Half of our clients say some version of "we love how Vercel feels, but the bill gets brutal once we cross hobby usage," or "we can't put this on a shared US PaaS for compliance reasons." The good news: the open-source ecosystem in 2026 is genuinely competitive on developer experience. The PaaS-grade workflow you want (git push, preview deploy, automatic TLS, one-click rollback) is now a weekend of setup on a single VPS. This is the stack we ship.
The stack at a glance
- Coolify: the PaaS control plane. Connect a Git repo, pick a build pack, get a deployment.
- Caddy: reverse proxy plus automatic Let's Encrypt TLS. The "https just works" part.
- Docker + BuildKit: the build and runtime layer.
- Postgres + Redis: managed via Coolify's database support, or external when the SLA matters.
- Restic + S3-compatible storage: for off-host backups.
- Uptime Kuma + Beszel: open-source uptime and lightweight metrics, plus Plausible for analytics.
Why Coolify specifically
We tried Dokku, CapRover, Dokploy, and Coolify on real client projects. Coolify won on three axes:
- Multi-server out of the box. You can manage a fleet of VPSes from one UI (production, staging, and a "spike" pool) without standing up a Kubernetes cluster.
- The build pack model. Dockerfile, Docker Compose, Nixpacks, and static sites all work. We rarely have to invent.
- Real PR previews. Open a GitHub PR, get a preview URL. The same feature you ditched Vercel to avoid paying for.
The trade-off: Coolify still moves fast and has rough edges. Pin a version, do not auto-update.
The one-VPS production setup
Many of our clients ship serious workloads on a single $40/month VPS. The shape:
- 4 vCPU, 8 GB RAM, 160 GB SSD: Hetzner CPX31 or DO 8GB.
- Coolify installed at the root domain (
panel.example.com), behind Caddy. - Two or three application containers, one Postgres, one Redis, one queue worker.
- Daily Restic backups to Backblaze B2 (cheap S3-compatible storage). Tested restores monthly.
- UFW firewall + Tailscale for SSH access. The panel is not on the public internet.
The deploy loop
What developers experience after the setup is done:
- Push to
main→ production deploy with zero-downtime container swap. - Open a PR → preview environment at
pr-123.preview.example.comwith its own ephemeral database snapshot. - Tag a release → image is built once and reused for staging then production.
- Roll back → one button in Coolify, or
coolify deploy --rollbackfrom CI.
What Caddy quietly handles
Caddy is the unsung hero. Out of the box you get:
- Automatic HTTPS via Let's Encrypt, including for ephemeral preview subdomains via on-demand TLS.
- HTTP/3 and HTTP/2 without flag-flipping.
- A Caddyfile that fits on one screen for most apps.
- Reverse-proxy upstreams with health checks and circuit breakers.
If you have ever fought a renewal-failed certbot cron at 3am, you understand why this matters.
Cost reality
For a typical post-Hobby SaaS we have moved off Vercel + Supabase + Neon:
- Before: $280/mo for the platform tier, plus database and bandwidth overages.
- After: $40/mo VPS + $7/mo Backblaze + $0 for Coolify/Caddy/Postgres.
The trade is that someone on the team needs to own the box. Not 40 hours a week, more like two hours a month once the setup stabilizes. For most early-stage teams, that's a fair swap.
Self-hosting is not a religion. It is a tool. Use it when the economics or the compliance story justify the operational tax. Stay on managed PaaS when they do not.
Where we still reach for managed
- Email delivery: Postmark / Resend. Running your own SMTP is a deliverability nightmare.
- CDN for global static assets: Bunny or Cloudflare in front of the VPS.
- Object storage: S3-compatible (Backblaze B2, Cloudflare R2). Self-hosting MinIO works, but the durability story is on you.
- Production databases past ~50 GB: managed Postgres. The backup/restore/PITR engineering isn't where you want to spend your evenings.
Starting checklist
- Pick a VPS region close to your users.
- Install Coolify via the one-line script, pin the version, never enable auto-update.
- Configure Caddy with on-demand TLS for preview subdomains.
- Wire Restic + B2 for nightly backups. Test a restore in week one.
- Set up Uptime Kuma + Beszel before you put a customer on it.
- Document the runbook for "Coolify is down": it's the only single point of failure in this stack.