Deployment Guide

This guide covers deploying to Coolify on Hetzner servers.

Prerequisites

Complete the pre-deployment checklist before deploying.

Server Setup (Hetzner)

1. Create server in Hetzner Cloud:

   • Ubuntu 22.04 or 24.04
   • SSH keys configured
   • Appropriate resources for your traffic

2. Configure firewall:

   Port	Source	Purpose
   80/443	Anywhere	HTTP/HTTPS
   22	Your IP	SSH

3. Run hardening script from coolifyservermanagement

4. Install Coolify proxy

Coolify Setup

Create Environment

Create separate environments for staging and production.

Add Database

1. Create PostgreSQL database in Coolify
2. Copy the connection string

Add Application

1. Select your Git repository
2. Set build type to docker

Configuration:

Setting	Value
Domain	Your production domain
Build	docker

Environment Variables

Copy from .env.example and update:

PAYLOAD_SECRET=your-new-secure-secret
DATABASE_URI=postgres://coolify:password@host:5432/coolify
NEXT_PUBLIC_SERVER_URL=https://yourdomain.com
NEXT_PUBLIC_SITE_NAME="Your Project Name"

Tip

In Coolify, use $COOLIFY_URL for NEXT_PUBLIC_SERVER_URL.

Persistent Storage

Add mounts:

Type	Source	Destination
Volume	next	/app/.next/cache
Directory	media	/app/media

Set permissions:

chown -R 1001:1001 media
chmod -R 755 media

Health Check

Enable at /healthcheck

DNS Setup

Type	Name	Value	TTL
A	@	SERVER_IP	Auto
CNAME	www	yourdomain.com	Auto

SSL certificates are automatically provisioned by Traefik.

Post-Deployment Checklist

• Site loads at https://yourdomain.com
• Admin panel works at /admin
• Uploaded media displays correctly
• Media persists between deployments
• Health check returns 200

Updating

Push changes to Git. Coolify auto-deploys via webhook.

Rollback: Go to Coolify → deployments → click previous working version.

Troubleshooting

Issue	Solution
502 Bad Gateway	Check app logs, env vars, database
Uploads fail	Remove --entrypoints.https.http3 from proxy
Build fails	Check TypeScript errors in logs
SSL issues	Verify DNS points to server

Security

• SSH restricted to office IP
• Strong PAYLOAD_SECRET
• HSTS enabled
• Database backups configured