Merge remote-tracking branch 'origin/main' into next

app/Jobs/ApplicationDeploymentJob.php

@@ -1927,8 +1927,9 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 $envs->push($this->runtimeEnvironmentAssignment($env));
             }
 
-            // Check for PORT environment variable mismatch with ports_exposes
-            if ($this->build_pack !== 'dockercompose') {
+            // Check for PORT environment variable mismatch with ports_exposes.
+            // With readonly labels disabled, custom labels control proxy routing, so skip the check.
+            if ($this->build_pack !== 'dockercompose' && $this->application->settings->is_container_label_readonly_enabled) {
                 $detectedPort = $this->application->detectPortFromEnvironment(false);
                 if ($detectedPort && ! empty($ports) && ! in_array($detectedPort, $ports)) {
                     $this->application_deployment_queue->addLogEntry(

app/Livewire/Project/Application/General.php

@@ -992,6 +992,11 @@ class General extends Component
 
     public function getDetectedPortInfoProperty(): ?array
     {
+        // With readonly labels disabled, Ports Exposes is read-only and custom labels control proxy routing.
+        if (! $this->application->settings->is_container_label_readonly_enabled) {
+            return null;
+        }
+
         $detectedPort = $this->application->detectPortFromEnvironment();
 
         if (! $detectedPort) {

app/Livewire/Project/Shared/ScheduledTask/Add.php

@@ -39,6 +39,9 @@ class Add extends Component
 
     public int $timeout = 300;
 
+    #[Locked]
+    public string $serverTimezone = 'UTC';
+
     protected $rules = [
         'name' => 'required|string',
         'command' => 'required|string',
@@ -74,6 +77,8 @@ class Add extends Component
                 throw new \Exception('Invalid resource type');
         }
 
+        $this->serverTimezone = getServerTimezone($this->resource->destination?->server);
+
         if ($this->containerNames->count() > 0) {
             $this->container = $this->containerNames->first();
         }

app/Livewire/Project/Shared/ScheduledTask/Show.php

@@ -45,12 +45,16 @@ class Show extends Component
     #[Validate(['integer', 'required', 'min:60', 'max:36000'])]
     public $timeout = 300;
 
+    #[Locked]
+    public string $serverTimezone = 'UTC';
+
     public function mount(Application|Service $resource, ScheduledTask $task): void
     {
         $this->resource = $resource;
         $this->type = $resource->type();
         $this->parameters = get_route_parameters();
         $this->task = $resource->scheduled_tasks()->whereKey($task->id)->firstOrFail();
+        $this->serverTimezone = getServerTimezone($this->task->server());
         $this->syncData();
     }
 

resources/views/livewire/project/shared/scheduled-task/add.blade.php

@@ -2,7 +2,7 @@
     <div class="grid gap-4 sm:grid-cols-2">
         <x-forms.input placeholder="Database cleanup" id="name" label="Name" />
         <x-forms.input placeholder="0 0 * * * or daily"
-            helper="Use every_minute, hourly, daily, weekly, monthly, yearly, or a cron expression."
+            helper="Use every_minute, hourly, daily, weekly, monthly, yearly, or a cron expression. Runs in the server timezone ({{ $serverTimezone }}). Change it in the server settings."
             id="frequency" label="Schedule" />
     </div>
 

resources/views/livewire/project/shared/scheduled-task/show.blade.php

@@ -36,7 +36,7 @@
                     label="Name" required />
                 <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)"
                     placeholder="0 0 * * * or daily" id="frequency" label="Schedule"
-                    helper="Use every_minute, hourly, daily, weekly, monthly, yearly, or a cron expression."
+                    helper="Use every_minute, hourly, daily, weekly, monthly, yearly, or a cron expression. Runs in the server timezone ({{ $serverTimezone }}). Change it in the server settings."
                     required />
                 <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" type="number"
                     placeholder="300" id="timeout" helper="Maximum execution time from 60 to 36,000 seconds."

