Self-Hosting with Coolify and Cloudflare
How I deployed my portfolio and other web applications using Coolify as a self-hosted PaaS with Cloudflare for DNS and TLS.
There's something satisfying about owning the whole deployment pipeline. When I decided to self-host my portfolio and the rest of my projects, what I wanted was the developer experience of Vercel or Railway with the infrastructure still under my control.
Coolify gave me that.
Why self-host
The case for managed platforms is a good one. They handle scaling, SSL, deployments and monitoring. You push code and it works.
I went the other way for four reasons. I wanted to understand the full stack instead of consuming it as a service. I wanted my infrastructure, my rules, my debugging. For my usage patterns, self-hosting is cheaper. And the homelab already had the compute sitting there.
The Coolify platform
Coolify is an open-source PaaS that runs on your own servers.
Git-based deployments
Deployments are git-based. Connect a repository, push to main, and it builds, deploys, and routes traffic automatically. If you've used Vercel or Netlify the workflow will feel familiar.
Container runtime
Underneath, it builds Docker images and runs them, so what I deploy through it can be a Next.js application, a static site, a backend API, or a database and the services around it.
Reverse proxy
Coolify manages the nginx or Traefik configuration automatically. Domain routing, SSL termination and traffic management sit with the platform.
Environment management
Secrets, environment variables and configuration go through the Coolify UI or API, and deployments pick the changes up without manual intervention.
The Cloudflare layer
DNS management
My domains point at Cloudflare's nameservers. DNS changes propagate quickly, and I get a clean interface for managing records.
TLS termination
Cloudflare provides SSL certificates automatically. Traffic from a browser to Cloudflare is encrypted, and traffic from Cloudflare to my origin is encrypted too, with origin certificates.
Additional protection
The proxy hides my origin IP, gives me basic DDoS protection, and caches static assets.
The architecture
- The browser requests my domain.
- Cloudflare DNS resolves it to Cloudflare's edge.
- The Cloudflare proxy forwards the request to my origin.
- The reverse proxy at the origin routes it to the right container.
- The application container serves the response.
Each layer has a specific responsibility, and I can troubleshoot or change any part independently.
Troubleshooting reality
Self-hosting means owning the problem end to end, and debugging walks that same path.
DNS issues
Is the domain resolving? Are the records pointing where I think they are? Is Cloudflare proxying, or is that record DNS-only?
TLS problems
Is the certificate valid, is the origin actually configured for HTTPS, are Cloudflare's SSL settings compatible with what the origin expects?
Routing problems
Is the reverse proxy receiving traffic at all, is it handing it to the right container, is the container listening on the port I said it was?
Application issues
Is the app healthy, are the environment variables set correctly, are there runtime errors in the logs?
I've hit all of those at one point or another, and each incident left me more confident in the system.
Lessons learned
Domain validation is the finicky one. The HTTPS scheme in Coolify's domain field matters, and small details like that produce failures that look mysterious until you find them. Layers mean troubleshooting layers, so when something breaks I verify each one from DNS to app. Managed services handle real work, and doing it yourself is how you find out what that work is. Every debugging session teaches me something about how the web works.
What I run
This site, Next.js with static content. A handful of personal projects and experiments. Backend API services for the projects that need one.
The trade-offs
Setup, maintenance and troubleshooting are mine. If my infrastructure goes down, so do my sites. Patching and hardening are my job too.
For learning, and for projects where I want full control, that's a trade I'll take.
If you're thinking about self-hosting, start with something you don't mind breaking. The skills you build along the way, DNS, TLS, containerization, reverse proxies, monitoring, transfer directly to professional infrastructure work.