Self-Hosting Coolify PaaS on Linux VPS in Pakistan: The Open-Source Vercel and Heroku Alternative

For software houses, digital agencies, and independent SaaS builders across Pakistan, developer productivity has long been tied to commercial Platform-as-a-Service (PaaS) providers like Vercel, Heroku, Render, and Fly.io. These platforms popularized git-driven workflows: push a commit to GitHub, trigger an automated containerized build, provision automatic SSL certificates, and receive a live preview URL in seconds.

However, operating commercial PaaS platforms in Pakistan has encountered severe friction:

1. Escalating Foreign Exchange Taxes and Bank Restrictions: Commercial PaaS services bill exclusively in US Dollars. Between State Bank of Pakistan (SBP) foreign transaction limits, 5% to 10% advance withholding taxes on international credit card transactions (often jumping to 14%–16% for non-filers), and unpredictable PKR currency volatility, a standard agency bill of $200–$500/month rapidly inflates into unpredictable operational expenditure.
2. Punitive Per-Seat and Bandwidth Pricing: Vercel charges $20 per team member per month before counting function execution timeouts and egress bandwidth costs. Heroku charges premium rates for small dynos and managed databases with limited memory allocations.
3. Regional Network Latency: Routing traffic from domestic users in Lahore, Karachi, or Islamabad through distant US East or EU West cloud edges introduces 140ms to 220ms of unnecessary round-trip latency.

The modern open-source answer is Coolify—often called the self-hosted Vercel and Heroku alternative. Paired with a dedicated, high-performance Linux VPS, Coolify delivers identical developer ergonomics: single-command deployments, automatic Let’s Encrypt SSL, integrated Traefik reverse proxying, multi-database management (PostgreSQL, MySQL, Redis, MongoDB), and zero recurring seat license fees.

This guide provides a comprehensive, production-grade engineering walkthrough for setting up, hardening, and operating Coolify on a Linux VPS.

---

Architecture Overview: How Coolify Operates Under the Hood

Unlike traditional monolithic control panels like cPanel or Plesk, Coolify operates on a modern, decoupled container orchestration architecture:

                  +--------------------------------------------------+
                  |                 Public Internet                  |
                  +--------------------------------------------------+
                                           |
                                [Ports 80 / 443 TCP]
                                           v
                  +--------------------------------------------------+
                  |               Traefik Reverse Proxy              |
                  |     - Let's Encrypt ACME Automated TLS           |
                  |     - Dynamic Routing via Docker Socket Labels   |
                  +--------------------------------------------------+
                                    /              \
                                   /                \
        [Internal Docker Bridge: coolify]      [Application Networks]
                                 /                    \
                                v                      v
            +---------------------------+   +-----------------------------+
            |      Coolify Core         |   |    Containerized Workloads  |
            | - Laravel / PHP Backend   |   | - Next.js (Node / SSR)      |
            | - Redis Queue Worker      |   | - Laravel 11/12 (PHP-FPM)   |
            | - PostgreSQL Metadata DB  |   | - PostgreSQL / Redis        |
            +---------------------------+   +-----------------------------+
                           |
                           v
            +---------------------------+
            |    Host Docker Engine     |
            | - Local Volume Mounts     |
            | - cgroup v2 Throttling    |
            | - S3 Backup Cron Tasks    |
            +---------------------------+

Coolify runs entirely inside Docker containers managed through its internal engine. The stack comprises:

• Coolify Engine (coolify): A Laravel-based dashboard and API orchestration layer.
• Coolify Realtime (coolify-realtime): WebSockets engine powering real-time build streaming and terminal output.
• Coolify Database (coolify-db): An internal PostgreSQL database storing team credentials, server states, deployment logs, and project metadata.
• Traefik Proxy (coolify-proxy): A reverse proxy listening on ports 80 and 443 that reads Docker labels and dynamically generates HTTP/HTTPS routing rules without requiring service restarts.

When you push code to GitHub or trigger a build, Coolify pulls your repository, builds a standard Docker image via Nixpacks or your project’s custom Dockerfile, binds it to an internal Docker network, and tells Traefik to route your designated domain name directly to the new container.

