🚀 How to Deploy Wallos on Ubuntu VPS

This article provides a guide demonstrating how to deploy Wallos on Ubuntu VPS with Docker Compose.

What Is Wallos?

Wallos is a free, open-source, self-hosted subscription management application that helps individuals and businesses track recurring expenses, monitor upcoming payments, and manage subscriptions from a centralized dashboard.

Unlike cloud-based subscription tracking services, Wallos can be installed on your own server, giving you greater control over your financial information and application data.

Key Features

• Subscription Tracking: Manage recurring expenses such as web hosting, VPS servers, domain registrations, software licenses, SaaS platforms, streaming services, and memberships.
• Payment Reminders: Receive notifications about upcoming renewals and recurring payments.
• Expense Analytics: Visualize monthly and annual subscription spending using charts and dashboards.
• Multiple Currencies: Track subscriptions billed in different currencies.
• Custom Categories: Organize subscriptions into categories such as Hosting, Infrastructure, Software, Business Services, and Entertainment.
• Payment Methods: Associate subscriptions with payment methods for easier expense management.
• Multiuser Support: Manage subscriptions for multiple users.
• Self-Hosted Privacy: Store your subscription information on infrastructure you control.

Technical Requirements

Wallos is designed to be lightweight and relatively easy to deploy.

Who Should Use Wallos?

Wallos is particularly useful for individuals and organizations managing numerous recurring expenses.

In short, Wallos provides a private, centralized way to answer three important questions: What am I paying for, how much am I spending, and when is my next payment due?

This guide deploys Wallos as a production-ready, self-hosted application on an Ubuntu VPS, with secure HTTPS access, persistent SQLite storage, scheduled backups, and a controlled update process.

The installation follows Wallos’s official Docker deployment structure, with additional hardening for an Internet-facing VPS.

Deploy Wallos on Ubuntu VPS with Docker Compose

To deploy Wallos on Ubuntu VPS with Docker Compose, follow the steps outlined below:

1. Deployment architecture

   Deployment settings

   Component	Configuration
   OS	Ubuntu Server 22.04 or 24.04
   Application	Wallos
   Docker image	bellamy/wallos:latest
   Public access	HTTPS port 443
   Internal service	127.0.0.1:8282
   Reverse proxy	Host-installed Nginx
   SSL	Let’s Encrypt / Certbot
   Database	SQLite
   Application directory	/opt/wallos
   Backup directory	/var/backups/wallos
   Timezone	America/Chicago

   For a dedicated small VPS, 1–2 vCPUs, 2 GB RAM, and approximately 20 GB of storage is a reasonable starting point. These are planning recommendations, not official Wallos minimum requirements.

   See Also: How to Host a Telegram Bot on Ubuntu VPS

   
   

