You picked Dokploy because you wanted Heroku-flavored ergonomics on your own VPS. Then you needed a message bus — pub/sub, JetStream persistence, maybe a WebSocket endpoint for the browser — and suddenly you're back in the YAML mines: writing a nats.conf , figuring out where the token lives, working out why Traefik won't terminate TLS in front of a raw TCP port, and wondering whether /varz is safe to expose to the internet (spoiler: it isn't).

I hit every one of those and packaged the fix as a single Dokploy Compose service: quochuydev/dokploy-nats . This post is the walkthrough I wish I'd had.

What you get

One docker-compose.yml that gives you:

NATS core on 4222 for in-cluster apps

JetStream with file-backed persistence (durable streams, KV, object store)

WebSocket on 8080 , ready to put behind Traefik as wss://

HTTP monitoring on 8222 — /healthz , /varz , /connz , /jsz

Token auth wired through env vars, no plaintext in the repo

It's deliberately boring.…