What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Run Concourse on a Linux VPS as three cooperating services: a web node, a worker node, and PostgreSQL. The practical order is PostgreSQL first, then shared secrets, the HTTPS-enabled web service, and finally one or more workers. Docker Compose is the most direct documented route for a single VPS, but it still requires a real database, key management, TLS, firewall rules, and a supported container runtime.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are building
Concourse separates control-plane work from build execution. The web node provides the UI, API, authentication, and pipeline scheduling. Workers execute jobs, tasks, and resource checks. PostgreSQL stores Concourse state, including pipeline configuration and other web-service data. The official installation documentation describes the system plainly: a Concourse installation is composed of a web node, a worker node, and a PostgreSQL node.
As an Amazon Associate I earn from qualifying purchases.
On a small VPS, all three may be associated with one machine, although PostgreSQL can be hosted separately. The web service must be reachable by administrators over HTTPS. Workers must reach the web node’s TSA endpoint on TCP port 2222, while the public interface normally uses TCP port 443. A worker is intentionally stateless and replaceable; PostgreSQL, pipeline YAML, credentials, and key material are the items that require durable backup and recovery planning.
Prerequisites and design decisions
Linux host and Docker
The documented Compose path works on Linux systems with Docker and Docker Compose available. Reserve enough CPU, memory, and disk for the number and size of concurrent builds. The web service’s demand follows API traffic and scheduling activity; worker demand follows task concurrency, resource checks, and the images those tasks run.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
PostgreSQL
Provide an already-running PostgreSQL database before starting Concourse. Record its hostname, database name, user, password, and any required connection or SSL settings. A local database container is possible, but the official Compose walkthrough assumes a database already exists, so a managed or separately administered PostgreSQL instance gives you a clearer backup boundary.
DNS, HTTPS, and network reachability
Create a DNS name for the web service and point it at the VPS (or at the TLS-terminating ingress in front of it). Set CONCOURSE_EXTERNAL_URL to the public HTTPS URL, not an internal hostname. The Compose example publishes host port 443 to Concourse’s internal port 8080. Workers need network access to the web node’s TSA listener on port 2222; keep that path private whenever possible.
Recommended Free Tools
Authentication and secret storage
Prepare a protected directory for the web keys and a separate protected directory for worker keys. The files must not be committed to a repository, copied into a public image, or made readable by unrelated users. Before exposing a VPS, replace demonstration credentials with a real authentication provider or strong local credentials and establish a rotation process.
Install in the documented order
- Prepare PostgreSQL. Create the database and account, verify that the web host can connect, and record the connection variables.
- Generate Concourse secrets. Create the session-signing key, TSA host key pair, and worker key pair. Keep private keys on the systems that use them; distribute only the corresponding public key where required.
- Deploy the web node. Mount the key directory read-only, configure the external HTTPS URL and PostgreSQL variables, publish ports 443 and 2222, then start the service.
- Deploy a worker. Configure the TSA public key, worker private key, TSA host, unique worker name, containerd runtime, and a sufficiently large work directory. Start it after the web node is available.
- Install and authenticate with
fly. Log in to the target and verify that the worker registers. - Submit a pipeline. Keep the YAML under version control and use
fly set-pipelineto publish it.
Generate and protect the keys
The web service expects a protected keys directory containing these files:
session_signing_keyfor signing user sessions.tsa_host_key, the TSA host’s private key.worker_key.pub, the public key authorized to register workers.
The worker side needs:
tsa_host_key.pub, the public key used to verify the TSA host.- The worker’s private key, matching the public key authorized by the web service.
Use filesystem permissions that allow only the Concourse service to read private material. Back up encrypted copies in an approved secret store. Losing a worker’s private key is recoverable by recreating that worker; losing the session-signing or TSA host keys can invalidate sessions or require coordinated reconfiguration, so document where the authoritative copies are kept.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Configure the web node with Docker Compose
Required environment
The official Compose configuration mounts the protected key directory read-only and sets the following variables:
CONCOURSE_SESSION_SIGNING_KEYCONCOURSE_TSA_HOST_KEYCONCOURSE_TSA_AUTHORIZED_KEYSCONCOURSE_EXTERNAL_URL- PostgreSQL host, database, user, password, and related connection variables documented for the web node
Set CONCOURSE_EXTERNAL_URL to the URL users will actually enter, including the HTTPS scheme. The Compose example maps host port 443 to Concourse port 8080 and exposes TSA on host port 2222. If TLS is terminated by a reverse proxy instead, preserve the same external URL and ensure the proxy forwards requests correctly; do not expose an unencrypted administrative interface by accident.
Authentication warning
The example uses a test:test local user as a demonstration. That pair is not an acceptable credential for a public VPS. Configure a stronger local account or an external identity provider before opening the service to the internet, and test login and logout through the public HTTPS hostname.
