Trigger v4 (4.0.0) on Coolify v4 with Traefik — Split Webapp & Worker

This README explains how to deploy Trigger v4 using Coolify v4 with Traefik, separating the Webapp and the Worker/Supervisor. It also considers an existing External Docker Registry.

Tested with the official trigger.dev@4.0.0 Docker Compose template as base and adapted for Coolify (without ports: and leveraging Magic Env Vars like SERVICE_FQDN_* and SERVICE_PASSWORD_*).

---

🧱 Prerequisites

• Coolify v4 with Traefik active.
• Server (Webapp) and (Worker) added in Coolify and Healthy.
• DNS pointing to the Webapp server (for the Webapp domain).
• External Docker Registry operational, with credentials.
• (Optional) Wildcard domain in Coolify for automatic FQDNs.

---

🚀 Architecture Overview

• Webapp: exposed to Internet via Coolify's Traefik. Manages UI, API, worker group tokens, etc.
• Worker (Supervisor): not publicly exposed. Connects outbound to the Webapp via HTTPS (TRIGGER_API_URL) and executes workloads in ephemeral containers via Docker.
• Webapp internal services: Postgres, Redis, ElectricSQL (Realtime), ClickHouse (metrics), MinIO (object storage) — same as in the official Compose.

---

🧩 Quick Steps

1. Create "Docker Compose (Raw)" resource in Coolify for the Webapp, paste the webapp YAML below.
2. In the webapp resource Environment:
   • Generate secrets with Magic Vars (SERVICE_PASSWORD_*) or paste your own values.
   • Fill in External Registry credentials (DEPLOY_REGISTRY_*) if you'll use deploys from the Webapp.
3. Deploy Webapp and configure the domain generated by SERVICE_FQDN_WEBAPP_3000 as APP_ORIGIN/LOGIN_ORIGIN/API_ORIGIN (already in the YAML).
4. In the Webapp log, check for the TRIGGER_WORKER_TOKEN (shown once). Copy the token.
5. Create a Docker Compose (Raw) resource for the Worker, paste the worker YAML below and set in Environment:
   • TRIGGER_API_URL=https://your-webapp-domain
   • OTEL_EXPORTER_OTLP_ENDPOINT=https://your-webapp-domain/otel
   • TRIGGER_WORKER_TOKEN=<copied-token>
   • MANAGED_WORKER_SECRET=<same as in Webapp>
6. Deploy Worker. Verify in the Webapp that the worker appears as online.

---

🔐 Secrets with Magic Env Vars (Coolify)

• Use SERVICE_PASSWORD_SESSION, SERVICE_PASSWORD_MAGIC, SERVICE_PASSWORD_ENCRYPTION, SERVICE_PASSWORD_MANAGEDWORKER, SERVICE_PASSWORD_POSTGRES, SERVICE_PASSWORD_MINIO, SERVICE_PASSWORD_64_CLICKHOUSE, etc.
• Coolify generates them once per resource and maintains the same value between deployments (useful so sessions/tokens don't get invalidated accidentally).
• You can substitute them with your own values if you prefer.

---

🧪 Quick Checks

• Webapp: open https://<your-FQDN> → create initial account → check the log for the magic email link.
• Logs: if Worker doesn't connect, check TRIGGER_API_URL, OTEL_EXPORTER_OTLP_ENDPOINT, TRIGGER_WORKER_TOKEN and that the server has Internet access.

---

🐞 Troubleshooting

• Worker doesn't appear online:
  • Check TRIGGER_WORKER_TOKEN (no spaces or line breaks).
  • Verify TRIGGER_API_URL and OTEL_EXPORTER_OTLP_ENDPOINT (valid HTTPS).
  • Ensure Internet access from the Worker server.
• Build/pull errors for run images:
  • Configure DOCKER_REGISTRY_* in Worker and do docker login if using private images.
• Email login links:
  • If you don't configure provider (EMAIL_TRANSPORT), magic links stay in Webapp logs.
• Changed SESSION_SECRET:
  • Existing sessions will be invalidated. Avoid in production.
• CORS/origins:
  • Always use the same domain in APP_ORIGIN/LOGIN_ORIGIN/API_ORIGIN (in this README they're derived from SERVICE_FQDN_WEBAPP_3000).

---

📎 Notes

• This README assumes split setup: that's why there's no shared:/home/node/shared volume nor user: root/chown, nor TRIGGER_WORKER_TOKEN=file://....
• If you ever run everything on the same host, you can restore the shared and "bootstrap" (TRIGGER_BOOTSTRAP_ENABLED=1) so the token gets deposited in a file.

---

Ready! Copy/paste the YAMLs in Coolify and fill in the minimum variables. If you want, also add a version without ClickHouse/MinIO pointing to external services.