Table of Contents

Coolify SSH Key Setup

Status: Resolved
Date: 2026-05 (initial setup)
Affects: Coolify

Full incident summary. Each root cause has its own atomic page.

Root Causes (atomic pages)

  1. Private keys must be added via Coolify UI, not directly to database
  2. Correct host IP is the Docker network gateway (172.18.0.1), not LAN IP
  3. Coolify requires root SSH access — PermitRootLogin prohibit-password
  4. fail2ban bans the Coolify container IP after repeated failures

Quick Fix Sequence

1. Generate fresh SSH key: 

sudo ssh-keygen -t ed25519 -a 100 -f /data/coolify/ssh/keys/id_coolify -q -N '' -C 'root@coolify'

2. Add to authorized_keys (both user and root): 

echo "<pubkey>" >> ~/.ssh/authorized_keys
sudo sh -c 'echo "<pubkey>" >> /root/.ssh/authorized_keys'

3. Allow root SSH: 

sudo sed -i 's/^PermitRootLogin no/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sudo systemctl restart sshd

4. Set correct IP in database: 

docker exec coolify-db psql -U coolify -d coolify \
  -c "UPDATE servers SET ip = '172.18.0.1', \"user\" = 'root' WHERE name = 'localhost';"

5. Add private key through Coolify UI: Settings → Private Keys → Add Private Key.

6. Unban container IP if needed: 

sudo fail2ban-client set sshd unbanip <container-ip>

7. Verify: 

docker exec coolify ssh -o StrictHostKeyChecking=no \
  -i /var/www/html/storage/app/ssh/keys/id_coolify root@172.18.0.1 'echo success'

See Also