Start and verify the web service
- Place the Compose file and environment configuration in a directory readable only by administrators.
- Check that the key paths are mounted read-only and that PostgreSQL credentials are not hard-coded in a public repository.
- Start the service with
docker compose up -d. - Open the external HTTPS URL in a browser and inspect the container logs if the service does not become ready.
Do not proceed to worker registration until the web node can reach PostgreSQL and the HTTPS endpoint is stable.
Configure a Linux worker
Supported environment and runtime
The worker documentation lists Ubuntu 22.04 and Ubuntu 24.04 among tested distributions and gives a minimum tested kernel version of 5.15. User namespaces must be enabled. Memory and swap accounting are needed so Concourse can enforce task limits. Containerd and Guardian are the production Linux runtimes; containerd is the default choice for a new Compose deployment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Workers orchestrate build containers and therefore run as root. The official Compose example runs the worker container as privileged for that reason. Treat privileged execution as a boundary to secure: dedicate the host where practical, limit administrative access, keep the kernel current, and avoid placing unrelated workloads on the same machine.
Worker variables and mounts
Configure these settings in the worker service:
CONCOURSE_TSA_PUBLIC_KEY, pointing totsa_host_key.pub.CONCOURSE_TSA_WORKER_PRIVATE_KEY, pointing to the worker’s private key.CONCOURSE_TSA_HOST, the web node address reachable on TSA port 2222.- A unique worker name so administrators can identify it in the UI and CLI.
- The containerd runtime selection.
CONCOURSE_WORK_DIR, on a filesystem with enough room for active builds and fetched resources.
Mount the key directory read-only. Do not treat the work directory as durable application storage: workers are stateless and interchangeable, and replacing one should not require restoring its old filesystem.
Start and confirm registration
- Confirm that the worker can resolve and reach the TSA host on TCP 2222.
- Confirm that the worker’s private key matches the public key authorized by the web node.
- Start the worker with
docker compose up -d. - Authenticate with
flyand runfly workers. A connected worker should appear in the output.
Install and use the fly CLI
fly is Concourse’s control plane for authentication and pipeline submission. The Linux quick-start endpoint is:
/api/v1/cli?arch=amd64&platform=linuxDownload the binary from your Concourse HTTPS endpoint, make it executable, and place it on a directory in PATH. Then log in with a distinct target name for this instance:
fly login -t example -c https://ci.example.com -u YOUR_USERNAME -p YOUR_PASSWORDUse a different target name for every Concourse installation. This prevents a command intended for staging from silently changing a production pipeline. Prefer an interactive or secret-managed login method rather than leaving passwords in shell history.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Write and publish a pipeline
Pipelines are configured entirely through the fly CLI or a set_pipeline step. A normal pipeline YAML declares resources, jobs, and task plans. Tasks and resources bring their own container images, so install build dependencies in those images rather than modifying the worker host.
Save the definition as pipeline.yml, review it, and submit it:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchfly -t example set-pipeline
--pipeline my-pipeline
--config pipeline.ymlfly shows a diff and asks for confirmation. When generating YAML in a script or piping it from standard input, use --config -; the confirmation prompt is disabled in that mode. Keep pipeline files in version control, review changes like application code, and store credentials through Concourse’s credential-management integration rather than embedding secrets in YAML.
Firewall and TLS rules
| Port | Purpose | Recommended exposure |
|---|---|---|
| 443 | HTTPS UI and API through the external URL | Public, restricted by authentication and TLS policy |
| 2222 | TSA connection used by workers | Workers only, preferably a private network or allowlist |
| PostgreSQL port | Web-node database connection | Web node only; never expose broadly |
Allow inbound HTTPS to the web node and restrict port 2222 to known worker addresses or the private network. Restrict PostgreSQL access to the web node’s address range. Apply equivalent outbound rules so workers can reach TSA and can fetch the resources their pipelines require.
Concourse’s Let’s Encrypt integration stores the TLS certificate and key in the database. When using that integration, database encryption is imperative because a database backup then contains TLS private material. If TLS is terminated elsewhere, protect the proxy’s certificate store and maintain HTTPS from users to the proxy.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Backups, upgrades, and recovery
Back up the durable state
- Back up PostgreSQL regularly and test restoring it.
- Back up encrypted copies of the session-signing key, TSA host key, and worker authorization material.
- Store pipeline YAML in version control outside the VPS.
- Document credential-provider configuration and the exact Compose files used for deployment.
Worker work directories do not belong in the backup set as application data. A replacement worker can be recreated with the same runtime, keys, network access, and capacity. The database and definitions are what let the web node recover the service’s logical state.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReplace a failed worker
- Provision a supported Linux host or clean worker container.
- Install or select containerd, enable user namespaces, and verify memory and swap accounting.
- Assign a new unique worker name and provide a new worker key pair.
