Coolify

The open-source self-hosted PaaS (62.5k★, Apache-2.0, PHP): “deploy static sites, databases, full-stack applications and 280+ one-click services on your own servers” — the Vercel/Heroku/Netlify answer that runs on hardware you own. Product note: coolify (OSS). Lane: Open source PaaS (noite/celld, dokku kin).

What it is

Push-to-deploy from git, one-click app/service catalog, databases with scheduled backups, PR preview deployments, Traefik/Caddy reverse-proxy management with automatic TLS — all from a web UI on your own server. “Still free. Still self-hosted.”

v4.4 (2026-10-07, captured — “biggest release since v4”)

• Traffic analytics built in (Sentinel): reads Traefik/Caddy logs → requests, bandwidth, unique visitors, p95 latency, status codes, countries, referrers, devices — per server/app/service, no 3rd-party tracker
• Secret managers: Doppler, Infisical, Vault — {{vault.KEY}} resolved at deploy time, never stored, redacted from logs
• OIDC SSO (Entra ID, Authentik, Zitadel; per-provider registration rules)
• Cloudflare DNS automation: add a domain → DNS record created; delete → removed
• GitHub Actions runners (beta): your workflows on your build servers, fresh container per job
• Docker registry logins via UI; team audit log (who/what/when + before→after, across UI/API/MCP/webhooks — note: MCP in the audit surface); SQLite 1-click connect; server roles (deploy-only/build-only); Traefik acme.json backups

Field report (KRZ, from hands-on — the honest box)

I had some issues with it though and security posture was worse than expected — root required, and sudo NOPASSWD broke permissions when editing Traefik from the Coolify web UI. Managing isolated docker networks was hard or sometimes impossible.

The pattern to remember: Coolify’s UX assumes it owns the host — root-level agent, web UI that edits proxy config directly. On a shared/do-everything box (the doombox model: monitoring stack + llama-swap + hand-rolled Quadlets), that assumption collides with least-privilege hygiene. The features above (audit log, OIDC, secrets) harden the app; the host integration remains the weak seam.

Verdict (2026-10-07)

Weekend sideproject candidate — flagged, not started. Right shape for the homelab: it productizes exactly the deploy lane doombox currently hand-rolls (Quadlets + caddy/nginx + deploy scripts). Trial protocol if it happens: a dedicated VM or LXC (not doombox direct), one non-critical service first, judge the root/sudo seam and docker-network isolation against the Ops toolbelt OWASP-before-exposing checklist, compare effort vs the Open source PaaS alternatives (noite on celld, dokku) and vs plain Quadlet discipline. Kin: Homelabs, Agent-accessible product (Coolify v4.4 ships an MCP surface — the audit-log line above).