   ---

   Compare Ubuntu VPS Plans

   KVM-SSD-1

   KVM-SSD-8

   KVM-SSD-16

   KVM-SSD-32

   CPU

   1 Core

   2 Cores

   4 Cores

   8 Cores

   Memory

   1 GB

   8 GB

   16 GB

   32 GB

   Storage

   16 GB NVMe

   128 GB NVMe

   256 GB NVMe

   512 GB NVMe

   Bandwidth

   1 TB

   4 TB

   8 TB

   16 TB

   Network

   1 Gbps

   1 Gbps

   1 Gbps

   1 Gbps

   Delivery Time

   ⏱️ Instant

   ⏱️ Instant

   ⏱️ Instant

   ⏱️ Instant

   Location

   US/EU/APAC

   US/EU/APAC

   US/EU/APAC

   US/EU/APAC

   Price

   $7.58*

   $39.50*

   $79.40*

   $151.22*

   View All

   Order

   Order

   Order

   Order

   KVM-SSD-1

   $7.58*

   CPU 1 Core

   Memory 1 GB

   Storage 16 GB NVMe

   Bandwidth 1 TB

   Network 1 Gbps

   Delivery Time ⏱️ Instant

   Location US/EU/APAC

   Order KVM-SSD-1

   KVM-SSD-8

   $39.50*

   CPU 2 Cores

   Memory 8 GB

   Storage 128 GB NVMe

   Bandwidth 4 TB

   Network 1 Gbps

   Delivery Time ⏱️ Instant

   Location US/EU/APAC

   Order KVM-SSD-8

   KVM-SSD-16

   $79.40*

   CPU 4 Cores

   Memory 16 GB

   Storage 256 GB NVMe

   Bandwidth 8 TB

   Network 1 Gbps

   Delivery Time ⏱️ Instant

   Location US/EU/APAC

   Order KVM-SSD-16

   KVM-SSD-32

   $151.22*

   CPU 8 Cores

   Memory 32 GB

   Storage 512 GB NVMe

   Bandwidth 16 TB

   Network 1 Gbps

   Delivery Time ⏱️ Instant

   Location US/EU/APAC

   Order KVM-SSD-32

   ---

2. Prepare Ubuntu

   Run the commands as root, or use sudo -i first.

   sudo -i
   

   Check the environment:

   cat /etc/os-release
   uname -m
   hostnamectl
   df -h /
   free -h
   

   Update installed packages:

   apt-get update
   apt-get upgrade -y
   

   Install utilities:

   apt-get install -y \
     ca-certificates \
     curl \
     gnupg \
     openssl \
     tar \
     gzip \
     sqlite3 \
     nginx \
     certbot \
     python3-certbot-nginx \
     ufw \
     unattended-upgrades
   

   Enable Nginx:

   systemctl enable --now nginx
   

   If an existing application uses TCP ports 80 or 443, inspect the active virtual hosts before proceeding.

3. Install Docker Engine and Compose

   We’ll use Docker’s official Ubuntu APT repository, rather than the convenience installation script. This follows Docker’s documented production installation approach.

   First, check for existing installations:

   docker --version 2>/dev/null || true
   docker compose version 2>/dev/null || true
   
   dpkg -l | grep -E \
     'docker|containerd|podman' || true
   

   If this is a fresh VPS, continue. If Docker is already hosting other workloads, inspect the packages before making changes.

   On a fresh server, remove conflicting packages:

   apt-get remove -y \
     docker.io \
     docker-compose \
     docker-compose-v2 \
     docker-doc \
     docker-buildx \
     podman-docker \
     containerd \
     runc
   

   Install the repository signing key:

   install -m 0755 -d /etc/apt/keyrings
   
   curl -fsSL \
     https://download.docker.com/linux/ubuntu/gpg \
     -o /etc/apt/keyrings/docker.asc
   
   chmod a+r /etc/apt/keyrings/docker.asc
   

   Create the APT source:

   cat > /etc/apt/sources.list.d/docker.sources <

   Install Docker:

   apt-get update
   
   apt-get install -y \
     docker-ce \
     docker-ce-cli \
     containerd.io \
     docker-buildx-plugin \
     docker-compose-plugin
   

   Enable the Docker service:

   systemctl enable --now docker
   systemctl enable --now containerd
   

   Verify the installation:

   docker version
   docker compose version
   systemctl is-active docker
   

   Test Docker:

   docker run --rm hello-world
   

   The test should print a message confirming that Docker Engine is working.

4. Create Wallos’s application directories

   Create the application and storage directories:

   install -d -m 0750 /opt/wallos
   install -d -m 0755 /opt/wallos/db
   install -d -m 0755 /opt/wallos/logos
   install -d -m 0700 /var/backups/wallos
   
   cd /opt/wallos
   

   The persistent directory layout will be:

   /opt/wallos/
   ├── compose.yaml
   ├── db/
   │   └── wallos.db
   └── logos/
   
   /var/backups/wallos/
   └── wallos-YYYY-MM-DD_HHMMSS.tar.gz
   

   Wallos officially uses two bind-mounted locations: the SQLite database directory and uploaded subscription logos.

