Install and maintain Coolify on Ubuntu

Coolify is installed with its official installer on a Docker-capable Ubuntu host, then protected with a host firewall and SSH intrusion prevention.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• A fresh Ubuntu host with ports 22, 80, 443, 8000, and 8080 available as required by your Coolify configuration.
• Complete the first administrator registration immediately after the installer displays the access URL.

What the AppStore installation creates

• docker.io and Docker Compose v2
• Coolify installed by the official cdn.coollabs.io installer
• UFW rules for SSH, HTTP, HTTPS, and Coolify bootstrap ports
• Fail2ban protection for SSH

1. Prepare the server

Update apt and install the same base packages used by the playbook.

sudo apt update
sudo apt install -y curl docker.io docker-compose-v2 python3-pip ufw fail2ban
sudo systemctl enable --now docker

2. Run the official Coolify installer

Review the downloaded script before running it if your security policy requires that.

curl -fsSL https://cdn.coollabs.io/coolify/install.sh -o /tmp/coolify-install.sh
less /tmp/coolify-install.sh
sudo bash /tmp/coolify-install.sh

3. Allow the required ports

Open SSH first so the firewall does not lock you out. Remove bootstrap-port rules later if your deployment no longer needs them.

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 8000/tcp
sudo ufw allow 8080/tcp
sudo ufw --force enable
sudo ufw status numbered

4. Complete first-user setup

Open the URL printed by the installer, create the first administrator, and configure a wildcard domain or application domains in Coolify.

Important files and data

• Coolify-managed Docker containers: inspect with sudo docker ps
• Docker persistent data: normally below /var/lib/docker plus Coolify-managed volumes
• Fail2ban configuration: /etc/fail2ban/

Health checks and logs

Run these checks after installation and after each upgrade:

sudo docker ps
sudo docker compose version
sudo ufw status
sudo fail2ban-client status sshd

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

sudo docker ps
sudo docker system df
# Use Coolify's documented update control from its dashboard or installed helper.
sudo journalctl -u docker -n 100 --no-pager

Backup scope

• Coolify configuration and its database volumes
• Application Docker volumes and bind-mounted data
• Any deployment keys and environment variables, stored securely and separately

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• If the installer URL is unreachable, inspect sudo docker ps -a, UFW, and the provider firewall.
• Do not use docker system prune --volumes on a production Coolify host unless you have verified every volume it would remove.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.