Secure Your Server

Use these layers to protect a server that runs Coolify or is connected to Coolify. Read the Security Model to learn which parts Coolify protects.

Do not lock yourself out

Keep your current SSH session open while you change SSH or firewall settings. Test each change from a second terminal. If SSH stops working, use the server console in your hosting provider dashboard.

1. Harden the server

Set up key-based SSH with the OpenSSH guide. Then add PasswordAuthentication no to /etc/ssh/sshd_config and run sudo sshd -t && sudo systemctl restart ssh.
Install security updates automatically with sudo apt install unattended-upgrades, or use Server patching.
On self-hosted Coolify, turn on 2FA or passkeys and keep a backup in a different location.

2. Close public ports

Use the firewall in your hosting provider dashboard. Do not use UFW by itself: Docker-published ports go around UFW rules.

Port	Rule
`22`	Allow only from your IP address and the Coolify server, or close it after step 3
`80`, `443`	Allow, or allow only from Cloudflare after step 4
`8000`, `6001`, `6002`	Close after the dashboard works through a domain or Tailscale

Do not open database ports unless a trusted client must connect directly. See Firewall for all ports.

3. Use Tailscale for private access

Tailscale makes SSH and the dashboard available only to devices in your tailnet.

Install Tailscale on each server and on your computer:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale ip -4

Test SSH with the Tailscale IP address: ssh root@100.x.y.z.
In Coolify, open each remote server, set IP address or domain to its Tailscale IP address, and click Revalidate connection.
Open the dashboard at http://100.x.y.z:8000.
Remove ports 22, 8000, 6001, and 6002 from the provider firewall.

Limits

Coolify Cloud cannot join your tailnet. Keep port 22 open to the Coolify Cloud IPv4 and IPv6 addresses.
Git providers cannot send webhooks to a dashboard that is only in your tailnet. For automatic deployments, keep the dashboard on a public domain and protect it with the WAF rule in step 5.

4. Put Cloudflare in front of your applications

Use one of these setups:

Cloudflare proxy: allow ports 80 and 443 only from the Cloudflare IP ranges, and use a Cloudflare Origin Certificate.
Cloudflare Tunnel: no inbound web ports.

In the Cloudflare dashboard, select your domain and go to Security > WAF. The available rules depend on your Cloudflare plan. Test new rules with Managed Challenge before you use Block.

Turn on the Managed rules for your plan.

Block the dashboard for other IP addresses, but allow webhooks. Action: Block.

(http.host eq "coolify.example.com"
  and not ip.src in {203.0.113.10}
  and not starts_with(http.request.uri.path, "/webhooks/"))

Add a rate limiting rule for login attempts. Action: Block above your request limit.

(http.host eq "coolify.example.com"
  and http.request.uri.path eq "/login"
  and http.request.method eq "POST")

Optional: block countries that you do not serve on application domains. Do not use it on the dashboard domain, because webhooks come from many countries.
```
(not ip.src.country in {"DE" "FR"})
```

Confirm the setup works

From a computer outside your tailnet, run nmap -Pn -p 22,80,443,6001,6002,8000 <server-public-ip>. Closed ports must show filtered or closed. Then make sure that the dashboard opens, each server validates, each application opens through HTTPS, and a Git push starts a deployment.