Coolify host setup

What it does

Copy the repository to a fresh Ubuntu server, run the pre‑flight, and let the phases take it from a root login to a hardened host running Coolify. Every phase is idempotent, so running it again after a fix is safe, and every phase supports a dry run that prints what it would do. The orchestrator can run a range of phases, prompt for what it needs in a guided mode, or run fully non‑interactive for automation.

The pre‑flight checks the Ubuntu version, memory, disk, required commands and network assumptions and stops before anything is installed. Installers are verified against checksums and GPG fingerprints you supply; the script refuses to fetch and run something it can’t check.

The phases

• Phase 1 · Foundation: OS baseline hardening, SSH policy, firewall, a non‑root admin account with your key, an explicit swapfile so an out‑of‑memory event becomes a slowdown rather than a silent kill, raised inotify limits because Docker plus Coolify plus three apps exhaust the defaults, and time sync, because clock drift breaks TLS and makes logs impossible to correlate.
• Phase 2 · Coolify itself, from a checksummed installer.
• Phase 3 · TLS: validates what Coolify’s own proxy needs rather than installing a competing one.
• Phase 4 · Containers: Docker daemon hardening.
• Phase 6 · Backup: restic to an off‑host target over SFTP, with verification.
• Phase 7 · WAF and intrusion detection: CrowdSec, with Falco as an option.
• Phase 8 · Maintenance: unattended updates and the timers that check mail delivery.
• Phase 9 · Audit: audit logging and a CIS benchmark check.
• Phase 10 · Database hardening for the Postgres instances the apps use.
• Phase 12 · Secrets: rotation helpers, OpenBao if enabled.

The numbering has gaps because phases were dropped without renumbering; that’s a choice, so old logs and docs stay true.

Utilities and docs

Twenty operational scripts for the day after: backups of config, databases and volumes with restore and a disaster‑recovery drill; a security audit and checklist; container scanning; a compliance report; a health check; mail verification; Coolify updates. The docs folder is one short guide per subject, from SSH hardening and edge SSO to a cutover checklist and a troubleshooting page, each written after the thing it describes went wrong once.

The two hosts

Both of my servers were built with it. The 12 GB Contabo host runs everything now: both sites, the dashboard, the mail relay, Pocket ID and TinyAuth for edge sign‑in. The older RackNerd box is the off‑host backup target and nothing else.

The game‑server variant

A Bedrock Minecraft server for family and friends across a few states wants its own VPS, and the setup differs in a few documented places: the pre‑flight’s CPU floor goes from one to four so a mis‑provisioned box fails at pre‑flight rather than as tick lag later, the mail relay is left out, and the firewall opens what the game needs.