Multiple Server Coolify with pfSense Firewall on RamNode VPS

What You'll Build

pfSense firewall as network gateway and security layer
Coolify master server for orchestration and management
Multiple worker nodes for application deployment
Secure internal network with proper firewall rules
Load balancing and high availability setup

Prerequisites

Before starting, ensure you have:

Server Requirements

• Active RamNode account
• Ability to deploy multiple VPS
• Minimum 3 public IP addresses
• Access to control panel

→ View Cloud VPS Plans

Technical Knowledge

• Linux system administration
• Docker & containerization
• Network configuration
• Firewall management

Resource Requirements

• pfSense VM: 2 CPU cores, 4GB RAM, 20GB storage
• Coolify Master: 4 CPU cores, 8GB RAM, 50GB storage
• Worker Nodes: 2-4 CPU cores, 4-8GB RAM, 30GB+ storage each

Architecture Design

Network topology overview:

Network Topology

Internet
│
┌───▼───┐
│pfSense│ (Public IP: xxx.xxx.xxx.1)
│Gateway│
└───┬───┘
  │ Internal Network: 10.10.10.0/24
  │
  ├── Coolify Master (10.10.10.10)
  ├── Worker Node 1 (10.10.10.20)
  ├── Worker Node 2 (10.10.10.21)
  └── Worker Node N (10.10.10.2x)

Service Distribution

pfSense: Network gateway, firewall, VPN endpoint
Coolify Master: Web UI, orchestration, database
Worker Nodes: Application containers, load balancing

Deploy pfSense VPS

Order and configure pfSense VPS:

Server Specifications

• Location: Choose closest to your users
• OS: FreeBSD 13 or Latest
• CPU: 2 cores minimum
• RAM: 4GB minimum
• Storage: 20GB SSD
• Network: Request 2 IP addresses minimum

📝 Note: Write down your primary and secondary IP addresses. Configure reverse DNS if needed. Ensure you have console access via VNC.

Deploy Coolify Master Server

Order master server VPS:

Master Server Specs

• OS: Ubuntu 22.04 LTS
• CPU: 4 cores
• RAM: 8GB
• Storage: 50GB SSD
• Network: 1 public IP address

Connect and Update

ssh root@your-master-ip

# Update system
apt update && apt upgrade -y

# Install essential packages
apt install -y curl wget git htop ufw fail2ban

Deploy Worker Node VPS

Repeat for each worker node (recommended: 2-3 nodes minimum):

Worker Node Specs

• OS: Ubuntu 22.04 LTS
• CPU: 2-4 cores
• RAM: 4-8GB
• Storage: 30GB+ SSD
• Network: Public IP optional (can use pfSense NAT)

Basic Worker Setup

# Connect via SSH
ssh root@worker-ip

# Update and prepare
apt update && apt upgrade -y
apt install -y curl wget docker.io docker-compose
systemctl enable docker
systemctl start docker

pfSense Configuration

Configure pfSense firewall:

Initial pfSense Setup

1. Access VNC Console from RamNode control panel

2. Boot from FreeBSD installer and follow pfSense installation wizard

Network Configuration

WAN Interface: vtnet0 (Primary RamNode IP)
LAN Interface: vtnet1 (10.10.10.1)

WAN IP: Use DHCP or static (your primary RamNode IP)
LAN IP: 10.10.10.1/24
DHCP Range: 10.10.10.100-10.10.10.200

Web Interface Access

pfSense Web Login

URL: https://10.10.10.1
Default Login: admin/pfsense

🔐 Security: Immediately change the default admin password to a strong password after first login!

Configure Firewall Rules

Navigate to: Firewall → Rules → LAN

• Allow LAN to any (default)
• Allow HTTP/HTTPS to Coolify Master
• Allow SSH between internal hosts
• Block unnecessary outbound traffic

Port Forward Rules

Navigate to: Firewall → NAT → Port Forward

Create Port Forwards

HTTP (80) → Coolify Master (10.10.10.10:80)
HTTPS (443) → Coolify Master (10.10.10.10:443)
SSH (2222) → Coolify Master (10.10.10.10:22)
Coolify Dashboard (8000) → Master (10.10.10.10:8000)

Docker Swarm Ports

Allow these ports for Docker Swarm communication:

Swarm Communication Ports

Port 2377/tcp (cluster management)
Port 7946/tcp+udp (node communication)
Port 4789/udp (overlay network)