- Authorize the new public key on the web node, configure TSA variables, and start the worker.
- Run
fly workersand wait for the new worker to show as connected before scheduling critical jobs there.
Scaling rule of thumb
CPU and memory planning should follow actual scheduling and build concurrency. The worker guide suggests considering another worker when container counts approach roughly 200 on one worker. This is an operational guideline, not a universal capacity guarantee; image size, task duration, disk speed, and memory limits can make a lower or higher count appropriate.
Docker Compose compared with other deployment paths
| Approach | Best fit | What you must operate |
|---|---|---|
| Docker Compose | One VPS or a small, explicitly managed installation | Host Docker, Compose files, TLS ingress, PostgreSQL connectivity, worker isolation, backups, and upgrades |
| Helm | A Kubernetes environment with established cluster operations | Cluster lifecycle, chart values, ingress, persistent PostgreSQL, secrets, and rollback procedures |
| Direct managed VM or hardware deployment | Teams that need package-level control and already have VM administration practices | Service supervision, runtime installation, TLS, firewalling, PostgreSQL, upgrades, and worker replacement |
Choose Compose when the VPS is intentionally small and you want the shortest documented path. Choose Helm only when Kubernetes is already a reliable operational platform; introducing it solely for Concourse adds cluster complexity. Whichever path you choose, compare PostgreSQL placement, TLS and ingress ownership, worker isolation, upgrade and rollback steps, backup responsibility, and how quickly a failed worker can be recreated.
Troubleshooting checklist
The web service will not start
- Check PostgreSQL hostname, credentials, database name, and network access.
- Verify that all three web key files exist at the mounted paths and are readable by the service.
- Confirm that
CONCOURSE_EXTERNAL_URLuses the public HTTPS hostname. - Inspect Compose logs for an invalid variable, unreadable key, or database migration error.
The worker is missing from fly workers
- Test DNS and TCP connectivity from the worker to the TSA host on port 2222.
- Ensure the worker uses the matching TSA public and private keys.
- Check that the web firewall allows the worker address while the worker firewall permits outbound TSA traffic.
- Verify the worker is running as root with the intended containerd runtime and that its work directory is writable.
Builds fail before the task runs
- Check free space under
CONCOURSE_WORK_DIR; fetched resources and active containers consume it. - Confirm user namespaces, memory accounting, and swap accounting on the Linux host.
- Review the task image and resource definitions. Dependencies belong in those images, not as ad-hoc packages on the worker.
- If one worker is near its container or memory limits, add capacity rather than treating the worker filesystem as permanent storage.
Users cannot log in
- Verify DNS, certificate validity, and proxy forwarding to Concourse’s internal port 8080.
- Confirm that the configured authentication provider or local credentials are active.
- Do not use the demonstration
test:testaccount on an internet-facing service.
Production readiness checklist
- PostgreSQL is reachable only from the web node and has tested backups.
- HTTPS works on the configured external URL and certificates are protected.
- Port 2222 is limited to worker networks.
- Private keys and credentials are outside source control and have an owner and rotation procedure.
- Workers use a supported Linux kernel, enabled user namespaces, memory and swap accounting, containerd or Guardian, and adequate work-directory capacity.
- At least one worker appears as connected in
fly workers. - Pipeline YAML is versioned and can be reapplied with
fly set-pipeline. - A failed worker can be recreated without restoring its old work directory.
- Web-node, database, and worker logs are monitored, and an operator knows how to revoke keys and rotate credentials.
Final setup sequence
For a single Linux VPS, the reliable path is: provision PostgreSQL, generate and protect the Concourse keys, deploy the HTTPS web node with its database variables, allow only the required firewall paths, deploy a privileged containerd worker with a replaceable work directory, verify registration with fly workers, and publish version-controlled YAML with fly set-pipeline. Keep PostgreSQL, keys, credentials, and pipeline definitions durable; treat workers as disposable capacity that can be added or rebuilt as workload changes.
Frequently Asked Questions
Can the web node and worker run on the same Linux VPS?
Yes. Docker Compose can place both services on one Linux host, provided the host has enough CPU, memory, storage, and network capacity. The worker still needs the documented runtime, root privileges, and access to TSA on port 2222.
Does Concourse require PostgreSQL?
Yes. PostgreSQL is the database node in the Concourse architecture. The documented Compose route assumes an already-running PostgreSQL database and requires its connection settings.
Which ports should I open?
Expose HTTPS on port 443 for the UI and API. Expose TSA on port 2222 only to worker addresses or a private network, and restrict the PostgreSQL port to the web node.
What happens if a worker fails?
Workers are stateless and replaceable. Recreate the worker with the supported Linux runtime, keys, TSA settings, unique name, and sufficient work-directory capacity; durable state remains in PostgreSQL and your pipeline and credential systems.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