5. Create the Docker Compose configuration

   Create the Compose file:

   cat > /opt/wallos/compose.yaml <<'YAML'
   services:
     wallos:
       image: bellamy/wallos:latest
       container_name: wallos
   
       restart: unless-stopped
   
       init: true
   
       ports:
         - "127.0.0.1:8282:80/tcp"
   
       environment:
         TZ: America/Chicago
   
       volumes:
         - ./db:/var/www/html/db
         - ./logos:/var/www/html/images/uploads/logos
   
       security_opt:
         - no-new-privileges:true
   
       logging:
         driver: json-file
         options:
           max-size: "10m"
           max-file: "5"
   
       stop_grace_period: 30s
   YAML
   

   This configuration adds several protections over the default example:

   See Also: How to Install Planka on Ubuntu VPS (5 Minute Quick-Start Guide)

   • Docker binds only to localhost, preventing direct public access to port 8282.
   • no-new-privileges prevents processes from gaining additional privileges through setuid/setgid execution.
   • Log rotation prevents uncontrolled Docker JSON log growth.
   • Persistent bind mounts preserve database and uploaded logos.
   • Docker automatically restarts Wallos after a daemon or server restart.

   We deliberately do not use privileged: true, host networking, or a mounted Docker socket.

   Validate the Compose file:

   cd /opt/wallos
   
   docker compose config --quiet
   

   Start the application:

   docker compose pull
   docker compose up -d
   

   Check the container:

   docker compose ps
   docker inspect wallos --format \
     '{{.State.Status}} {{if .State.Health}}{{.State.Health.Status}}{{end}}'
   

   Check logs:

   docker compose logs --tail=100 wallos
   

   Test HTTP from the server:

   curl -sSI http://127.0.0.1:8282/
   

   You should receive an HTTP response, typically 200 OK or another application-generated response.

   Verify that the application is not publicly bound:

   ss -ltnp | grep 8282
   

   Expected binding:

   127.0.0.1:8282
   

   If the container cannot write its database or logo directories, inspect ownership and permissions through the logs and fix the specific write-access problem. Do not apply chmod 777 to the installation.

6. Configure DNS

   Create an A record for your selected Wallos hostname.

   For this example:

   DNS setting	Value
   Type	A
   Hostname	wallos.example.com
   Value	Your VPS public IPv4
   TTL	300

   Check DNS resolution:

   apt-get install -y dnsutils
   
   dig +short A wallos.example.com
   dig +short AAAA wallos.example.com
   

   The A record should point to your server. If an AAAA record exists, it must also point to a server capable of serving this hostname over IPv6. Otherwise, remove the incorrect AAAA record before certificate issuance.

7. Configure the Nginx reverse proxy

   We will terminate TLS at Nginx and forward requests internally to the Wallos container.

   Create the virtual host:

   cat > /etc/nginx/sites-available/wallos.conf <<'NGINX'
   server {
       listen 80;
       listen [::]:80;
   
       server_name wallos.example.com;
   
       server_tokens off;
   
       access_log /var/log/nginx/wallos-access.log;
       error_log  /var/log/nginx/wallos-error.log warn;
   
       client_max_body_size 20m;
   
       location / {
           proxy_pass http://127.0.0.1:8282;
           proxy_http_version 1.1;
   
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
   
           proxy_set_header Connection "";
   
           proxy_connect_timeout 10s;
           proxy_send_timeout 60s;
           proxy_read_timeout 60s;
   
           proxy_buffering on;
           proxy_redirect off;
       }
   }
   NGINX
   

   Replace wallos.example.com with your actual hostname:

   See Also: Easily Install and Run Postal Email Platform on Ubuntu VPS (5 Minute Guide)

   sed -i \
     's/wallos\.example\.com/YOUR_ACTUAL_HOSTNAME/g' \
     /etc/nginx/sites-available/wallos.conf
   

   Alternatively, edit the file directly:

   nano /etc/nginx/sites-available/wallos.conf
   

   Enable the site:

   ln -s \
     /etc/nginx/sites-available/wallos.conf \
     /etc/nginx/sites-enabled/wallos.conf
   

   If this is a dedicated VPS with no other Nginx websites, you may remove the default site:

   rm -f /etc/nginx/sites-enabled/default
   

   Test and reload:

   nginx -t
   systemctl reload nginx
   

   Verify the HTTP reverse proxy using your real hostname:

   curl -I http://YOUR_ACTUAL_HOSTNAME/
   

   A successful response confirms Nginx can reach Wallos.

8. Configure the firewall

   For a typical production VPS, permit inbound SSH, HTTP, and HTTPS. Do not expose Wallos’s internal port 8282.

   Important: Before enabling UFW, allow the SSH port actually used by this VPS. An incorrect SSH rule can lock you out.

