments, preview deployments per pull request — builds on the same project and environment structure you have already set up.