An app, a proxy, one readable Compose file.

STEP 01Check the prerequisites

Use a supported Ubuntu LTS, SSH access, a domain and an app with a tested Dockerfile listening on 0.0.0.0:3000 inside the container. Install Docker Engine and the Compose plugin using Docker’s official Ubuntu instructions. Membership in the docker group grants root-equivalent access; use the access model appropriate for your server.

docker --version
docker compose version

STEP 02Describe the two services

Create compose.yaml in the app directory. The app exposes port 3000 only to the Compose network. Only Caddy publishes ports 80 and 443. This example assumes these host ports are free; on an existing server, integrate with its existing proxy instead.

services:
  app:
    build: .
    restart: unless-stopped
    environment:
      NODE_ENV: production
    expose:
      - "3000"
  proxy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
volumes:
  caddy_data:
  caddy_config:

STEP 03Configure the real hostname

Create Caddyfile alongside compose.yaml. Replace app.example.com with your domain and point DNS to this VPS. The caddy_data volume keeps certificate material across container restarts. Do not delete it during updates.

app.example.com {
  reverse_proxy app:3000
}

Make sure inbound HTTP/HTTPS reaches the proxy. Preserve SSH access when changing any firewall. Docker published ports can bypass UFW rules.

STEP 04Build, launch and inspect

Validate before starting. An app should listen on 0.0.0.0 inside its container; 127.0.0.1 would make it unreachable from the proxy container. A failed image build should be fixed before replacing a working release.

docker compose config --quiet
docker compose up -d --build
docker compose ps
docker compose logs --tail=50 app proxy

STEP 05Verify data and recovery

Open the real HTTPS URL from outside the server. A successful response proves routing, not all application behavior. Test authentication and important writes. Persist uploads outside the image and back them up. Plan a known-good image rollback and a database-compatible restore procedure.