Configure Master Server Network

Configure static networking for pfSense:

Edit Netplan Configuration

nano /etc/netplan/01-netcfg.yaml

Netplan Configuration

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: false
      addresses:
        - 10.10.10.10/24
      gateway4: 10.10.10.1
      nameservers:
        addresses:
          - 8.8.8.8
          - 1.1.1.1

Apply Configuration

# Apply network configuration
netplan apply

# Verify connectivity
ping 8.8.8.8
ping 10.10.10.1

Install Docker and Coolify

Install Docker on the master server:

Install Docker

# Install Docker
curl -fsSL https://get.docker.com | sh

# Add user to docker group
usermod -aG docker $USER

# Start and enable Docker
systemctl enable docker
systemctl start docker

# Verify installation
docker --version
docker-compose --version

Initialize Docker Swarm

Setup Docker Swarm

# Initialize Docker Swarm
docker swarm init --advertise-addr 10.10.10.10

# Save the worker join token (you'll need this later)
docker swarm join-token worker

Install Coolify

Download and Install Coolify

# Create coolify directory
mkdir -p /opt/coolify
cd /opt/coolify

# Download Coolify installer
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

Configure Coolify Environment

nano /opt/coolify/.env

Coolify Environment Variables

APP_URL=https://your-domain.com
APP_NAME=Coolify
DB_PASSWORD=your-secure-database-password
REDIS_PASSWORD=your-secure-redis-password
PUSHER_APP_KEY=your-pusher-key
PUSHER_APP_SECRET=your-pusher-secret

Start Coolify Services

# Start Coolify
cd /opt/coolify
docker-compose up -d

# Verify services are running
docker-compose ps

✅ Access Coolify Dashboard at: http://10.10.10.10:8000 or through pfSense port forward

Configure Worker Nodes

For each worker node, configure network and join swarm:

Worker Network Configuration

nano /etc/netplan/01-netcfg.yaml

Worker Netplan Config

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: false
      addresses:
        - 10.10.10.2X/24  # Replace X with node number (20, 21, etc.)
      gateway4: 10.10.10.1
      nameservers:
        addresses:
          - 8.8.8.8
          - 1.1.1.1

Apply and Install Docker

netplan apply

# Install Docker
curl -fsSL https://get.docker.com | sh
systemctl enable docker
systemctl start docker

Join Docker Swarm

Join Swarm as Worker

# Use the token from master server
docker swarm join --token SWMTKN-1-xxxx 10.10.10.10:2377

Verify from Master

# On master server, verify nodes
docker node ls

Add to Coolify Dashboard

In Coolify, navigate to Servers → Add Server

Worker Node Details

Name: worker-01
IP Address: 10.10.10.20
Port: 22
User: root

Configure SSH Access

# On master server, copy SSH key to worker
ssh-copy-id root@10.10.10.20

# Test connection
ssh root@10.10.10.20 "docker --version"

Configure DNS and Load Balancing

pfSense DNS Configuration

Navigate to: Services → DNS Resolver

Add Host Overrides

coolify.local → 10.10.10.10
worker1.local → 10.10.10.20
worker2.local → 10.10.10.21

Install HAProxy

Navigate to: System → Package Manager

1. Search for: haproxy
2. Install HAProxy package

Configure HAProxy

Navigate to: Services → HAProxy

Backend Configuration

Name: coolify_backend
Servers: 
  - 10.10.10.10:80
  - 10.10.10.20:80
  - 10.10.10.21:80
Health Check: HTTP

Frontend Configuration

Name: web_frontend
Listen Address: WAN Interface
Port: 80, 443
Default Backend: coolify_backend

SSL/TLS Configuration

Install Certbot on Master

# Install certbot
apt install -y certbot

# Generate certificates
certbot certonly --standalone -d your-domain.com

Navigate to: System → Cert Manager in pfSense to import SSL certificates and apply to HAProxy frontend

Security Hardening

SSH Hardening

Edit SSH Configuration

nano /etc/ssh/sshd_config

Recommended SSH Settings

Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers coolify-admin

Firewall Configuration

Configure UFW on Each Server

ufw default deny incoming
ufw default allow outgoing
ufw allow from 10.10.10.0/24 to any port 22
ufw allow from 10.10.10.0/24 to any port 2376
ufw enable

Docker Daemon Security

Configure Docker Daemon

nano /etc/docker/daemon.json

Docker Security Configuration

{
  "hosts": ["unix:///var/run/docker.sock"],
  "tls": true,
  "tlscert": "/etc/docker/server-cert.pem",
  "tlskey": "/etc/docker/server-key.pem",
  "tlsverify": true,
  "tlscacert": "/etc/docker/ca.pem"
}

🔐 Security Best Practices: Block all inbound except HTTP/HTTPS/SSH, limit SSH access to specific IPs, enable intrusion detection (Snort/Suricata), configure rate limiting, and enable DDoS protection.

