VPS Self-Hosting Setup

A layered approach to running Docker Compose apps on a single Hetzner VPS. Traefik handles routing and TLS, a PLG stack covers observability, and each app is an isolated Compose project with its own backup sidecar.

Server

Docker Networks

# Shared external networks
traefik-public   # Traefik discovers containers on this network
monitoring       # Prometheus, Loki, Promtail, cAdvisor

# Per-app (internal only)
default          # DB ↔ app service; never touches traefik-public

Backup pattern

Each app runs offen/docker-volume-backup on a staggered cron. PostgreSQL gets a pg_dump pre-hook before the volume snapshot. All backups ship to Backblaze B2. Errors trigger notifications via Shoutrrr / ntfy.

Setup Review

Git Push Deployments

Three options that complement each other — they cover different deployment scenarios and can all run simultaneously.

Webhook + Traefik

webhook runs as a systemd service on the host — not in a container. It binds to the Docker bridge gateway interface (172.17.0.1), which is reachable from inside Traefik's container but completely invisible to the public internet.

Request flow

Why this beats a container for webhook

Running webhook on the host means deploy scripts run as your user with full access to app directories. No Docker socket exposure inside a container. No volume-mount gymnastics to reach the compose files. systemd keeps it alive and restarts it on failure.

Firewall layers

Systemd unit

# /etc/systemd/system/webhook.service
[Unit]
Description=Webhook deployment server
After=network.target

[Service]
User=youruser
ExecStart=/usr/local/bin/webhook \
  -hooks /etc/webhook/hooks.json \
  -ip 172.17.0.1 \
  -port 9000
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.targetsystemd

Traefik file provider route

# core/traefik/config/conf.d/webhook.yml
http:
  routers:
    webhook:
      rule: "Host(`hooks.yourdomain.com`)"
      entrypoints: websecure
      tls:
        certResolver: letsencrypt
      service: webhook
  services:
    webhook:
      loadBalancer:
        servers:
          - url: "http://172.17.0.1:9000"yaml

Enable the file provider in traefik.yml alongside the existing Docker provider:

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik-public
  file:                    # add this block
    directory: /etc/traefik/conf.d
    watch: trueyaml

Mount the new directory in Traefik's Compose service:

volumes:
  - ./config/traefik.yml:/etc/traefik/traefik.yml:ro
  - ./config/conf.d:/etc/traefik/conf.d:ro   # add
  - ./acme:/acmeyaml

Hook definition

[
  {
    "id": "deploy-myapp",
    "execute-command": "/apps/myapp/deploy.sh",
    "command-working-directory": "/apps/myapp",
    "trigger-rule": {
      "match": {
        "type": "payload-hmac-sha256",
        "secret": "your-webhook-secret",
        "parameter": {
          "source": "header",
          "name": "X-Hub-Signature-256"
        }
      }
    }
  }
]json

Deploy script

#!/bin/bash
set -euo pipefail
cd /apps/myapp
docker compose pull
docker compose up -d --remove-orphansbash

Secrets Management

A realistic look at the options. The right choice depends on what problem you're actually solving — and for a single-operator setup, that's often different from what the tooling is marketed toward.

Honest threat model

What does each approach actually protect against?