   Inspect SSH’s listening ports:

   ss -ltnp | grep sshd
   

   If this server uses your customary SSH port 2211, configure:

   ufw allow 2211/tcp
   

   If it uses standard SSH port 22 instead:

   ufw allow 22/tcp
   

   Allow web traffic:

   ufw allow 80/tcp
   ufw allow 443/tcp
   

   Enable the firewall only after verifying SSH access is permitted:

   ufw enable
   ufw status verbose
   

   If the server uses IPv6, ensure UFW’s IPv6 handling is enabled.

   Docker’s published ports can bypass certain UFW policies. Our Compose file avoids publicly publishing port 8282 by binding explicitly to loopback. Docker documents the associated firewall behavior.

9. Enable HTTPS with Let’s Encrypt

   Obtain and install the certificate:

   certbot --nginx \
     -d YOUR_ACTUAL_HOSTNAME \
     --redirect \
     --agree-tos \
     -m admin@example.com \
     --no-eff-email
   

   Replace admin@example.com with your actual administrative email address.

   This command will obtain the certificate, configure Nginx for HTTPS, and redirect ordinary HTTP requests to HTTPS.

   Verify:

   nginx -t
   systemctl reload nginx
   

   Check the certificate:

   openssl s_client \
     -connect YOUR_ACTUAL_HOSTNAME:443 \
     -servername YOUR_ACTUAL_HOSTNAME \
     </dev/null 2>/dev/null |
   openssl x509 -noout -subject -issuer -dates
   

   Test the website:

   curl -I https://YOUR_ACTUAL_HOSTNAME/
   

   Also verify HTTP redirection:

   curl -I http://YOUR_ACTUAL_HOSTNAME/
   

   The HTTP response should now redirect to HTTPS.

   Add HTTP security headers

   Once HTTPS works, open the SSL-enabled virtual host:

   See Also: How to Manage Ruby Apps in cPanel

   nano /etc/nginx/sites-available/wallos.conf
   

   Within the HTTPS server block, add:

   add_header X-Content-Type-Options "nosniff" always;
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   add_header X-Frame-Options "SAMEORIGIN" always;
   

   These are conservative baseline headers. Avoid applying a restrictive Content Security Policy without testing Wallos’s scripts and styles.

   Once you have verified HTTPS works for the hostname, you can optionally enable HSTS:

   add_header Strict-Transport-Security \
       "max-age=31536000" always;
   

   Use HSTS only when you’re prepared to maintain HTTPS continuously for the hostname.

   Reload Nginx:

   nginx -t && systemctl reload nginx
   

   Verify automatic certificate renewal

   systemctl list-timers --all |
   grep -i certbot
   

   Then:

   certbot renew --dry-run
   

   Certbot supports scheduled renewal and provides this dry-run verification procedure.

10. Create the first Wallos account

    Open your configured URL:

    https://YOUR_ACTUAL_HOSTNAME/

    On a fresh installation, Wallos presents its initial registration screen. Create a strong, unique administrative password.

    After signing in, review application settings, categories, currencies, and notification options.

    Because Wallos may contain subscription, billing, or business financial details, I recommend restricting registration to approved users after creating your initial account. Review the version’s administrative registration controls, if available.

    For strictly internal use, consider putting Wallos behind a VPN or identity-aware access gateway rather than exposing its login page directly to the Internet.

11. Check Wallos’s scheduled jobs

    Wallos uses scheduled tasks for payment-date maintenance, currency exchange updates, and notifications. Its Docker image incorporates a cron service, so do not immediately create duplicate host-level cron jobs.

    Inspect processes in the running container:

    docker exec wallos ps aux
    

    Inspect available cron configuration:

    docker exec wallos sh -c '
      ls -la /etc/cron.d 2>/dev/null || true
      ls -la /etc/crontabs 2>/dev/null || true
      cat /etc/crontab 2>/dev/null || true
    '
    

    Check container logs for scheduled-task failures:

    docker logs wallos --tail=200
    

    If you need to run a particular scheduled task manually for testing:

    docker exec wallos php \
      /var/www/html/endpoints/cronjobs/updatenextpayment.php
    

    Only invoke a task manually after checking its intended behavior, particularly tasks that send notifications. This avoids accidentally generating duplicate messages.

