Coolify v4.3 on a VPS: Run Your Apps Without a Managed PaaS

Heroku bills per dyno, Railway by compute hour and egress bandwidth, Render by active service. As soon as a client project outgrows its free tier — or the free tier is discontinued, as Heroku did in November 2022 — the bill climbs in steps. For an agency managing eight to fifteen applications, the cumulative total quickly exceeds what a single dedicated orchestration VPS would cost over a year. The issue is not the price of an isolated project: it is the multiplication of billing lines, each on a different cycle, with each platform's own overage rules. On top of that, vendor lock-in means environment variables, database add-ons and deployment pipelines are proprietary constructs you will need to migrate if the platform changes its pricing or retention policies. Coolify replaces all those lines with one: the VPS hosting the orchestrator.

Coolify orchestrates Docker and can run your applications, databases and its own panel on the same server simultaneously. The minimum resources to get started are 2 vCPU and 2 GB RAM — sufficient for a handful of lightweight services. In production, with multiple active client projects, plan for 4 GB RAM: each container reserves its memory, and databases (PostgreSQL, Redis, MySQL) consume consistently. Storage depends on your volumes: start with at least 40 GB SSD, more if you enable local backups. TCP ports 80 and 443 must be open for Let's Encrypt and application traffic. Port 22 (SSH) is required for installation and administration. Coolify is not compatible with a VPS where Docker was previously installed manually with a non-standard configuration: start from a fresh Ubuntu 22.04 LTS or Debian 12 image.

Coolify monitors the branch you designated and triggers a new deployment on every push via webhook. The full cycle — receiving the GitHub/GitLab event, building the image, stopping the previous container, starting the new one — typically takes less than a minute for a standard Node.js application. Environment variables are managed as encrypted secrets in Coolify's database: they never appear in plain text in the logs. For an application that requires a database, first create the database service in the same Coolify project (New Resource > Database), note the generated credentials, then add them as environment variables in the application. Both services automatically share the same internal Docker network.

Deploy previews are enabled from the application configuration page, under the Preview Deployments tab. Once enabled, every pull request opened on the repository automatically receives an ephemeral environment accessible at a URL built on the pattern <pr-number>.<app-domain>. Coolify manages the SSL certificate for this environment via Let's Encrypt and destroys the environment when the PR is closed or merged. For volume backups, go to Storage > Backups at the service level. Enter the credentials for an S3-compatible bucket (AWS S3, Cloudflare R2, self-hosted MinIO), the desired frequency (daily, weekly) and the retention count. Coolify creates a compressed archive of the volume and transfers it to the bucket on the defined schedule. Trigger the first execution manually from the dashboard to confirm that the S3 credentials work before relying on the automation.

Four situations come up regularly during first installations or after an update.

Port 80 or 443 already in use. Coolify uses Traefik as a reverse proxy on ports 80 and 443. If another process occupies these ports (nginx, Apache installed directly on the VPS), Traefik does not start and no certificate can be issued. Check with ss -tlnp | grep -E ':80|:443', stop the competing process, then restart Coolify with docker compose -f /data/coolify/source/docker-compose.yml restart.

Git webhook not triggered after a push. The most frequent cause is a network firewall blocking GitHub or GitLab outbound IP addresses to your VPS. Verify that GitHub Webhook IP ranges (https://api.github.com/meta) are allowed on port 443 of your VPS. Also check in Coolify that the webhook was properly created in the GitHub repository settings (Webhooks tab of the repository).

SSL certificate stuck pending. Let's Encrypt uses the HTTP-01 challenge: it attempts to reach http://<your-domain>/.well-known/acme-challenge/. If the domain's DNS is not yet propagated, or if port 80 is not reachable from the outside, the challenge fails and Traefik retries every five minutes. Wait for full DNS propagation, verify port 80 accessibility with curl -I http://<your-domain>, then restart the application service in Coolify.

Application started but unreachable. Verify that the port exposed in the Coolify configuration matches the port your application actually listens on inside the container. A Node.js container listening on 3000 must have 3000 as the container port in the Coolify configuration, even if the public URL uses port 443.

Coolify fits within an ecosystem of self-hosted deployment solutions. If your context calls for a different approach — GitOps pipelines via Kamal, lightweight orchestration with Dokploy, or a simplified interface with Easypanel — each tool has its strengths depending on team size and deployment complexity. The related articles explore these alternatives and the specific use cases for each environment.