Self-Hosting a Business Stack with Dokploy, Traefik, CrowdSec

Small and mid-sized businesses often utilize a variety of separate tools for accounting, customer management, sales, and messaging. This can lead to data duplication and process breakdowns between systems. A more streamlined solution is to deploy a unified stack on the business's own infrastructure. This article outlines the deployment and security setup used by Greatzern Software Solutions to run business systems on a single virtual private server (VPS).

The typical client stack includes an enterprise resource planning (ERP) system, an e-commerce platform, WhatsApp and email automation, online scheduling and booking, and a newsletter and email marketing tool. Each application operates as its own container with its own subdomain.

Traffic enters the server through four layers. Cloudflare, positioned at the edge, manages DNS, caching, and basic filtering. A Cloudflared tunnel transfers traffic to the server, eliminating the need for the VPS to expose its web ports directly to the internet. CrowdSec monitors behavior and blocks malicious IP addresses. Traefik routes each request to the appropriate container, while Dokploy manages the containers, domains, and deployments on top of this architecture.

Dokploy provides a deployment dashboard on the business's server. By connecting a repository or Docker image, setting environment variables, attaching a domain, and deploying, the process becomes simplified. Traefik is automatically configured, reducing the manual routing effort. For businesses that wish to maintain control over their infrastructure, this means a single server, a single dashboard, and no per-application hosting fees.

When services require communication, such as an automation tool calling a database, containers must share a network. In Dokploy, this network is named "dokploy-network." If a service does not explicitly declare this network, it cannot resolve other containers by name, resulting in DNS resolution failures despite both containers being operational. To resolve this issue, the network must be declared explicitly in the compose file:

services:

app:

image: your-image:latest

networks:

- dokploy-network

networks:

dokploy-network:

external: true

After making these adjustments, containers can communicate with each other using service names. Additionally, CrowdSec adds a layer of behavioral protection. By analyzing logs and identifying patterns such as brute force attempts and scanners, CrowdSec blocks the corresponding IP addresses through a bouncer. With Traefik in front of the applications, the CrowdSec bouncer sits in the request path, rejecting flagged IPs before they reach the applications.

This dual-layer protection, along with Cloudflare at the edge, provides robust security without incurring the cost of a managed security product.

To maintain strong security practices, web ports should remain closed on the VPS and traffic should be routed through the tunnel. Each application should be assigned its own subdomain, and strong, unique credentials should be used and regularly rotated. Databases and volumes should be backed up on a schedule, with regular restoration tests. The host and container images should always be kept up to date, and CrowdSec decisions should be monitored regularly.

This setup is ideal for businesses seeking an integrated system, data control, and predictable costs. However, properly building and maintaining such a system can be time-consuming, often requiring a dedicated team. Greatzern Software Solutions configures, deploys, and supports these systems on the business's own infrastructure, ensuring optimal performance and security.