tests/Feature/ApplicationDeploymentControlVarFilteringTest.php

@@ -2029,3 +2029,24 @@ it('keeps heredoc bodies unchanged when it adds build secrets to a Dockerfile',
         "RUN --mount=type=secret,id=API_URL,env=API_URL python -c 'print(1)'",
     ]);
 });
+
+it('warns in the deployment log when PORT does not match ports_exposes', function () {
+    [$application, $server] = makeDeploymentControlVarFixture(['ports_exposes' => '80']);
+    createApplicationEnvironmentVariable($application, ['key' => 'PORT', 'value' => '3000']);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+    invokeDeploymentJobMethod($job, $reflection, 'generate_runtime_environment_variables');
+
+    expect(collect($job->recordedLogEntries)->contains(fn (string $entry) => str_contains($entry, 'PORT environment variable (3000)')))->toBeTrue();
+});
+
+it('does not warn about a PORT mismatch when readonly labels are disabled', function () {
+    [$application, $server] = makeDeploymentControlVarFixture(['ports_exposes' => '80']);
+    $application->settings()->update(['is_container_label_readonly_enabled' => false]);
+    createApplicationEnvironmentVariable($application, ['key' => 'PORT', 'value' => '3000']);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+    invokeDeploymentJobMethod($job, $reflection, 'generate_runtime_environment_variables');
+
+    expect(collect($job->recordedLogEntries)->contains(fn (string $entry) => str_contains($entry, 'PORT environment variable')))->toBeFalse();
+});

tests/Feature/ApplicationPortMismatchWarningTest.php

@@ -0,0 +1,66 @@
+<?php
+
+use App\Livewire\Project\Application\General;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::updateOrCreate(['id' => 0], []);
+    });
+
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id, 'network' => 'coolify-test']);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockerimage',
+        'ports_exposes' => '80',
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'PORT',
+        'value' => '3000',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $this->application->id,
+        'is_preview' => false,
+    ]);
+});
+
+test('shows a PORT mismatch warning when readonly labels are enabled', function () {
+    Livewire::test(General::class, ['application' => $this->application->fresh()])
+        ->assertSee('PORT mismatch detected');
+});
+
+/**
+ * Regression for #10941: with readonly labels disabled, the Ports Exposes field is
+ * read-only and custom labels control proxy routing, so the warning cannot be acted on.
+ */
+test('does not show a PORT mismatch warning when readonly labels are disabled', function () {
+    $this->application->settings()->update(['is_container_label_readonly_enabled' => false]);
+
+    Livewire::test(General::class, ['application' => $this->application->fresh()])
+        ->assertDontSee('PORT mismatch detected');
+});

tests/Feature/ScheduledJobManagerDispatchTest.php

@@ -1176,6 +1176,26 @@ it('records a midnight schedule in the server timezone, not in UTC', function ()
         ->and(ScheduledJobState::query()->where('schedule_key', 'midnight')->value('last_scheduled_for')->toDateTimeString())->toBe('2026-10-03 04:00:00');
 });
 
+it('runs a scheduled task in the server timezone, not in the instance timezone', function (string $serverTimezone, string $utcNow, bool $expectDispatch) {
+    config(['constants.coolify.self_hosted' => true]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]))->update(['instance_timezone' => 'Europe/Istanbul']);
+    Carbon::setTestNow(Carbon::parse($utcNow, 'UTC'));
+    Queue::fake();
+
+    $application = createScheduledTaskApplication();
+    $application->destination->server->settings()->update(['server_timezone' => $serverTimezone]);
+    createScheduledApplicationTask($application, ['frequency' => '59 23 * * *']);
+
+    (new ScheduledJobManager)->handle();
+
+    Queue::assertPushed(ScheduledTaskJob::class, $expectDispatch ? 1 : 0);
+})->with([
+    // 23:59 in Istanbul (UTC+3) is 20:59Z.
+    'UTC server at 23:59 Istanbul' => ['UTC', '2026-10-26 20:59:00', false],
+    'UTC server at 23:59 UTC' => ['UTC', '2026-10-26 23:59:00', true],
+    'Istanbul server at 23:59 Istanbul' => ['Europe/Istanbul', '2026-10-26 20:59:00', true],
+]);
+
 function createStaleEnqueuedOccurrence(string $scheduleKey, string $jobType, int $resourceId, Carbon $scheduledFor, int $minutesAgo = ScheduledJobDeliveryService::ENQUEUED_STALE_AFTER_MINUTES + 1): ScheduledJobDelivery
 {
     return ScheduledJobDelivery::create([