---

Prerequisites and System Sizing

To ensure stability during resource-intensive build processes (such as compiling Next.js TypeScript assets or running Composer package resolution), adhere to the following hardware baselines:

Workload Scope	Recommended VPS Specifications	Target Workloads
Starter / Micro-Agency	2 vCPU, 4 GB RAM, 50 GB NVMe	2–4 Next.js apps, 1 PostgreSQL instance, 1 Redis cache
Growing Software House	4 vCPU, 8 GB RAM, 100 GB NVMe	6–10 Client projects (Laravel, Node, Python), staging & production environments
High-Traffic Production	8 vCPU, 16 GB RAM, 200 GB NVMe	Multiple high-throughput APIs, eCommerce portals, dedicated worker queues

[!NOTE] For heavy production clusters processing continuous high-volume database reads/writes or running hundreds of concurrent tenant containers, examine bare-metal Dedicated Servers or localized Dedicated Servers in Pakistan to eliminate virtualization overhead and noisy-neighbor disk I/O contention.

Base OS Selection

We recommend Ubuntu 22.04 LTS or Ubuntu 24.04 LTS (64-bit) for broad compatibility with modern Docker CE engines and kernel-level cgroup v2 support.

---

Step 1: Base Linux VPS Provisioning and Hardening

Before installing Docker or Coolify, secure your base operating system and configure swap space to prevent memory-exhaustion build crashes.

1.1 Update System Packages

Connect to your VPS via SSH as root:

apt-get update && apt-get upgrade -y
apt-get install -y curl wget git jq ufw htop net-tools software-properties-common ca-certificates gnupg lsb-release

1.2 Configure Swap Space (Crucial for Node.js Builds)

Next.js builds and Docker multi-stage compiles frequently spike memory usage. Without swap, the Linux kernel Out-Of-Memory (OOM) killer will terminate Node processes during next build.

Allocate a 4 GB swap file on your fast NVMe storage:

fallocate -l 4G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

# Persist across reboots
echo '/swapfile none swap sw 0 0' >> /etc/fstab

# Tune kernel swappiness to favor physical RAM
sysctl vm.swappiness=15
sysctl vm.vfs_cache_pressure=50
echo 'vm.swappiness=15' >> /etc/sysctl.d/99-coolify.conf
echo 'vm.vfs_cache_pressure=50' >> /etc/sysctl.d/99-coolify.conf

1.3 Configure Firewall (UFW)

Coolify requires ports for web traffic, the administration console, SSH, and internal Docker communications:

# Set default policies
ufw default deny incoming
ufw default allow outgoing

# Open SSH (adjust if using a non-standard port)
ufw allow 22/tcp comment 'SSH Management'

# Web Traffic routed to Traefik
ufw allow 80/tcp comment 'Traefik HTTP'
ufw allow 443/tcp comment 'Traefik HTTPS'

# Coolify Management UI
ufw allow 8000/tcp comment 'Coolify Dashboard'

# Enable firewall
ufw --force enable
ufw status verbose

---

Step 2: Clean Docker Engine Installation

Coolify can automate Docker installation, but manually provisioning the official Docker CE repository ensures deterministic package management, non-buggy storage drivers, and proper systemd integration.

# Add Docker official GPG key
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg

# Add Docker repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker CE and Compose plugin
apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Enable and start Docker daemon
systemctl enable --now docker

Configure the Docker daemon for production stability by editing /etc/docker/daemon.json:

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "50m",
    "max-file": "3"
  },
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 65535,
      "Soft": 65535
    }
  }
}

Apply the daemon configuration:

systemctl restart docker

---

Step 3: Deploying Coolify via the Automated Script

With the base OS secured and Docker running, execute Coolify’s official automated installation:

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

The installer performs the following actions:

1. Downloads the production docker-compose.yml for Coolify to /data/coolify/source.
2. Generates secure, high-entropy cryptographic master keys and database credentials in /data/coolify/source/.env.
3. Creates dedicated Docker bridge networks (coolify, coolify-infra).
4. Pulls official container images: coollabsio/coolify:latest, coollabsio/coolify-realtime:latest, postgres:16-alpine, redis:alpine, and traefik:v3.1.
5. Starts the stack and mounts the Docker socket (/var/run/docker.sock).

