Daniel Kam
Menu

19 October 2026

Connect a private GitHub repository to Coolify with a deploy key

Give one private repository a read-only Coolify deploy key, then check a real fetch instead of relying on a repository listing.

VPS deployment and maintenanceCoolify
Connect a private GitHub repository to Coolify with a deploy key

Give Coolify a read-only deploy key for one private GitHub repository. This lets it fetch the app source without receiving your personal GitHub token or write access to the repository.

Watch the original video

Part 5: Connect a private GitHub repository to Coolify with a deploy key

Video draft: Setup explanation with recorded Coolify source checks. Repository and deploy-key creation took place before the recording. Audio, captions and editing should receive a full review before publication.

Create and review the repository

  1. Sign in to GitHub and complete account security setup privately.
  2. Create a new repository named hetzner-coolify-tutorial and select Private.
  3. Add the demo files from the Compose lesson at the repository root. Keep site/index.html inside its folder.
  4. Include a .gitignore that excludes real .env files while allowing the sanitised .env.example.
  5. Review the exact file list for private keys, tokens, recordings, credentials, and unrelated business content. Commit the source and record its full commit SHA.

If you use Git locally, initialise a new dedicated directory, not a shared workspace containing unrelated projects. Verify the remote before pushing:

git remote -v
git status --short
git diff --cached --check
git log -1 --format=%H

For a new, empty GitHub repository, use this local sequence after saving the reviewed demo files in a new folder. Leave GitHub’s initial README and licence options empty for this route so there is no separate remote history to reconcile. Git must be installed, and your GitHub credential helper or CLI must already be authenticated for this account. For example, gh auth login uses GitHub CLI’s supported login flow when that tool is installed. Never place a token in the remote URL.

# Run inside your new demo folder, not a shared workspace.
git init -b main
git add .gitignore .dockerignore Dockerfile nginx.conf compose.yaml site/index.html
git diff --cached --check
git diff --cached --stat
git diff --cached
git commit -m "Add static Coolify tutorial app"
git remote add origin https://github.com/YOUR_ACCOUNT/hetzner-coolify-tutorial.git
git remote -v
git push -u origin main
git log -1 --format=%H

Replace YOUR_ACCOUNT with the repository owner. Stop before the commit if the staged diff includes anything outside that explicit file list. Confirm the resulting GitHub repository is still private and that its main commit matches the local full SHA. The optional local Compose override and safe example environment file can be added in a separate reviewed commit when you need them.

Create a repository-specific key

Use the installed Coolify interface’s private-repository/deploy-key route. When it can generate the dedicated key pair, retain the private half within Coolify’s protected credential store and copy only the public half to GitHub. If generating outside Coolify, use a protected temporary directory on the server and transfer the private half directly into Coolify’s key credential field privately. Do not use the laptop key or paste private material into a prompt.

  1. Open the intended GitHub repository, then Settings → Deploy keys → Add deploy key.
  2. Name the key so you can identify the tutorial integration later.
  3. Paste the dedicated public key. Leave Allow write access unchecked.
  4. Save and confirm the key belongs to this repository and is read-only.
  5. In Coolify, add a private repository resource using the corresponding private-key credential and the repository SSH URL, such as [email protected]:YOUR_ACCOUNT/hetzner-coolify-tutorial.git.
  6. Select the intended branch and revision. Verify the source can actually be fetched, not merely that the repository name appears in a picker.

GitHub: Managing deploy keys explains the repository-specific scope and limitations of deploy keys. A GitHub App is another supported integration route and can be limited to selected repositories. Choose one route deliberately; do not assume a deploy-key setup also creates automatic GitHub webhooks.

Check the result and diagnose errors

A clone authentication error calls for checking the SSH URL, repository owner/name, paired public/private key, and selected Coolify credential. Do not broaden to a personal account token as the first fix. A successful clone still does not prove that the application builds, the right commit is deployed, or GitHub events can reach Coolify.

The tutorial verified a private repository with an enabled read-only deploy key and a real Coolify build of its selected commit. It used manual deployment, without a webhook. The sample filming repository remains private, so readers should create their own from the files in the next lesson.

Before leaving this step, record the repository URL, branch, intended full SHA, and the non-secret deploy-key title. Keep the private key and passwords out of those notes.

Return to the Hetzner and Coolify series

When the checks in this lesson pass, continue with part 6.

More writing