Limit coolify access to the machine or network

[hensansi]

This issue was closed but I found a cleaner solution on how to deal with this:

The solution is to add the following to /data/coolify/source/.env:
APP_PORT=127.0.0.1:8000

This will bind the docker service to the localhost not exposing it to the internet.

In my case I'm actually using tailscale and I want to still keep it exposed to that network so I can simply grab the ip with tailscale ip and use that instead of 127.0.0.1

The final solution to add the entry to the file looks something like this:

LOCAL_IP=$(tailscale ip 2>/dev/null | head -n1 || echo "127.0.0.1") && \
echo "APP_PORT=${LOCAL_IP}:8000" >> /data/coolify/source/.env

Afterwards if you run the /data/coolify/source/upgrade.sh script the services should be restarted with the new variable.

If there is someone from the collaborators or the team that could add/link the solution to that issue, maybe it will help other people out there.

FYI:
There is a weird artifact 0/tcp shouldn't be there but it should be of no consequence:

Ports before:
443/tcp, 8000/tcp, 9000/tcp, 0.0.0.0:8000->80/tcp

Ports after:
0/tcp, 443/tcp, 9000/tcp, 127.0.0.1:8000->80/tcp

FYI 2:
Oh, and keep in mind that the coolify-realtime is still exposed. I'm new to coolify so I will just avoid exposing till I know what is for.
0.0.0.0:6001-6002->6001-6002/tcp

LOCAL_IP=$(tailscale ip 2>/dev/null | head -n1 || echo "127.0.0.1") && \
echo "SOKETI_PORT=${LOCAL_IP}:6001" >> /data/coolify/source/.env

[hensansi]

@peaklabs-dev can you add this extra info to #2427?

[djsisson]

you can use a custom.yml file to override the defaults also
just save it in this location:
/data/coolify/source/docker-compose.custom.yml

i use this since i dont need any ports mapped to host

services:
    coolify:
        ports: !reset []
    soketi:
        ports: !reset []

but you can also use !override

services:
    coolify:
        ports: !override
          - 127.0.0.1:8000:80
    soketi:
        ports: !override
          - 127.0.0.1:6001:6001
          - 127.0.0.1:6002:6002

[its-michaelroy]

@hensansi

Thank you so much! I wasted 4 days trying to figure out how to do this correctly while going through my server checklist. I'm glad I found these posts.

For my specific setup, (Debian 12 Bookworm) I did the following:

---

1. Install Tailscale

• Visit the Tailscale Website and follow their installation instructions. It's straightforward and well-documented.

• After Installation:

  • Set up Tailscale on both your server and device.
  • Review all settings within your Tailscale admin console, including:
    • Approving devices.
    • Managing tokens.
    • Configuring access controls.

---

2. Test SSH Access

• Attempt to SSH into Your Server:

  ssh user1@<your-server-ip>

• If SSH Doesn't Work:

  • Review Firewall Settings:

    • Check iptables, UFW, Firewalld, or any other firewall you're using to ensure that SSH traffic is allowed.

  • Check sshd_config:

    • Ensure that your user (User1) and/or IP addresses are permitted to log in.
    • Verify settings like AllowUsers or PermitRootLogin as needed.

---

3. Bind Docker to Tailscale IP

• Execute the Following Commands to Bind Coolify's Ports to Your Tailscale IP (Credits to @hensansi):

  LOCAL_IP=$(tailscale ip 2>/dev/null | head -n1 || echo "127.0.0.1")
  echo "APP_PORT=${LOCAL_IP}:8000" | sudo tee -a /data/coolify/source/.env
  echo "SOKETI_PORT=${LOCAL_IP}:6001" | sudo tee -a /data/coolify/source/.env

  Explanation:

  • tailscale ip: Retrieves the Tailscale IP address.
  • APP_PORT and SOKETI_PORT: Bind Coolify's application and real-time service to the Tailscale IP.

