Skip to content

Add a DigitalOcean Server

Appliku can provision DigitalOcean droplets on your behalf using the DigitalOcean API. The droplet is created in your DigitalOcean account, and you pay DigitalOcean directly for the infrastructure.

Step 1: Create a DigitalOcean API Token

Before adding a server, you need to provide Appliku with a DigitalOcean API token.

  1. Go to the DigitalOcean API Tokens page
  2. Give the token a descriptive name (e.g., "Appliku")
  3. Set the Scopes to Full Access (Appliku needs write access to create and manage droplets and their firewalls). With Custom Scopes, see Token scopes below.
  4. Set the Expiration to Never or 1 Year (shorter expirations will require you to update the token in Appliku when it expires)
  5. Click Generate Token
  6. Copy the token immediately -- it will only be shown once

Step 2: Add the Token to Appliku

  1. Open the Appliku dashboard
  2. Go to Team Settings (click on your team name in the sidebar, then Settings)
  3. Find the DigitalOcean section
  4. Paste your API token and save

Step 3: Create a Droplet

  1. Navigate to the Servers tab in your team dashboard
  2. Click Add Server
  3. Select DigitalOcean as the provider
  4. Choose a region closest to your users for lower latency
  5. Select a droplet size

Minimum recommended size

Choose a droplet with at least 1 GB of RAM. Smaller droplets may run out of memory during Docker image builds, especially for JavaScript/TypeScript projects.

  1. Click Create Droplet

Step 4: Wait for Setup

Appliku will create the droplet and automatically begin the server setup process. This takes a few minutes. The droplet is provisioned with Ubuntu 26.04 when DigitalOcean offers it, otherwise Appliku falls back to Ubuntu 24.04.

You can monitor the progress on the server detail page. Once setup is complete, the server status will change to Active and you can start deploying applications to it.

Firewall

Each droplet has a firewall mode. See Firewall for the Firewall tab.

  • Managed (new droplets): the droplet has its own DigitalOcean cloud firewall, appliku-<environment>-server-<id>, with these rules:
  • HTTP (80) and HTTPS (443) from all IPv4 and IPv6 addresses;
  • SSH from the Appliku servers and from the IP addresses that you add on the Firewall tab;
  • the ports that Appliku publishes for your databases (external connections on) and apps (expose_web_port, ports in appliku.yml), from all addresses until you add a rule for that port;
  • your rules;
  • in a cluster, the Docker Swarm ports from the other nodes only;
  • all outgoing traffic (apt, Docker pulls, git).

All other incoming ports are closed. The firewall exists before the droplet: Appliku creates it first and creates the droplet with the tag appliku-<environment>-server-<id>, so that DigitalOcean applies the firewall to the droplet when it starts. (DigitalOcean does not document the exact moment at first boot; SSH accepts only keys in any case.) Then Appliku applies the firewall to the droplet directly and removes the tag from the firewall. - Legacy (droplets created before the managed firewall): no cloud firewall, all ports are open to the internet (unless you attached your own firewall). Nothing changes until you switch the droplet on the Firewall tab. You can switch back at any time.

A port that Appliku publishes for your database or app is open to all addresses. Add a rule for that port on the Firewall tab, and only your sources can connect. Add your IP first ("Add my IP") before you switch, if you use SSH.

Appliku owns all rules in its firewall. For other rules, attach your own cloud firewall to the droplet. Appliku never changes firewalls that it does not own. When you delete a droplet, Appliku deletes its firewall some time later.

Private network

A DigitalOcean cloud firewall also filters the private (VPC) network. If another droplet connects to this droplet over its private IP address (for example to a database), add a rule for that address or network on the Firewall tab before you switch. The preview cannot see such connections.

Token scopes

A full-access token works. A token with custom scopes needs these scopes for the managed firewall: firewall:create, firewall:read, firewall:update, firewall:delete, tag:create, tag:read, droplet:read (in addition to the scopes that create droplets).

If the token cannot read firewalls, the create-droplet form and the token form show "The DigitalOcean token cannot manage firewalls". A token that can read but not change firewalls fails when you create a droplet: the creation stops with that message in the server log, and no droplet is created. On an existing droplet, the Firewall tab shows the status "failed: the DigitalOcean token cannot manage firewalls (scope)".

Managing the Droplet

The droplet is fully owned by your DigitalOcean account. You can see it in the DigitalOcean dashboard alongside your other resources. However, you should manage it through Appliku to keep configurations in sync.

If you delete the droplet directly in DigitalOcean, Appliku will detect this automatically via the API and mark the server as deleted. See Server Settings for more details.