Coxios

Documentation

Everything you need to run your VPS

From installing the app to your first deployment, every screen explained in plain words. No command to type.

Install Coxios

Coxios is a desktop app. Download it with the Download button on the site, open the .dmg file and drag Coxios into your Applications folder.

The macOS build (Universal, Apple silicon and Intel) is available today. Windows and Linux builds are on their way: the download button tells you for your system.

The app is signed and notarized by Apple, so macOS opens it without a warning. It then updates itself, and a banner lets you know when a new version is ready.

Create your account and connect the app

Your Coxios account links your subscription to the app. You create it on the website, with an email or with Google.

In the app, sign-in opens in your browser: you sign in on coxios.com, then come back to the app, already signed in. No password is ever typed into the app, and the session survives restarts.

Without signing in, the app runs on the free plan (1 server).

Add a server

Click Add a server. Coxios first asks whether your VPS is brand new or one you already use.

  1. 1

    Brand new VPS

    You just bought it and received an email with an IP address, the root user and a password. Enter them as they are: Coxios connects, then the Setup Assistant secures everything.

  2. 2

    Already configured VPS

    You already have a dedicated user and an SSH key. Coxios looks for your shortcuts in ~/.ssh/config and offers to import them in one click. Nothing changes on the server without your confirmation.

  3. 3

    Password or SSH key

    You pick how to connect. If your key is protected by a passphrase, Coxios can keep it in your system keychain.

  4. 4

    Server fingerprint

    On the first connection, Coxios records the server's SSH fingerprint in its own file (it does not touch your ~/.ssh/known_hosts). If it ever changes without you reinstalling the VPS, the app warns you instead of connecting.

The Setup Assistant

On a fresh VPS, the assistant applies security best practices step by step. Each step first checks what is already in place, and you see the commands it sends.

  • Deployment structure

    Prepares the folders where your applications will live.

  • Non-root user

    Creates your user with sudo rights and installs your SSH key.

  • SSH hardening

    Disables root login and password authentication.

  • Firewall

    Turns on UFW (or firewalld on Rocky, Alma, RHEL) and opens only the ports you chose.

  • Kernel hardening

    Sets safe network parameters (sysctl) against IP spoofing and SYN floods.

  • Fail2ban

    Blocks addresses that try passwords in a loop.

  • Docker and Compose

    Installs Docker Engine and Docker Compose for your apps.

  • Reverse proxy

    Installs Caddy, which handles HTTPS on its own, or keeps the proxy already there (Nginx, Traefik).

  • Automatic updates

    Turns on automatic security updates for the system.

Day-to-day security

A server's Security tab continuously reads what protects it: fail2ban and its blocks, the firewall, the SSH configuration, HTTPS certificates and open ports. A color code shows what needs your attention.

Two deeper scans run on demand, read only:

  • Lynis: about 250 configuration checks, plus a hardening index out of 100 with numbered suggestions.
  • Trivy: compares your deployed Docker images against the public database of known flaws.

Docker applications

The Applications tab deploys your apps in Docker containers, in two ways:

  • Catalog: ready-to-use services in one click (WordPress, Vaultwarden, Plausible, n8n, Nextcloud, Invoice Ninja, Supabase…) with guided configuration.
  • Git repository: Coxios clones your repo directly on the VPS (GitHub, GitLab, Bitbucket or self-hosted) and builds it with its Dockerfile or docker-compose.yml.
  • Git credentials are saved once in Git sources: access token (kept in the keychain), SSH deploy key, or GitHub App.
  • Auto-deploy redeploys the app on every push to the chosen branch, through a signed webhook.
  • Each app's environment variables are edited from the app, without opening the .env file.

Domains and HTTPS

To link a domain to an app, create an A record pointing to the server's IP at your registrar (OVH, Gandi, Cloudflare, Namecheap…). Coxios checks the DNS for you and tells you when it has propagated.

With Caddy, the Let's Encrypt HTTPS certificate is obtained and renewed automatically, in about thirty seconds. With Nginx, the binding is HTTP only for now.

Monitoring and logs

The Monitoring tab shows CPU, memory, disk, swap, load, network, services and the hungriest processes. Set alert thresholds and the app notifies you when they are crossed.

The Logs tab streams the logs of a container, a service or a system file live, with filtering, pause and auto-scroll.

Server users

The Users tab manages the VPS's system accounts: create a user, grant or remove administrator rights, add their public SSH key or generate one, set a fallback password, lock or delete them.

Coxios explains which groups effectively grant full powers (such as docker), and writes sudo rules to a separate file validated by visudo: it never touches /etc/sudoers.

Lock the app

In settings, you can require Touch ID or a code to open Coxios, after a period of inactivity, and before irreversible actions (deleting a server, an app with its data, a user).

Subscription

The free plan manages 1 server. Pro manages 5 and Business 50 (beyond that, you declare your number of servers, up to 200). Prices are on the Pricing page.

You subscribe and manage your subscription from your account. The subscription belongs to your organization: the app picks it up as soon as you sign in.

Troubleshooting

The app asks for my sudo password

Your user needs a password for sudo. Coxios uses it for administration actions without storing it in plain text. A banner offers to make these rights permanent if you want.

The server shows as unreachable

Run the Full diagnostic from the server page. The usual causes: the VPS is off, the SSH port changed, or your IP was blocked by fail2ban after several attempts. In that case, wait for the block to expire or lift it from your provider's console.

The Terminal button asks for a password

After hardening, only your SSH key can log in. Check that the ~/.ssh/coxios-… key still exists on your computer.

My domain does not answer over HTTPS

Check that the A record points to the server's IP (Coxios tests it), then give propagation a few minutes. If Caddy does not start, another program probably holds port 80 or 443.

An exposed container is reachable despite the firewall

That is how Docker works: a port published with -p bypasses UFW. Link the app to a domain instead, so it sits behind the reverse proxy over HTTPS.