2026-10-18
Two Umami first-boot checks I nearly missed on Coolify
A working analytics URL was only the start. I still had to close the default login and finish the domain setup.
I brought up a self-hosted Umami instance through Coolify and got a live panel. That 200 response did not mean setup was finished. The factory admin login was still accepted on the public panel. I checked it, rotated the password in the same session, then verified that the old login was refused and the new one worked.
Rotate the factory login before calling it live
On first boot, treat the bundled admin credential as exposed. Set a unique password before pointing people at the panel. Then test both sides of the change: the factory login must fail and the replacement must succeed. In my case the old login had still been valid after the domain was public. I caught it in a direct authentication check, not by looking at the homepage.
A service domain was a separate Coolify problem
At the time I deployed it, the Coolify API path I used had no field that set the domain on a service application. I wrote the domain directly into Coolify's database, with a rollback script written first. That was a controlled workaround for that installation, not a general instruction to edit Coolify's tables. I am leaving out the row, SQL, host and file locations because none help someone verify their own setup.
The final check is practical: open the intended public domain, confirm the certificate and response, and try the old admin login once more. A running container and a reachable URL do not answer the credential question.
Topics
More notes
- A fresh DNS record existed, but my Mac still said the domain did not
- Put a feature branch on an existing Coolify URL, then put it back
- Check the offsite copy of a Coolify compose database backup
- Choosing a VPS in Australia for self-hosting
- Point your app at a Coolify Postgres by container name, not IP
- A launchd job that dies with no code change
- Coolify quietly bakes your build secrets into the image layers
- A full VPS disk on Coolify: 1905 MB per rebuild, down to 31 MB
- The Next.js standalone healthcheck trap on Coolify
- serve -s makes every URL on a multi-page site come back 200