This page is the map of persmon.cloud: what runs on the box, what each thing is for, how a request travels from a browser to a container, and how the whole thing is kept backed up, patched and watched.
Every public hostname resolves to the same IP. Traefik reads the hostname and hands the request to the right container over Docker's private networks. Nothing but ports 22, 80 and 443 is open to the internet.
Each app is a Coolify resource built from a Git repository. Coolify builds the image on the server, starts the container, and tells Traefik which hostname belongs to it.
Multi-tenant hotel property-management system with point-of-sale. This is the public demo host, reseeded with fresh sample data every night at 03:30.
Five containers: a web front end, an api, a dedicated postgres, a redis cache and a caddy sidecar that serves the built front end and proxies /api to the backend. Backed up nightly at 02:30.
The same HMS platform, deployed as an isolated instance for Ishasha Junction Hotel. Real bookings, real staff, real data — so it has its own database and its own 02:45 backup.
Identical stack to the demo (web, api, postgres, redis, caddy) but a completely separate Coolify resource and Docker network. A bug on the demo cannot touch this tenant's data.
Jasper's personal life dashboard — the one app on this server that is for a single person. Scheduled jobs run every 15 minutes; the database is backed up at 02:50.
An app container plus its own db. Deploys are triggered by a webhook on push. Background jobs are fired by a host-side cron (jasper-os-cron.sh) rather than inside the container, so they survive redeploys.
Public voting platform for the 1st National Sickle Cell Awards 2026. Isolated on purpose: its own auth service, its own gateway, its own database. Ballots are counted in every nightly backup log.
Four containers: web, auth, an authgw that fronts the auth service, and db. Staff accounts, SMTP and secrets are managed by dedicated scripts on the host.
The first app ever deployed here and still the quickest health check: if hello answers, DNS, the firewall, Traefik, TLS and Coolify are all working.
Auto-deploys on every push to the private persmon-hello repository through the Coolify GitHub App. One container, no database.
Next.js storefront for Uganda Bookshop, currently in staging. Catalogue and cover images were imported on 21 Sep; the storefront goes public once the domain is pointed here.
A single Coolify application in its own project. Uses the self-hosted Supabase stack below for auth and data.
An order-management demo started directly with Docker from ~/oms-build, refreshed by a cron job every 10 minutes. The only application container Coolify does not manage.
Plain docker run — no Traefik labels, so it has no public hostname. Logs go to ~/oms-cron.log.
These services are not products — they are the machinery that builds, routes, stores and secures the products above.
Self-hosted platform-as-a-service. Think of it as a private Heroku: it connects to GitHub, builds images, runs containers, wires up domains and certificates, and shows logs and a terminal in the browser.
Six containers: coolify (the app), coolify-db (Postgres), coolify-redis (queues), coolify-realtime (websockets for live logs), coolify-sentinel (metrics) and coolify-proxy (Traefik). It talks to Docker through the local socket and to the host over SSH on 127.0.0.1.
The only container that listens on the internet. Watches Docker for labels, so a new app with a domain is routable within seconds. Requests and renews Let's Encrypt certificates automatically.
Managed by Coolify. Attached to every app's private network so it can reach each container by name. Redirects all HTTP to HTTPS. Certificates live in acme.json inside /data/coolify/proxy.
Postgres with batteries: instant REST API, authentication, file storage and a web studio. Used by newer projects such as Uganda Bookshop instead of writing a backend from scratch.
A trimmed nine-container stack: kong (API gateway) in front of auth, rest, storage, meta, realtime and studio, with db (Postgres) and minio (S3-compatible object store) behind them. Only Kong and Studio are exposed through Traefik.
A standalone Postgres server for apps that need a plain database without the Supabase layer. Reachable only from containers on its Docker network; never from the internet.
Coolify-managed database resource. Included in the 03:00 full backup; its data directory is a named Docker volume on the NVMe disk.
Each of these is a small self-hosted app that replaces a paid SaaS. All are Coolify resources with their own subdomain and password.
Visual workflow automation — the self-hosted alternative to Zapier. Connects webhooks, schedules, HTTP calls and the other services on this box.
Three containers: n8n (editor + API), postgresql (workflow store) and task-runners (executes code nodes in isolation).
Bitwarden-compatible password manager, stored on Persmon's own disk. Works with the official Bitwarden browser extensions and mobile apps.
One Rust container with an SQLite database; sign-ups are closed after the first account. Included in nightly backups.
A web file manager over ~/files. Upload, download and share files from a browser without SFTP.
One container with a bind mount to the host folder, so files are also visible in the shell.
Live, searchable logs for every container in one screen. The first place to look when something misbehaves.
Reads the Docker socket read-only; stores nothing.
Lightweight CPU, memory, disk and network graphs for the host and each container, with history. The lighter cousin of Grafana.
A beszel hub plus a beszel-agent that samples the host every few seconds.
Pings every public site every minute and pushes alerts to Telegram (@persmon_vps_alerts_bot) when one goes down or a certificate nears expiry. Backup scripts also send a heartbeat here, so a backup that silently stops running raises an alert.
One container with an SQLite database. Push monitors receive heartbeats from the nightly cron jobs.
| Time | Job | What it protects |
|---|---|---|
| 02:15 | mhf-backup | MHF Votes database + ballot count |
| 02:30 | hms-backup | Persmon HMS demo database |
| 02:45 | ishasha-backup | Ishasha Ops live database |
| 02:50 | jasper-os-backup | Jasper OS database |
| 03:00 | persmon-backup | Full archive: Coolify config, volumes, tool data, checksums · heartbeat to Uptime Kuma |
| 03:30 | hms-reseed | Resets the public HMS demo to clean sample data |
| nightly | PC pull | Off-site copy of ~/backups to Jasper's workstation |
Backups are kept in ~/backups with SHA-256 checksums. A restore drill script exists and has been exercised.
persmon; every action that needs root goes through sudo.~/.* files with mode 600 and in Coolify's encrypted store — never in repositories or this page.*.persmon.cloud name points at the same IPv4 address. The hostname is the only thing that distinguishes one app from another.Host header, and looks up which container declared that hostname in its Docker labels.| Path | Contents |
|---|---|
| /data/coolify | Coolify state, proxy config, certificates |
| /var/lib/docker | Images, volumes, container layers (~20 GB) |
| ~/backups | Nightly dumps + checksums + job logs |
| ~/*.sh | Backup, reseed and cron scripts (referenced by crontab — do not move) |
| ~/archive | Old script copies and audit snapshots (safe to delete after 30 days) |
| ~/transfers | Large one-off files moved to or from the VPS |
| ~/files | What FileBrowser serves |
Maintenance: 22 packages upgraded (Docker 29.8), Coolify updated, rebooted onto kernel 6.8.0-139, 1.8 GB of unused images pruned, home folder organised. Firewall rule for the proxy made reboot-proof. Jev trial connector removed. This page launched at persmon.cloud.
Uganda Bookshop staging imported (catalogue + covers).
Jasper OS deployed at me.persmon.cloud with webhook deploys and 15-minute jobs; backup scripts revised, Uptime Kuma push heartbeats added for every job.
MHF Votes stack deployed in isolation for the National Sickle Cell Awards 2026.
Build phase closed; operations runbook adopted. Reboots only in chosen windows.
Postgres 17, trimmed Supabase, backups with off-site pull, Uptime Kuma + Telegram, and the utilities toolbox (n8n, Vaultwarden, FileBrowser, Dozzle, Beszel) all brought up in one long day.
VPS provisioned, hardened, Coolify installed, first app (hello) auto-deploying from GitHub.