Coolify

Connect to the VM over SSH as azureuser, the default login user. Replace <vm-ip> with the public IP of your VM.

ssh azureuser@<vm-ip>

sudo systemctl is-active docker.service coolify.service docker --version docker compose version

The output shows active twice, then the Docker Engine version and the Docker Compose v2 plugin version.

sudo docker ps --format "table {{.Names}}\t{{.Status}}"

The containers coolify, coolify-db, coolify-redis and coolify-realtime should all show the Up / healthy state. Coolify's own Traefik proxy (coolify-proxy) starts when you connect your first server from the dashboard.

All Coolify state lives on a dedicated data disk mounted at /data/coolify. Check the mount:

findmnt /data/coolify df -h /data/coolify

findmnt shows the device backing /data/coolify, and df confirms the 40 GiB volume.

First boot generates a unique administrator email and password for your instance and writes them to a root-only file. Self-registration is disabled, so this is the only login until you invite more users from the dashboard.

sudo cat /root/coolify-credentials.txt

Note the coolify.url, coolify.admin.email and coolify.admin.pass values. The dashboard URL is http://<vm-ip>:8000/.

curl -fsS http://127.0.0.1:8000/api/health

Coolify returns OK once the application is fully up.

Confirm that the per-VM administrator password authenticates against Coolify's login. This script fetches the CSRF token, posts the credentials and checks that the response is a successful redirect.

EMAIL=$(sudo grep '^coolify.admin.email=' /root/coolify-credentials.txt | cut -d= -f2-)
CJ=$(mktemp)
curl -s -c "$CJ" 'http://127.0.0.1:8000/login' >/dev/null
XSRF=$(grep XSRF-TOKEN "$CJ" | awk '{print $NF}' | python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')
curl -s -b "$CJ" -o /dev/null -w 'login HTTP %{http_code}\n' \
  -H "X-XSRF-TOKEN: ${XSRF}" -H 'X-Requested-With: XMLHttpRequest' \
  --data-urlencode "email=${EMAIL}" --data-urlencode "password=<COOLIFY_ADMIN_PASSWORD>" \
  'http://127.0.0.1:8000/login' rm -f "$CJ"

A 302 (redirect to the dashboard) confirms the login succeeded.

Browse to http://<vm-ip>:8000/ and sign in with the email and password from Step 5. The login page notes that registration is disabled, because the first-boot root administrator is the only account.

On first sign-in, Coolify shows a short onboarding screen. Click Skip Setup to go straight to the dashboard, or click Let's go! to walk through connecting your first server.

The dashboard is your single pane of glass. The left sidebar lists Projects, Servers, Sources (Git providers), Destinations, S3 Storages, Shared Variables, Keys & Tokens, Settings and more.

The localhost server, which is the Docker host Coolify runs on, is ready to deploy to immediately.

Open Servers to manage the local Docker host and connect additional servers for distributed deployments. The pre-configured localhost entry is the server Coolify itself runs on, so do not delete it.

Open Settings to configure the instance. You can set the public URL and name, the instance timezone, the public IPv4/IPv6 used for deployments, transactional email, OAuth providers, automated backups and scheduled jobs.

Set the URL to your own domain here once you front the dashboard with HTTPS.

From the dashboard, create a Project, then add a resource. Connect a Source (GitHub, GitLab, Bitbucket or a public Git URL), or point Coolify at a Dockerfile or Docker Compose file.

Coolify builds the image, deploys the container, wires it into its Traefik proxy and, optionally, provisions a Let's Encrypt certificate. You can also provision one-click managed databases (PostgreSQL, MySQL, MariaDB, MongoDB, Redis, KeyDB and more) and deploy ready-made services from the catalogue.

Coolify's own Traefik proxy serves the applications you deploy on ports 80 and 443. That is why this image does not run nginx and does not rebind port 80. The dashboard stays on port 8000.

To reach the dashboard at https://coolify.example.com instead of http://<vm-ip>:8000, point a DNS A record at the VM's public IP. Then open Settings > Configuration > General and set the instance URL to your domain.

Coolify's Traefik proxy requests a Let's Encrypt certificate and routes the domain to the dashboard. Make sure ports 80 and 443 are open in your NSG so the ACME HTTP-01 challenge and HTTPS traffic can reach the proxy.

Manage the stack with systemd and Docker Compose:

sudo systemctl status coolify.service --no-pager sudo systemctl restart coolify.service

The Coolify state, including the application database, lives under /data/coolify on the dedicated data disk. It survives instance replacement and can be resized independently.