---

4. Verify .env Configuration

• Check the Updated .env File:

  cat /data/coolify/source/.env

  You Should See:

  APP_PORT=<tailscale-ip>:8000
  SOKETI_PORT=<tailscale-ip>:6001  # Real-time service/Proxy
  

  (Replace <tailscale-ip> with your actual Tailscale IP address.)

---

5. Restart Coolify Services

• Run the Upgrade Script to Apply Changes:

  sudo /data/coolify/source/upgrade.sh

---

6. Check Docker Containers Status

• Verify All Containers Are Running Correctly:

  sudo docker ps

  Expected Output:

  • Coolify: Up and listening on port 8000.
  • Coolify-Realtime: Up and listening on port 6001.
  • Traefik: Up and healthy, managing ports 80, 443, 8080.
  • Other Dependencies: PostgreSQL, Redis, etc., should also be running.

---

7. Test Port Accessibility

• Use curl to Check If the Ports Are Functioning Properly:

  curl http://<tailscale-ip>:8000
  curl http://<tailscale-ip>:6001

  Replace <tailscale-ip> with Your Actual Tailscale IP Address.

  Expected Outcome:

  • Port 8000: Should return the Coolify UI or a relevant response.
  • Port 6001: While it might not return readable content, the connection should be established without errors.

---

8. Final Verification

• Access Coolify's UI:

  • Via Tailscale:

    http://<tailscale-ip>:8000 (Success!)
    

  • Via Public VPN:

    http://<Server IP>:8000 (Now should not load)
    

• Ensure the UI Loads Without the Real-Time Service Warning.

• Perform Actions in Coolify That Rely on Real-Time Updates (e.g., Deploying an App) and Verify They Function Correctly.

---

Hopefully, this helps others facing similar challenges! Thanks to everyone who contributed.

[bitsByB]

@its-michaelroy, thank you so much for this detailed how-to, it really is clear 😄
Like you it's been a while I'm trying to solve this problem (I'm on Ubuntu server), so I really appreciate you taking the time to explain the process step by step in a clear fashion!

Everything works perfectly as explained! (edited this post)

I have a question: is there a way to make it https? maybe using Caddy?
Thanks for letting me know what you think Michael

[its-michaelroy]

@bitsByB I haven’t used Caddy myself, but it’s definitely an option worth considering. In my setup, I specify the domain within Coolify before deploying my app as https://subdomain.domain.com. Since I'm using Cloudflare, I manage my certificates and proxy settings through their dashboard after creating A records pointing to the public IP.

I did come across a tutorial by a creator named Syntax that seems quite solid. You can find it here:

https://youtu.be/taJlPG82Ucw

The first 25 minutes should cover Caddy, HTTPS domains, and proxies, which might be exactly what you’re looking for.

Hope this helps!

[bitsByB]

Nice @its-michaelroy! yes I found it too! that's exactly what I was looking for...

Maybe you have an idea: I missed configure something in Coolify and now I'm getting a 525 Cloudflare error and can't access the dashboard sign in page anymore... everything worked perfectly before that!

Someone suggested I could reopen the port 8000 and then use ip:8000 to get back into the dashboard.
In our case it would be tailscale-ip:8000, do you know how I should do that with the configuration you and @hensansi advised?

Thanks Michael!

[its-michaelroy]

Yes, to use Tailscale, you’ll need to download, install, and enable it first. Once it’s set up, you can navigate to your server's IP address.

Finding the IP Address of Your Tailscale Device

1. Using the Tailscale App or Website

• Open the Tailscale app or log in to the Tailscale website.
• You’ll see the IP addresses assigned to each of your devices in the network. (IE: 100.100.101.12 - Server)

2. Finding the IP by SSHing into the Server

• If you’re already SSH’d into your server, you can run the following command to get the Tailscale IP directly:

  tailscale ip -4
  100.100.101.12

  *Sidenote: Check your FW rules as well & make sure you look at your Cloudflare settings to ensure it's not on Full (Strict) mode as this can cause a lot of errors if the cert isn't exactly the way it wants it. Best to leave it on just Full for now and try to work on that later.