> laddzilla/log
← all entries

Building the laddzilla.com platform

infrastructureself-hostingcoolifyhetzner
Live app →

This is entry #1 — and fittingly, it’s about the thing running everything else. I wanted one place to deploy and test the apps I build, reach them from anywhere, and keep a public log of what I’m working on. Here’s how the platform came together.

The stack

The whole thing runs on a single small Linux box, with a handful of pieces doing the heavy lifting:

  • Hetzner Cloud — the VPS itself. A CPX21 (3 vCPU / 4 GB RAM) in a US region, which is plenty to run a self-hosted platform plus several small apps.
  • Coolify — a self-hosted, Heroku-style dashboard. I push code and it builds, deploys, wires up a reverse proxy, and issues HTTPS. Full terminal access to the box stays mine.
  • Cloudflare — DNS for the domain, plus a wildcard record so every subdomain points at the server automatically.
  • Tailscale — a private network so half-built apps are reachable from my laptop and phone without ever being exposed to the public internet.

What it does

The payoff is that adding a new app is almost no work. I deploy in Coolify, pick a subdomain like todo.laddzilla.com, and it’s live with a valid certificate a moment later — no DNS edits, no manual nginx configs, no Let’s Encrypt dance. The wildcard DNS record (*.laddzilla.com → the server) means the subdomain just works the instant the app is up.

Public apps go through Coolify’s proxy; anything I want kept private lives behind Tailscale instead. And this log site — the one you’re reading — sits out front on its own, deliberately separate from the experiment box so a broken deploy can never take down the page other people actually see.

Things that bit me

A couple of snags worth remembering:

  • Line endings. A setup script picked up Windows carriage returns and bash choked on set -euo pipefail with a cryptic “invalid option name”. A quick sed -i 's/\r$//' script.sh fixed it. Lesson: edit scripts on the server, not through a Windows editor.
  • Hardening vs. automation. I locked SSH down with PermitRootLogin no, then Coolify couldn’t manage its own host — it connects as root over SSH. The fix was PermitRootLogin prohibit-password: root can log in by key only, never by password, which keeps the box secure and lets Coolify do its job.

What’s next

Now that the platform is up, the plan is to actually build on it — each new project gets deployed here and gets an entry in this log. If you’re reading this, the pipeline works.