To upgrade Coolify, review the Coolify release notes first, then run the official upgrade script at /data/coolify/source/upgrade.sh.

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Coolify. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.large or larger. Coolify, the database, the cache and the realtime server all run as containers, and the applications you deploy run on the same host, so size the instance for your intended workload.

Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group that opens port 22 from your management network, port 8000 for the dashboard, and ports 80 and 443 for the applications you deploy. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a short while after the instance state becomes Running and the status checks pass. During this time, the per-instance administrator login is generated and the Coolify stack finishes coming up.

Run the following command to launch an instance from the SecureAnyCloud Coolify Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=coolify}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can read both from the EC2 console or with aws ec2 describe-instances.

Connect over SSH with your key pair. On the Ubuntu 24.04 variant, the SSH login user is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

The dashboard administrator login is unique to your instance and was generated on first boot. Read the credentials file as root:

sudo cat /root/coolify-credentials.txt

The file lists the dashboard URL, the administrator email and the generated password. Self-registration is disabled, so this root administrator is the only login until you invite more users from inside the dashboard. Keep these credentials somewhere safe.

The Coolify dashboard is served directly on port 8000. In a browser, open:

http://<instance-public-ip>:8000/

The Coolify sign-in page opens. Sign in with the administrator email and password from the credentials file. The dashboard then loads, showing your projects and the local server.

In the Servers view, you manage the local Docker host that Coolify deploys to. You can also connect additional servers over SSH to spread deployments across more than one machine.

To deploy something, choose New to open the resource catalogue. From there you can deploy applications from a public or private Git repository, a Dockerfile or a Docker Compose file. You can also provision one-click managed databases such as PostgreSQL, MySQL, MariaDB, MongoDB and Redis, or deploy a ready-made service from the catalogue.

Coolify manages the build, the container lifecycle and a reverse proxy with automatic Let's Encrypt certificates for the applications you deploy. The dashboard streams live build and runtime logs over its websocket connection.

Over SSH, confirm that the stack service is active, that the dashboard answers its health endpoint on port 8000, and that the Coolify containers are up:

sudo systemctl is-active coolify

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8000/api/health

sudo docker ps --format 'table {{.Names}}\t{{.Status}}'

The first command reports the service as active. The health check returns 200. The container list shows the coolify, coolify-db, coolify-redis, coolify-realtime and coolify-proxy containers running.

Coolify runs as a Docker Compose stack under /data/coolify. The coolify.service systemd unit is a thin wrapper that brings the stack up on boot and takes it down on stop. The stack definition lives in /data/coolify/source, alongside the .env configuration file.

Inspect the running stack with the standard Docker tooling:

sudo docker compose --env-file /data/coolify/source/.env -f /data/coolify/source/docker-compose.yml -f /data/coolify/source/docker-compose.prod.yml ps

To restart the whole stack, restart the service rather than calling Docker directly. This keeps systemd in sync:

sudo systemctl restart coolify

The application database lives in the coolify-db Docker volume, the cache in coolify-redis, and your deployed applications, provisioned databases and managed SSH keys live under /data/coolify.

The Coolify state tree lives on a dedicated EBS volume mounted at /data/coolify. This keeps the application database, your per-application build state, managed SSH keys and the configuration off the operating system disk, and lets you resize or snapshot them independently. Confirm the mount:

df -h /data/coolify

To grow the state tree, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device.

This volume holds the database and all of your deployment state, so a snapshot of it captures the complete state of your Coolify installation.

The dashboard is served over plain HTTP on port 8000. For production use, place it behind TLS.

The simplest option is Coolify's own proxy. Set the instance domain under Settings in the dashboard, and Coolify requests a Let's Encrypt certificate and serves the dashboard over HTTPS through its built-in Traefik proxy on port 443. Alternatively, put the instance behind an Application Load Balancer with a managed certificate that forwards to port 8000.

Restrict the security group so the dashboard port is reachable only from the networks that need it, and keep ports 80 and 443 open for the applications you deploy.

Back up your deployment by snapshotting the /data/coolify EBS volume, which captures the application database and all of your deployment state. Coolify also has built-in scheduled backups for the managed databases it provisions, configurable from the dashboard.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. The Coolify stack starts automatically on boot.

When you are ready to upgrade, Coolify can update itself to newer releases from the Settings area of the dashboard.