Setup Monitoring

Install monitoring stack on master server:

Create Monitoring Directory

mkdir -p /opt/monitoring
cd /opt/monitoring

Create Docker Compose

nano docker-compose.yml

Monitoring Stack Configuration

version: '3.8'
services:
  prometheus:
    image: prom/prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml

  grafana:
    image: grafana/grafana
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=your-secure-password

  node-exporter:
    image: prom/node-exporter
    ports:
      - "9100:9100"

Configure Prometheus

nano prometheus.yml

Prometheus Configuration

global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'coolify-master'
    static_configs:
      - targets: ['10.10.10.10:9100']

  - job_name: 'worker-nodes'
    static_configs:
      - targets: ['10.10.10.20:9100', '10.10.10.21:9100']

Automated Backups

Create Backup Script

nano /opt/scripts/backup.sh

Backup Script

#!/bin/bash

# Backup Coolify database
docker exec coolify_db pg_dump -U coolify > /backups/coolify_$(date +%Y%m%d).sql

# Backup Docker volumes
docker run --rm -v coolify_data:/data -v /backups:/backup alpine tar czf /backup/coolify_data_$(date +%Y%m%d).tar.gz /data

# Upload to remote storage (configure as needed)
# rclone copy /backups remote:coolify-backups/

Schedule Backup

chmod +x /opt/scripts/backup.sh
crontab -e
# Add: 0 2 * * * /opt/scripts/backup.sh

Testing and Verification

Verify Network Connectivity

Test Connections

# Check network connectivity
ping 10.10.10.10
telnet 10.10.10.10 2377

# Verify firewall rules
iptables -L
ufw status

# Check Docker Swarm status
docker node ls
docker system events

Verify Coolify Dashboard

Check Coolify Services

docker-compose ps
docker-compose logs

# Check if services are listening
netstat -tlnp | grep 8000

Test Application Deployment

1. Access Coolify dashboard at http://your-pfsense-ip:8000

2. Deploy a test application

3. Verify it's accessible through pfSense

Common Troubleshooting

Connection Issues Between Nodes

Debug Network

# Check network connectivity
ping 10.10.10.10
telnet 10.10.10.10 2377

# Verify firewall rules
iptables -L
ufw status

# Check Docker Swarm status
docker node ls

Coolify Dashboard Not Accessible

Check Services

# Check Coolify services
docker-compose ps
docker-compose logs

# Verify port forwarding in pfSense
netstat -tlnp | grep 8000

pfSense Performance Issues

Monitor Resources

# Check CPU and memory
top

# Monitor network interfaces
netstat -i

Check firewall logs: Navigate to Status → System Logs → Firewall in pfSense

View Logs

Log Commands

# Coolify logs
docker-compose logs -f
docker logs coolify_app

# Docker Swarm logs
docker system events
docker node inspect worker-01

Deployment Complete

You now have a robust, scalable infrastructure for running Coolify across multiple servers with proper security and network isolation. The pfSense firewall provides enterprise-grade security, while the multi-server Coolify setup ensures high availability and performance.

Key Benefits Achieved

✅ Security: pfSense firewall with proper rule configuration
✅ Scalability: Multiple worker nodes for application deployment
✅ High Availability: Docker Swarm clustering with automatic failover
✅ Monitoring: Comprehensive monitoring and alerting setup
✅ Backup: Automated backup strategy for data protection

Next Steps

1. Configure domain names and SSL certificates
2. Set up monitoring alerts and notifications
3. Implement automated scaling policies
4. Configure additional backup destinations
5. Test disaster recovery procedures

Support Resources

• Coolify Documentation
• pfSense Documentation
• Docker Swarm Guide
• RamNode Support: Submit ticket through client area

Related Guides

Coolify Single Server Setup

Learn how to set up Coolify on a single server

pfSense Firewall Setup

Complete guide to pfSense firewall configuration