Fix WebSocket / Realtime Not Connecting on Coolify

Error: WebSocket connection to 'wss://<your-domain>:6001/app/...' failed (UI shows "WARNING: Cannot connect to real-time service")

Coolify's live UI updates and the in-browser terminal don't work because the browser's secure WebSocket (wss://) can't reach Coolify's realtime service.

Coolify runs a realtime service (Soketi/Pusher protocol) on port 6001 and the terminal server on port 6002. The browser connects to these over WebSocket. When you access the dashboard over HTTPS but Coolify's instance settings still describe the instance as http (so APP_URL / PUSHER_SCHEME = http and PUSHER_PORT = 6001), the browser tries wss://<domain>:6001 and the handshake fails on a protocol/port mismatch. The correct path is for Coolify's reverse proxy (Traefik or Caddy) to terminate TLS on 443 and proxy the WSS traffic, NOT to expose 6001/6002 directly. Coolify's docs explicitly say that once you reach the dashboard via a custom domain through the built-in proxy you can CLOSE 6001/6002 rather than open them.

The fix

1. Confirm the realtime container is running.

   docker ps --format 'table {{.Names}}\t{{.Status}}' | grep coolify-realtime

2. Set the instance to HTTPS the Coolify-native way (do not hand-edit env first). In the dashboard go to Settings > Instance/Configuration and set the Instance Domain (FQDN) to its https:// URL with no custom port, then save. This regenerates APP_URL and the PUSHER_* values so the browser connects via wss://<your-domain> over 443 through the proxy.

3. If you must edit the env directly (advanced), in /data/coolify/source/.env set PUSHER_SCHEME=https, set PUSHER_HOST to your domain, and leave PUSHER_PORT empty so the client uses wss://<your-domain> on 443 instead of :6001. Re-deploying/upgrading Coolify can overwrite hand edits, which is why the UI setting is preferred.

4. Restart Coolify so the change is picked up.

   docker restart coolify coolify-realtime

5. Make sure the reverse proxy (Traefik/Caddy) is up and serving 443, and that ports 80 and 443 are open in the firewall. Do NOT permanently open 6001/6002 to the public internet for an HTTPS/custom-domain setup; the proxy carries the WSS traffic. (Only open 6001/6002 temporarily if you access Coolify by raw IP:8000 with no proxy/domain.)

6. If you front Coolify with your own external reverse proxy or a Cloudflare Tunnel, route the app path to 6001 and the terminal WebSocket path to 6002 with WebSocket upgrade enabled, and force IPv4 (127.0.0.1) for the 6001 upstream — Soketi binds IPv4-only, so an upstream resolving to ::1 fails (issue #8584).

7. Hard-refresh the dashboard to drop the stale WebSocket attempt and reopen the page.

Verify it worked

The dashboard shows live status updates without a manual refresh and the in-browser Terminal connects. In browser DevTools > Network > WS the connection to wss://<your-domain> shows 101 Switching Protocols instead of failed.

docker logs coolify-realtime --tail 20

Related Coolify errors

• www.domain.com cert error but apex works
• Build-time error: process.env.NEXT_PUBLIC_* / VITE_* / API URL is undefined during build — values set in Coolify are empty in the built bundle (e.g. ReferenceError or fetch to "undefined")
• NET::ERR_CERT_AUTHORITY_INVALID
• TRAEFIK DEFAULT CERT / self-signed certificate

Have Emsden Studio fix it for you — from A$149

All Coolify deploy errors