> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arct.cloud/llms.txt
> Use this file to discover all available pages before exploring further.
# Self-Host Coolify on a VPS
> Install Coolify on an Arct Cloud Linux VPS, secure its dashboard with HTTPS, and configure backups and safe updates.
Arct Cloud provides an unmanaged Linux VPS. Coolify is not preinstalled or managed by Arct Cloud; you are responsible for the Coolify control plane, deployed workloads, security, backups, and updates.
This guide installs self-hosted Coolify on a fresh Ubuntu 24.04 server using Coolify's recommended automated installer. Ubuntu 24.04 LTS is supported by that installer.
## Requirements
| Basis | CPU | RAM | Storage |
| --------------------------------- | ------: | ---: | -----------------------: |
| **Official Coolify minimum** | 2 cores | 2 GB | 10 GB free |
| **Practical Arct recommendation** | 2 vCPUs | 4 GB | 40 GB NVMe (`cvm.micro`) |
The official minimum runs the control plane. Builds, Docker images, databases, application volumes, and backups need additional resources. For several applications or local image builds, start with 4 vCPUs and 8 GB RAM (`cvm.small`) and monitor disk usage.
Install Coolify on a fresh server when possible. Ports, Docker configuration, and existing reverse proxies can conflict with the automated installer.
## Install Coolify
[Deploy a server](/compute/virtual-machines/deploy), select a plan based on the control plane and workloads you will run, and choose Ubuntu 24.04.
Find the server IP address in the Arct Cloud console, then connect:
```bash theme={null}
ssh ubuntu@YOUR_SERVER_IP
```
See [Connect via SSH](/compute/virtual-machines/connect-ssh) for key and username help.
Create an `A` record such as `coolify.example.com` that points to the server's public IPv4 address. Add an `AAAA` record only when IPv6 is configured and reachable.
Coolify binds these TCP ports during setup:
| Port | Purpose |
| -----: | ---------------------------------------------------------------- |
| `22` | SSH and Coolify's connection to the server |
| `80` | HTTP traffic and certificate issuance |
| `443` | HTTPS traffic |
| `8000` | Direct dashboard access during setup; keep private |
| `6001` | Real-time dashboard updates during direct-IP setup; keep private |
| `6002` | Web terminal during direct-IP setup; keep private |
Confirm the ports are not already occupied:
```bash theme={null}
sudo ss -lntp
getent ahostsv4 coolify.example.com
```
Before running the installer, attach a network-level firewall or ACL in front of the VPS with this inbound policy:
| Ports | Source during bootstrap |
| ---------------------------------- | ------------------------------------------------------- |
| `22/tcp` | Your current public admin IP only |
| `80/tcp`, `443/tcp` | Any, for the dashboard domain and certificate issuance |
| `8000/tcp`, `6001/tcp`, `6002/tcp` | Deny from the public internet |
| All other inbound ports | Deny unless a deployed workload explicitly requires one |
Keep the current SSH session open while changing firewall rules. Attach and verify this policy **before** installation. Coolify's [official firewall guide](https://coolify.io/docs/knowledge-base/server/firewall) explains that Docker-published ports bypass plain UFW rules and recommends a provider firewall. If no upstream firewall is available, configure the guide's Docker-aware `ufw-docker` alternative before proceeding; an ordinary UFW deny rule is not sufficient.
Coolify recommends its automated installation script. Run it with root privileges from the fresh server:
```bash theme={null}
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash
```
The installer adds required packages, installs Docker Engine when needed, creates `/data/coolify`, generates secrets and SSH keys, and starts the control plane. Do not install Docker through Snap.
From your local computer, open an SSH tunnel for the direct-IP setup services and leave it running:
```bash theme={null}
ssh -L 8000:127.0.0.1:8000 \
-L 6001:127.0.0.1:6001 \
-L 6002:127.0.0.1:6002 \
ubuntu@YOUR_SERVER_IP
```
Confirm that `http://YOUR_SERVER_IP:8000` is unreachable without the tunnel, then open `http://127.0.0.1:8000` through the tunnel. Create the first administrator with a unique password and enable two-factor authentication before adding servers or secrets.
Anyone who reaches the registration page first can become the Coolify administrator and gain root-level control of the server. Do not proceed if port `8000` is reachable directly from a non-allowlisted network.
Wait until `coolify.example.com` resolves to this VPS. In Coolify, open **Settings > Configuration > General**, set **URL** to the complete address `https://coolify.example.com`, and save.
Coolify's integrated proxy requests and renews the TLS certificate. Confirm the dashboard, real-time updates, and web terminal all work through the HTTPS domain before restricting the setup ports.
Back up the generated environment file immediately:
```bash theme={null}
sudo install -d -m 700 /data/coolify-backup
sudo cp --preserve=mode,timestamps \
/data/coolify/source/.env /data/coolify-backup/coolify.env
```
Copy this backup to encrypted storage outside the VPS. It includes `APP_KEY`, which Coolify needs to decrypt credentials during a restore.