12. Configure automated daily backups

    Because Wallos stores subscription and application data in SQLite, database consistency matters.

    We’ll use a short application stop during the backup to capture a consistent database, uploaded logos, and the Compose file together. This is simple and dependable, though it introduces a brief nightly service interruption.

    Create the backup script

    cat > /usr/local/sbin/wallos-backup.sh <<'BASH' #!/usr/bin/env bash set -Eeuo pipefail APP_DIR="/opt/wallos" BACKUP_DIR="/var/backups/wallos" DATE="$(date +%Y-%m-%d_%H%M%S)" ARCHIVE="${BACKUP_DIR}/wallos-${DATE}.tar.gz" mkdir -p "$BACKUP_DIR" chmod 700 "$BACKUP_DIR" cd "$APP_DIR" # Prevent concurrent backup executions. exec 9>/run/wallos-backup.lock
    flock -n 9 || {
        echo "Another backup is running."
        exit 1
    }
    
    # Guarantee a restart if backup execution fails.
    STOPPED=0
    
    restart_wallos() {
        if [ "$STOPPED" -eq 1 ]; then
            docker compose up -d
        fi
    }
    
    trap restart_wallos EXIT
    
    echo "Stopping Wallos for consistent backup..."
    docker compose stop
    STOPPED=1
    
    echo "Creating archive..."
    tar -czf "$ARCHIVE" \
        compose.yaml db logos
    
    chmod 600 "$ARCHIVE"
    
    echo "Starting Wallos..."
    docker compose up -d
    STOPPED=0
    
    echo "Verifying archive..."
    tar -tzf "$ARCHIVE" >/dev/null
    
    echo "Deleting local archives older than 14 days..."
    find "$BACKUP_DIR" \
        -maxdepth 1 \
        -type f \
        -name 'wallos-*.tar.gz' \
        -mtime +13 \
        -delete
    
    echo "Backup complete: $ARCHIVE"
    BASH
    
    chmod 700 /usr/local/sbin/wallos-backup.sh
    

    The script uses a lock to prevent overlapping executions and an exit trap to restart Wallos if backup execution fails.

    See Also: Getting Started With WHMCS: Features, Benefits, and Setup Guide

    Test it manually:

    /usr/local/sbin/wallos-backup.sh
    

    Verify the application returns to service:

    docker compose -f /opt/wallos/compose.yaml ps
    

    Check the backup:

    ls -lh /var/backups/wallos/
    

    And inspect its contents:

    tar -tzf "$(ls -1t /var/backups/wallos/wallos-*.tar.gz | head -n 1)" | head -30
    

    Schedule nightly backups

    Create a systemd service:

    cat > /etc/systemd/system/wallos-backup.service <<'EOF'
    [Unit]
    Description=Backup Wallos application data
    Requires=docker.service
    After=docker.service
    
    [Service]
    Type=oneshot
    ExecStart=/usr/local/sbin/wallos-backup.sh
    EOF
    

    Create a timer:

    cat > /etc/systemd/system/wallos-backup.timer <<'EOF'
    [Unit]
    Description=Nightly Wallos backup
    
    [Timer]
    OnCalendar=*-*-* 03:30:00
    Persistent=true
    RandomizedDelaySec=5m
    
    [Install]
    WantedBy=timers.target
    EOF
    

    Enable it:

    systemctl daemon-reload
    systemctl enable --now wallos-backup.timer
    

    Verify:

    systemctl list-timers wallos-backup.timer
    

    Review logs:

    journalctl -u wallos-backup.service -n 50
    

    This retains approximately 14 days of local backup archives. For production, also replicate the backup archives to a separate server or off-site object-storage service; backups on the same VPS cannot protect against complete VPS or storage failure.

13. Test database integrity

    After you’ve created your initial account, Wallos should have created its SQLite database.

    Confirm:

    ls -lah /opt/wallos/db/
    

    Check the database:

    sqlite3 /opt/wallos/db/wallos.db \
      'PRAGMA integrity_check;'
    

    Expected output:

    ok
    

    If you see an error rather than ok, investigate before upgrading or performing additional database operations.

    See Also: How to Install Jitsi Meet on Ubuntu VPS

    For additional validation, periodically test restoring a backup to a separate VPS or isolated Docker environment.

