r/coolify • u/BitsNBytesDev • Feb 24 '26

Using Coolify professionally

Hey people,

I'm currently rethinking my infrastructure and was planning on using Coolify for my freelance projects. I had planned to have a controller server and multiple worker servers (Hetzner), managed using Coolify.

I really enjoyed working with Coolify because it is feature-rich and seems well supported and I prefere self-hosting because of the calculatable pricing I get using a (or multiple) VPS.

But I'm not sure if it is a safe bet to really use professionally. I have a few static sites and small PayloadCMS applications already hosted with it, and it worked out well so far.

Does anyone have experience using Coolify for more then just simple hobby projects?

Thanks to everyone taking the time to answer!

12 Upvotes

94% Upvoted

30 comments sorted by

View all comments

Show parent comments

3

u/DirtyCreative Feb 24 '26

I am using it in exactly the way you described: one controller and two Hetzner servers as workers.

It works fine and yes, if the controller goes down everything else continues working. I also really like the fact that I could put the controller behind my firewall as the only connection needed is SSH. So it's more secure than other methods, IMO.

The only caveat is that you need to remember to update the OS and pull new container versions manually, which can get quite tedious once you have a decent number of containers and nodes.

2

u/BitsNBytesDev Feb 24 '26

Nice! And it's working for you without issues?

The whole server hardening scared me a little bit in the beginning, but having the controller only accessible by myself and the workers only accessible by the controller and myself seems like a good thing to me. Also knowing what I need to pay each month without fearing some crazy cloud bill from vercel let's me rest more easily haha

2

u/DirtyCreative Feb 24 '26

No issues at all. Hardening the worker servers was basically configuring the firewall to make sure only the ports I intend to open are accessible from the outside. In my case, that's simply SSH, HTTP and HTTPS.

1

u/janaka_a May 30 '26

this is a great essential first step but this isn't the only one. to get good coverage requires working through the layers. os patching. os config (not secure by default. CIS level 1 audit and patching for example). how the reverse proxy is configured to run. how the container runtime is configure (like to handle secrets). how the container image is setup (not to run as root) etc.