Once the script concludes, check the health of the containers:

docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

You will see the active stack running:

• coolify
• coolify-realtime
• coolify-db
• coolify-redis
• coolify-proxy

Open your browser and navigate to:

http://YOUR_SERVER_IP:8000

Register your administrative account. This first user is automatically granted root administrative authority over the instance.

---

Step 4: Wildcard DNS and Traefik SSL Certificate Setup

Operating a production PaaS requires automated domain routing. Rather than manually configuring DNS records for each individual client app, microservice, or staging build, establish a Wildcard DNS architecture.

4.1 DNS Records Configuration

In your DNS provider (e.g., Cloudflare, Route53, or your domain registrar), add two records pointing to your Linux VPS IP:

Record Type	Name	Target / Value	TTL	Proxy Status
A	coolify.yourdomain.com	203.0.113.10 (Your VPS IP)	Auto	DNS Only (Grey Cloud)
A	*.apps.yourdomain.com	203.0.113.10 (Your VPS IP)	Auto	DNS Only (Grey Cloud)

[!IMPORTANT] If using Cloudflare, keep the records set to DNS Only (Grey Cloud) during initial Let’s Encrypt validation so that ACME challenge tokens can reach your Traefik instance directly on port 80.

4.2 Securing the Coolify Control Plane

Within the Coolify dashboard:

1. Navigate to Settings > Instance Settings.
2. Set the Instance Domain to https://coolify.yourdomain.com.
3. Save changes. Coolify dynamically writes a routing rule to Traefik, provisions a Let’s Encrypt certificate, and switches the admin interface to secure HTTPS on port 443.

---

Step 5: Connecting GitHub & GitLab for Automated CI/CD

Coolify integrates directly with GitHub Apps and GitLab Webhooks to enable seamless push-to-deploy workflows without requiring external CI runners like GitHub Actions.

5.1 Setting Up a GitHub App

1. Inside Coolify, go to Sources > Add New > GitHub App.
2. Enter your Organization or User account name.
3. Click Create GitHub App. Coolify pre-fills GitHub’s API registration form with webhook callback URLs and requisite permission scopes:
   • Repository permissions: Contents (Read)
   • Pull requests (Read & Write) (for preview deployments)
   • Webhooks (Read & Write)
4. Install the GitHub App on your desired repositories (e.g., client projects, staging codebases).

Once connected, pushing code to your designated branch (such as main or production) sends a webhook payload to Coolify, which triggers an automated rebuild and rolling container swap without downtime.

---

Step 6: Deploying Real-World Stacks on Coolify

6.1 Deploying Next.js 14/15 (SSR / Node.js Standalone)

For optimal memory performance inside Docker containers, configure your Next.js project to use standalone output. In your next.config.js:

/** @type {import('next').NextConfig} */
const nextConfig = {
  output: 'standalone',
  poweredByHeader: false,
  compress: true,
};

module.exports = nextConfig;

In Coolify:

1. Click Projects > Select Environment > New Resource > Public / Private Repository.
2. Select your Next.js repository.
3. Set Build Pack to Nixpacks (or Dockerfile if you maintain a custom multi-stage Docker build).
4. Under Ports Exposes, define 3000.
5. Enter your domain: https://frontend.apps.yourdomain.com.
6. Click Deploy.

Coolify runs the build in a temporary build container, maps the output to a persistent container, verifies health checks, and registers the domain with Traefik.

6.2 Deploying Laravel 11/12 with PostgreSQL & Redis

For a robust PHP application, combine an application container with isolated database services:

1. Add PostgreSQL: In the project canvas, select New Resource > Databases > PostgreSQL. Set the database name, user, and password. Coolify spins up an isolated container and attaches it to the project network.
2. Add Redis: Select New Resource > Databases > Redis.
3. Add Laravel Application: Select your Laravel repository.
   • Set Build Pack: Nixpacks or Docker Compose.
   • Under Environment Variables, reference the internal network hostnames:

     APP_ENV=production
     APP_DEBUG=false
     APP_URL=https://api.apps.yourdomain.com
     DB_CONNECTION=pgsql
     DB_HOST=postgresql-internal-hostname
     DB_PORT=5432
     DB_DATABASE=app_production
     DB_USERNAME=coolify
     DB_PASSWORD=${POSTGRESQL_PASSWORD}
     CACHE_DRIVER=redis
     QUEUE_CONNECTION=redis
     REDIS_HOST=redis-internal-hostname
     REDIS_PORT=6379