14. Update Wallos safely

    I recommend manually controlled application updates rather than unattended container replacements. Image updates may contain database migrations or breaking changes, and maintaining a tested rollback path is important.

    Create an update script:

    cat > /usr/local/sbin/wallos-update.sh <<'BASH'
    #!/usr/bin/env bash
    set -Eeuo pipefail
    
    cd /opt/wallos
    
    echo "Backing up Wallos..."
    /usr/local/sbin/wallos-backup.sh
    
    echo "Pulling latest image..."
    docker compose pull
    
    echo "Recreating Wallos..."
    docker compose up -d
    
    echo "Current status:"
    docker compose ps
    
    echo "Recent logs:"
    docker compose logs --tail=50 wallos
    
    echo "HTTP check:"
    curl --fail --silent --show-error \
        http://127.0.0.1:8282/ \
        -o /dev/null
    
    echo "Update finished."
    BASH
    
    chmod 700 /usr/local/sbin/wallos-update.sh
    

    When you wish to update:

    /usr/local/sbin/wallos-update.sh
    

    For tighter production change control, pin the application to a tested immutable image digest rather than tracking latest. Before an upgrade, record the currently running image:

    docker inspect wallos \
      --format '{{.Image}}'
    

    A backup permits data recovery, but a database migration may not be backward-compatible with the previous image. Rollback may therefore require restoring both the previous image and a pre-upgrade database backup.

15. Harden Ubuntu and Docker

    Enable operating system security updates

    Ensure unattended upgrades is installed:

    apt-get install -y unattended-upgrades
    

    Enable automatic security updates:

    dpkg-reconfigure unattended-upgrades
    

    Verify:

    systemctl status apt-daily-upgrade.timer
    

    Automatic application image updates remain separate from Ubuntu’s APT security updates.

    Restrict Docker administration

    Avoid adding ordinary users to the docker group unless they are trusted system administrators. Membership provides privileges effectively equivalent to root access.

    Keep Docker administration limited to root or trusted privileged operators.

    Verify network exposure

    ss -ltnp
    

    Ensure only the intended services listen on public interfaces.

    Test Nginx:

    nginx -t
    

    Check firewall status:

    ufw status numbered
    

    Check Docker container privileges:

    docker inspect wallos \
      --format 'Privileged={{.HostConfig.Privileged}}'
    

    Expected:

    Privileged=false
    

    Check restart policy:

    docker inspect wallos \
      --format '{{.HostConfig.RestartPolicy.Name}}'
    

    Expected:

    unless-stopped
    

    Confirm data persistence:

    docker inspect wallos \
      --format '{{range .Mounts}}{{.Source}} -> {{.Destination}}{{println}}{{end}}'
    

    You should see the database and logo bind mounts.

16. Troubleshooting

    Symptom	Diagnosis
    Wallos returns HTTP 502	curl -I http://127.0.0.1:8282/
    Container exits immediately	docker logs wallos --tail=100
    Container reports unhealthy	docker inspect wallos --format '{{json .State.Health}}'
    Port 8282 already occupied	ss -ltnp \| grep 8282
    Database write failures	ls -la /opt/wallos/db
    Nginx configuration errors	nginx -t
    SSL renewal failures	certbot renew --dry-run
    Container won’t restart	journalctl -u docker -n 100
    Backup timer not running	systemctl status wallos-backup.timer

    For detailed live logs:

    See Also: Deploy OWASP Amass on Debian VPS

    cd /opt/wallos
    docker compose logs -f --tail=100
    

    Use Ctrl+C to exit the log viewer; the Wallos container remains running.

Final configuration summary

Once completed, your production deployment will have these characteristics:

Official references

• Wallos — Official GitHub Repository
• Official Wallos Docker Compose Configuration
• Docker Engine Installation on Ubuntu
• Certbot Installation and Renewal Instructions

Recommended production practice: Treat the SQLite database as critical business data, preserve regular off-site backups, and verify successful restores. The combination of persistent storage, HTTPS, firewall restrictions, and backup-first updates provides a solid foundation for running Wallos on an Ubuntu VPS.

Conclusion

You now know how to deploy Wallos on Ubuntu VPS with Docker Compose.