After the HTTPS dashboard, real-time connection, and web terminal are verified, keep ports `8000`, `6001`, and `6002` denied at the network firewall and close the SSH tunnel. Keep `22`, `80`, and `443` available as required. Recheck the policy whenever you add direct port mappings to a workload.
Check the control-plane containers and public endpoint:
```bash theme={null}
sudo docker ps --filter name=coolify \
--format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
curl -I https://coolify.example.com
sudo docker logs --tail 50 coolify
```
In the dashboard, open **Servers > localhost**, validate the server, deploy a small test resource, and confirm it is reachable through HTTPS.
## Persistent Data and Security
Coolify stores its control-plane configuration under `/data/coolify`, including its environment file, SSH keys, proxy configuration, application definitions, and local backups. Do not edit the base Compose files in `/data/coolify/source`; updates replace them. Use `docker-compose.custom.yml` for supported overrides.
| Data | What to protect |
| --------------------------------- | ------------------------------------------------------------------ |
| Coolify internal database | Projects, server records, configuration, and encrypted credentials |
| `/data/coolify/source/.env` | The `APP_KEY` and generated database or service secrets |
| `/data/coolify/ssh/keys/` | Private keys used to manage localhost and remote servers |
| Application databases and volumes | Workload data; not included in a Coolify instance database backup |
Use a unique administrator password and enable two-factor authentication. Keep SSH key-only where possible, restrict administrative access, and do not expose databases or application container ports unless a client explicitly needs them. Applications routed through the Coolify proxy normally need only ports `80` and `443`.
Coolify can control Docker and connect to servers over SSH. A compromised administrator account can compromise every managed workload and secret. Treat the dashboard as privileged infrastructure.
## Back Up and Restore
Configure two separate backup layers:
1. In **Settings > Backup**, add an S3-compatible destination, schedule a Coolify instance database backup, run it once manually, and verify the object exists in remote storage.
2. Save `/data/coolify/source/.env`, especially `APP_KEY`, and `/data/coolify/ssh/keys/` in encrypted off-server storage.
3. Configure scheduled backups for each application database and persistent volume. A Coolify instance backup does not include workload databases, application volumes, or arbitrary files on managed servers.
4. Record the Coolify version whenever you take a recovery checkpoint.
To restore, install the matching Coolify version on the target server, restore the saved `APP_KEY`, load the instance `.dmp` backup into Coolify's database using the official restore procedure, restore the SSH keys, and then restore every application database and volume independently. Test this process on a replacement server before relying on it for production recovery.
Keep at least one backup outside the Coolify server. A local backup cannot help if the VPS, filesystem, or account becomes unavailable.
## Update and Roll Back Safely
Before changing the Coolify version:
1. Create and verify an instance backup plus workload backups.
2. Copy `.env` and SSH keys off-server.
3. Review the [Coolify releases](https://github.com/coollabsio/coolify/releases) and wait for active deployments to finish.
4. Record the current version shown in the dashboard.
Update during a maintenance window from **Settings > Configuration > Updates**, or run the official installer over SSH:
```bash theme={null}
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash
```
After the update, verify the displayed version, localhost validation, proxy, web terminal, and representative application/database resources. Update logs are written under `/data/coolify/source/` as `upgrade-*.log`.
To return to a known release, disable automatic updates and run the installer with the exact target version from the official releases page:
```bash theme={null}
COOLIFY_VERSION=REPLACE_WITH_RELEASE_TAG
curl -fsSL https://cdn.coollabs.io/coolify/install.sh \
| sudo bash -s "$COOLIFY_VERSION"
```
An older control-plane image may not understand database migrations made by a newer release. If the downgrade fails, stop and restore the pre-update instance database with its matching `APP_KEY` instead of repeatedly downgrading. Coolify control-plane rollback does not roll back deployed applications or their data.
## Troubleshooting
Port `8000` should remain blocked publicly. Connect through the SSH tunnel, then check `sudo ss -lntp | grep ':8000'`, `sudo docker ps --filter name=coolify`, and the newest `/data/coolify/source/upgrade-*.log`. Another service occupying port `8000` can prevent a correct start.
Confirm the `A` record points to this server and ports `80` and `443` are publicly reachable. Remove an incorrect `AAAA` record, then inspect the Coolify proxy logs for ACME errors.
Before domain setup, direct-IP access also needs ports `6001` and `6002`. After domain setup, confirm the instance URL uses `https://` and that the proxy routes the dashboard, real-time service, and terminal before closing those ports.
Check `free -h`, `df -h`, and `sudo docker system df`. Builds can exceed the control-plane minimum. Add RAM/storage, use a dedicated build server, and configure Coolify's automated Docker cleanup rather than deleting active volumes.
The restored database and active `APP_KEY` do not match. Restore the exact key saved with that backup; generating a replacement cannot decrypt existing values.
## Official Resources
Official requirements, supported systems, and automated installation.
Source code, installer, security policy, and issue tracker.
Stable releases, fixes, and upgrade notes.
Coolify is developed by Coollabs. Arct Cloud is an independent infrastructure provider and is not affiliated with, sponsored by, or endorsed by Coollabs.