4. Set post-deployment commands in Coolify:

   php artisan migrate --force && php artisan config:cache && php artisan route:cache && php artisan view:cache

---

Step 7: Enforcing Container Resource Limits (CPU & RAM Throttling)

In a multi-tenant agency VPS hosting multiple client sites, a memory leak or runaway infinite loop in one container must not crash adjacent applications or the VPS itself.

Coolify allows granular cgroup v2 resource limits per application:

1. Navigate to your application > Configuration > Resources.
2. Configure Memory Limits:
   • Memory Limit: 512M or 1024M (Maximum RAM before the container is throttled or killed).
   • Memory Reservation: 256M (Guaranteed floor allocated to the container).
3. Configure CPU Limits:
   • CPUs: 1.5 (Prevents a single process from locking 100% of all available CPU cores).

Under the hood, Coolify injects these parameters directly into the container’s runtime flags:

docker run -d \
  --cpus="1.5" \
  --memory="1024m" \
  --memory-reservation="256m" \
  ...

---

Step 8: Production Offsite S3 Backups

A self-hosted PaaS is only as reliable as its backup strategy. Relying solely on local disk storage leaves your business exposed to hardware failure or accidental data loss.

Coolify features built-in scheduled backups to any S3-compatible object storage provider (such as Cloudflare R2, Wasabi, AWS S3, or Backblaze B2).

8.1 Configuring S3 Backup Destinations

1. Go to Settings > Sources / Destinations > S3 Storage.
2. Provide your S3 credentials:
   • Bucket: agency-coolify-backups
   • Endpoint: https://<account-id>.r2.cloudflarestorage.com (for Cloudflare R2)
   • Access Key ID: YOUR_ACCESS_KEY
   • Secret Access Key: YOUR_SECRET_KEY
   • Region: auto / us-east-1

8.2 Automating Database Backups

For every PostgreSQL, MySQL, and MongoDB instance created in Coolify:

1. Select the Database > Backups.
2. Enable Scheduled Backups.
3. Set Cron Expression: 0 2 * * * (Every night at 02:00 AM PKT).
4. Set Retention: 14 days.
5. Select your S3 destination.

Coolify executes pg_dump or mysqldump directly within the container network, streams the compressed archive to your S3 bucket, and verifies checksum integrity.

---

Step 9: Coolify System Maintenance & Diagnostic Cheatsheet

Keep this operational cheatsheet handy for routine maintenance on your Linux VPS:

Updating Coolify

Coolify updates automatically if enabled in settings, but you can trigger a clean manual update via CLI:

# Pull latest installer and restart core containers
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

Cleaning Up Dangling Docker Artifacts

Continuous builds generate untagged Docker images, intermediate build stages, and orphaned build caches that consume valuable NVMe disk space. Execute a weekly maintenance purge:

# Remove stopped containers, unused networks, and dangling images
docker system prune -af --volumes

Inspecting Live Traefik Proxy Routing

If a custom domain displays a 404 page not found from Traefik:

# Inspect Traefik logs in real-time
docker logs -f coolify-proxy --tail 50

---

Transitioning from Single VPS to Dedicated Bare-Metal Clusters

As your agency or SaaS scales beyond 20–30 active client workloads, a single virtual server may encounter hardware limitations:

• Disk I/O Bottlenecks: Multiple concurrent database writes saturate virtual block storage.
• Build-Time CPU Steal: Heavy Docker compilation jobs momentarily slow down live HTTP request processing.

Coolify solves this via Multi-Server Clustering. You can maintain your main Coolify management console on a lightweight VPS, and attach remote worker nodes through secure SSH agent tunnels.

For maximum database throughput and dedicated hardware isolation, deploying bare-metal Dedicated Servers provides unshared NVMe write speeds, predictable core allocations, and total infrastructure control. For applications serving domestic users requiring sub-15ms round-trip times, low-latency Dedicated Servers in Pakistan provide direct regional peering across local telecom exchanges.

---